Skip to content
pulseback
Waitlist Join the waitlist
Docs menu

REST API & API keys

Everything you can click, over HTTPS with a workspace API key. Authentication, conventions, errors and the endpoint groups.

Updated October 27, 2026

The dashboard and the mobile app use the same API you do. Anything you can do in the app, you can script.

Authentication

Create a key in Settings → API keys (admins only). The full key is shown once; Pulseback stores only a hash, and the list shows its prefix (pbk_3fA9…) and when it was last used.

Send it as a bearer token:

curl https://app.pulseback.io/api/workspaces/$WID/monitors \
  -H "Authorization: Bearer pbk_…"
  • A key belongs to one workspace and only reaches /api/workspaces/:wid/… routes of that workspace.
  • It acts with the admin role, on behalf of the admin who created it. Delete the key and it stops working immediately.
  • Your workspace id is in the dashboard URL: https://app.pulseback.io/w/<wid>.
  • Keep keys in a secret store, never in client-side code.

Conventions

  • Base URL: https://app.pulseback.io/api. JSON in, JSON out, over HTTPS only.
  • Times are ISO-8601 in UTC. Ids are prefixed strings (mon_…, inc_…). Incident routes accept the id or the incident number: /incidents/482.
  • Lists come inside a named key ({ "monitors": [...] }). Paginated lists are { "items": [...], "cursor": "…" }; pass ?cursor= for the next page until cursor is null.
  • Request bodies are validated against the documented fields; unknown fields are ignored.

Errors

Every non-2xx response has the same shape:

{ "error": { "code": "plan_limit", "message": "Your plan allows 25 monitors.", "details": { "limit": "monitors", "plan": "starter", "upgradeTo": "team" } } }
code HTTP Meaning
bad_request, validation 400 The body or query didn’t validate. details lists the problems by field.
unauthorized 401 Missing or invalid key.
forbidden 403 The key can’t reach this workspace or route.
not_found 404 No such resource in this workspace.
conflict 409 The change conflicts with current state, e.g. deleting a policy that monitors still use.
plan_limit 402 Over a plan limit or using a feature your plan doesn’t include. details says which limit and which plan includes it.
rate_limited 429 Too many requests. Back off and retry.
unavailable, internal 5xx Our side. Retry with backoff.

Endpoints

All paths are under https://app.pulseback.io/api/workspaces/:wid.

Monitors

Method Path What
GET /monitors List, with ?status=all|issues|paused, ?environment=, ?type=, ?q=
POST /monitors Create (fields)
GET PATCH DELETE /monitors/:id Read, update, delete
POST /monitors/:id/pause, /resume Pause or resume
POST /monitors/:id/check Run now from every region
GET /monitors/:id/stats?range=24h|7d|30d Uptime and response times
GET /monitors/:id/results Raw results, newest first, paginated
POST /monitors/import Import from StatusCake or CSV

Incidents

Method Path What
GET /incidents List, with ?filter=open|mine|resolved|all, ?severity=, ?environment=
POST /incidents Open one by hand, paging or not
GET PATCH /incidents/:id Read; change title, severity, status or owner
POST /incidents/:id/acknowledge, /resolve, /reopen, /escalate Lifecycle actions, with an optional note
POST /incidents/:id/reassign Page a person or schedule instead
GET /incidents/:id/timeline Every alert, page, acknowledgement and note
POST /incidents/:id/notes Add a note
POST /incidents/:id/status-updates Post to status pages
GET PUT /incidents/:id/postmortem Read or save the postmortem

On-call

Method Path What
GET POST /schedules List, create
GET PATCH DELETE /schedules/:id Read, update, delete
GET POST /schedules/:id/overrides List, create overrides
GET /shifts?from=&to= Computed shifts with overrides applied (up to 62 days)
GET POST /swaps List, request swaps
GET POST /escalation-policies List, create
GET PATCH DELETE /escalation-policies/:id Read, update, delete

Status pages

Method Path What
GET POST /status-pages List, create
GET PATCH DELETE /status-pages/:id Read, update (including components), delete
POST /status-pages/:id/domain/verify Verify a custom domain
GET POST /status-pages/:id/posts List, post updates
GET POST /status-pages/:id/maintenance List, schedule maintenance
GET /status-pages/:id/subscribers Subscribers, paginated

Integrations, changes and members

Method Path What
GET POST /integrations Events API, email, GitHub, deploy webhook, Slack, webhook
POST /integrations/:id/rotate-key New key for an inbound integration
POST /integrations/:id/test Send a test to an outbound integration
GET /changes Recorded deploys, paginated
GET /deliveries Every page, call, text and message sent
GET /overview What the dashboard home shows
GET /members Members and pending invites

Public endpoints that don’t use an API key: the Events API, deploy webhooks, heartbeat pings and the status page JSON.

Example: acknowledge an incident from a script

curl -X POST https://app.pulseback.io/api/workspaces/$WID/incidents/482/acknowledge \
  -H "Authorization: Bearer $PULSEBACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "note": "Acknowledged by the deploy bot: rolling back." }'

Example: who’s on call?

curl "https://app.pulseback.io/api/workspaces/$WID/shifts?from=2026-11-02T00:00:00Z&to=2026-11-09T00:00:00Z" \
  -H "Authorization: Bearer $PULSEBACK_API_KEY"