Monitor types reference

WatchFor supports 25 monitor types. This page lists, for each type, exactly what to send to the API: the type value, the target format, the config fields the type accepts, the alert metrics you can build rules from (with the exact string to pass as the alert-rule metric), and the default rules the system creates automatically.

TCP

TCP port connectivity + optional payload match.

• Type value (type field): tcp
• Target: host:port — e.g. example.com:443

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Slow TCP Connect — metrics['tcp.connect_time_ms'] > 1000 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

DNS

Resolve a record and check answers + timing.

• Type value (type field): dns
• Target: domain or IP — e.g. example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Slow DNS Lookup — metrics['dns.check_time_ms'] > 1000 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

HTTP / HTTPS

Monitor a web page or HTTP endpoint.

• Type value (type field): http
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Unexpected Status Code — status_code not_in_groups ["2xx", "3xx"] (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

SSL / TLS

Certificate expiry, chain, hostname + TLS version.

• Type value (type field): ssl
• Target: domain or host:port — e.g. example.com:443

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• SSL Expiry Warning — metrics['ssl.days_until_expiry'] < 14 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

UDP

UDP query + response match.

• Type value (type field): udp
• Target: host:port — e.g. example.com:53

Default alert rules (created automatically):

• Availability Check — success == false (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

ICMP (Ping)

Host reachability + packet loss + latency.

• Type value (type field): icmp
• Target: domain or IP — e.g. example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

MTR (Traceroute)

Per-hop path analysis to a destination.

• Type value (type field): mtr
• Target: domain or IP — e.g. example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Destination Unreachable — metrics['mtr.destination_reached'] == 0 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Sitemap

Crawl a sitemap.xml and check for broken URLs.

• Type value (type field): sitemap
• Target: https URL — e.g. https://example.com/sitemap.xml

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Sitemap Missing — metrics['sitemap.found'] == 0 (critical)
• Broken URL Ratio — metrics['sitemap.broken_percent'] > 20 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Favicon

Check a site's favicon is served correctly.

• Type value (type field): favicon
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Favicon Missing — metrics['favicon.found'] == 0 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

CDN

Detect the CDN in front of a site.

• Type value (type field): cdn
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Brotli

Check Brotli compression support.

• Type value (type field): brotli
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Brotli Not Supported — metrics['brotli.supported'] == 0 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Breach

Watch a domain for newly reported data breaches.

• Type value (type field): breach
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• New Breach Within Window — metrics['breach.last_added_age_hours'] < 48 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

CMS

Detect the CMS powering a site.

• Type value (type field): cms
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

SMTP

Mail server connectivity, relay + STARTTLS checks.

• Type value (type field): smtp
• Target: domain or host:port — e.g. mail.example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Open Relay Detected — metrics['smtp.open_relay'] == 1 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

FTP

FTP connect, auth, list, write + speed.

• Type value (type field): ftp
• Target: domain, IP or host:port — e.g. ftp.example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Connection Failed — metrics['ftp.connect_success'] == 0 (critical)
• Authentication Failed — metrics['ftp.authentication_success'] == 0 (critical)
• Write Test Failed — metrics['ftp.write_success'] == 0 (critical)
• List Failed — metrics['ftp.list_success'] == 0 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

SFTP

SSH file transfer connect, auth, list, write + speed.

• Type value (type field): sftp
• Target: domain, IP or host:port — e.g. sftp.example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Connection Failed — metrics['sftp.connect_success'] == 0 (critical)
• Authentication Failed — metrics['sftp.authentication_success'] == 0 (critical)
• Write Test Failed — metrics['sftp.write_success'] == 0 (critical)
• List Failed — metrics['sftp.list_success'] == 0 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

WebSocket

WebSocket handshake, ping + pattern match.

• Type value (type field): websocket
• Target: ws:// or wss:// URL — e.g. wss://example.com/ws

Default alert rules (created automatically):

• Availability Check — success == false (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Domain (RDAP)

Domain registration + expiry via RDAP.

• Type value (type field): rdap
• Target: domain — e.g. example.com

Default alert rules (created automatically):

• Domain Expiry — metrics['rdap.days_until_expiry'] < 30 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Blacklist (RBL)

Check an IP/domain against DNS blacklists.

• Type value (type field): blacklist
• Target: domain or IP — e.g. example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Listed on Any RBL — metrics['blacklist.listed_count'] > 0 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

NTP

Time server offset, sync + stratum.

• Type value (type field): ntp
• Target: domain, IP or host:port — e.g. pool.ntp.org

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Clock Offset Too High — metrics['ntp.offset_abs_ms'] > 100 (critical)
• Server Not Synchronized — metrics['ntp.leap_unsync'] > 0 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Email Security

SPF, DMARC + DKIM policy checks for a domain.

• Type value (type field): email_policy
• Target: domain — e.g. example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• SPF Record Missing — metrics['spf.present'] == 0 (critical)
• DMARC Record Missing — metrics['dmarc.present'] == 0 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Core Web Vitals

Full Lighthouse audit — performance, CWV, SEO.

• Type value (type field): browser
• Target: https URL — e.g. https://example.com

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• LCP Poor — metrics['lighthouse.lcp_ms'] > 4000 (critical)
• CLS Poor — metrics['lighthouse.cls'] > 0.25 (critical)
• INP Poor — metrics['lighthouse.inp_ms'] > 500 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

Heartbeat / Cron

Dead-man's switch — your job pings a URL; we alert if it goes silent.

• Type value (type field): heartbeat
• Target: server-assigned ping URL (do not set) — e.g. /p/<token> (generated on create)

Default alert rules (created automatically):

• Missed Schedule — metrics['heartbeat.missed'] >= 1 (critical)
• Run Failed — metrics['heartbeat.run_failed'] >= 1 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

MCP Server

Model Context Protocol handshake, tools + drift.

• Type value (type field): mcp
• Target: https URL — e.g. https://mcp.example.com/mcp

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• Tool Inventory Changed — metrics['mcp.inventory_changed'] == 1 (warning)
• No Tools Exposed — metrics['mcp.tools_count'] == 0 (critical)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):

API

Full HTTP request with JSON/status assertions and value extraction.

• Type value (type field): api
• Target: https URL — e.g. https://api.example.com/health

Default alert rules (created automatically):

• Availability Check — success == false (critical)
• HTTP Status Evaluation — api.status_code not_in_groups ["2xx", "3xx"] (critical)
• Assertions Failed — metrics['api.assertions_failed'] > 0 (critical)
• SSL Expiry Warning — metrics['api.ssl_days_until_expiry'] < 30 (warning)

Alert metrics — values for the metric field of POST /monitors/{id}/alert-rules:

Config fields (config object on create/update):