API reference

A small REST API over HTTPS. JSON in, JSON out.

  • Base URL: https://api.scmon.io
  • Auth: Authorization: Bearer scmon_… on every endpoint except account registration.
  • Rate limit: 120 requests/minute per client (tighter per-key limits apply at higher tiers).
  • Errors: non-2xx responses return { "error": "code", "details"?: … }.

Authentication

Register an account to get your first key, then send it as a Bearer token. Keys are shown once at creation — store them securely. You can mint additional keys, each optionally locked to an IP allowlist.

Accounts & keys

MethodPathAuthDescription
POST/v1/accounts—Register {email, password} (password ≥ 10 chars). Returns the account and first API key. 409 if the email exists.
GET/v1/account✓Your profile: plan, max_watches, credit_balance, webhook_secret.
POST/v1/keys✓Mint a key. Optional { "ipAllowlist": ["1.2.3.4", "10.0.0.0/24"], "scopes": [] }.
GET/v1/keys✓List your keys (prefixes only — never the secret).
DELETE/v1/keys/:id✓Revoke a key (204).

Watches

MethodPathAuthDescription
POST/v1/watches✓Create a watch. 402 at your plan’s watch limit.
GET/v1/watches✓List watches.
GET/v1/watches/:id✓Fetch one.
PATCH/v1/watches/:id✓Update fields or toggle active.
DELETE/v1/watches/:id✓Delete (204).

IP allowlisting

A key created with an ipAllowlist is rejected unless the request’s source IP matches one of its entries (single IPs or CIDR ranges). SCMon reads the real client IP at the Cloudflare edge, so a request needs both a valid key and an allowed IP.