Skip to content
Overwatch API

Overview

Overwatch API v1

Section titled “ Overwatch API v1 ”

Overwatch is a multitenant website monitoring service built around four per-site apps: Broken Links (dead-link crawling, the core), Accessibility (a rendered axe-core scan), Uptime (multi-region monitors), and Performance (real-user Core Web Vitals from CrUX). Each app is toggled per site and serves its results over this HTTP API.

This reference covers the full public /v1 surface — both the endpoints a third-party CMS integration (Umbraco, Sanity, …) calls with an API key, and the endpoints the Overwatch dashboard calls with a session. Every request is scoped to one organization (tenant); you only ever see your own organization’s sites and reports.

Authentication

Two credentials are accepted, both resolving to one organization:

  • API key — send an organization-scoped key in the x-api-key header. This is the credential for CMS integrations. Keys may additionally be scoped to a subset of the organization’s sites.
  • Dashboard session — a Better Auth session, sent as Authorization: Bearer <sessionToken> (or a cookie), scoped to the session’s active organization.

Some endpoint groups are session-only — API-key callers get a 403: API-key management (/v1/keys*), member management (/v1/members*), org-wide usage (/v1/usage), billing (/v1/billing), notification settings (/v1/notifications*, /v1/sites/{id}/notifications), and account quotas (/v1/me/*). Each endpoint’s description states its auth and role requirements. See the Authentication guide for details on keys, sessions, and roles.

Conventions

  • All timestamps on persisted records (*_at fields) are epoch milliseconds. Two exceptions: live crawl status uses counters, and API key records use ISO 8601 strings (they come from the auth layer).
  • Boolean-ish columns such as enabled are returned as 0 or 1.
  • Errors are returned as { "error": "<message>" } with an appropriate HTTP status code.

Information

  • OpenAPI version: 3.1.0

Operations

Section titled “ Operations ”
GET
/v1/sites
POST
/v1/sites
GET
/v1/sites/overview
DELETE
/v1/sites/{id}
PATCH
/v1/sites/{id}
POST
/v1/sites/{id}/crawl
POST
/v1/sites/{id}/a11y-scan
GET
/v1/sites/{id}/status
GET
/v1/sites/{id}/history
GET
/v1/sites/{id}/report
GET
/v1/sites/{id}/report.pdf
GET
/v1/sites/{id}/a11y-report
POST
/v1/sites/{id}/a11y-suppressions
DELETE
/v1/sites/{id}/a11y-suppressions/{suppressionId}
PUT
/v1/sites/{id}/a11y-manual-checks
DELETE
/v1/sites/{id}/a11y-manual-checks/{sc}
GET
/v1/sites/{id}/gsc
DELETE
/v1/sites/{id}/gsc
POST
/v1/sites/{id}/gsc/connect
GET
/v1/sites/{id}/gsc/properties
POST
/v1/sites/{id}/gsc/property
GET
/v1/sites/{id}/search-console
GET
/v1/sites/{id}/seo-report
GET
/v1/uptime/monitors
GET
/v1/sites/{id}/uptime/monitors
POST
/v1/sites/{id}/uptime/monitors
DELETE
/v1/sites/{id}/uptime/monitors/{monitorId}
PATCH
/v1/sites/{id}/uptime/monitors/{monitorId}
GET
/v1/sites/{id}/uptime/monitors/{monitorId}/live
GET
/v1/sites/{id}/uptime/monitors/{monitorId}/report
GET
/v1/sites/{id}/uptime/monitors/{monitorId}/metrics
GET
/v1/sites/{id}/crux
GET
/v1/notifications
PATCH
/v1/notifications
POST
/v1/notifications/test
GET
/v1/sites/{id}/notifications
DELETE
/v1/sites/{id}/notifications
PATCH
/v1/sites/{id}/notifications
GET
/v1/sites/{id}/usage
GET
/v1/usage
GET
/v1/billing
PATCH
/v1/billing
GET
/v1/keys
POST
/v1/keys
POST
/v1/keys/{id}/revoke
POST
/v1/keys/{id}/reroll
GET
/v1/members
POST
/v1/members/invitations
POST
/v1/members/invitations/{id}/cancel
PATCH
/v1/members/{memberId}/access
PATCH
/v1/members/{memberId}/role
DELETE
/v1/members/{memberId}
GET
/v1/me/org-quota
POST
/v1/me/limit-requests

Authentication

Section titled “ Authentication ”

ApiKeyAuth

Section titled “ ApiKeyAuth ”

An organization-scoped API key minted from the Overwatch dashboard.

Security scheme type: apiKey

Header parameter name: x-api-key

BearerAuth

Section titled “ BearerAuth ”

A dashboard session token, scoped to the session’s active organization.

Security scheme type: http