# Page snapshots

An error message says a check failed; a **snapshot** shows what the checker actually got. It is often the fastest
way to tell a real outage from a false alarm: an error page, a login wall, a CAPTCHA, an empty body and a slow page
all look different in a snapshot even when the error text is similar.

## Which checks capture a snapshot

| Monitor type | What is captured | When |
|---|---|---|
| Website / HTTP, API | The HTTP response the checker received: status line, headers and body | On a failing check (or a redirect loop) - at the moment a monitor goes down and on later failing checks while it stays down |
| Content check, Transaction | A screenshot of the page in the browser (WebP image) | On the browser check's run |
| Page speed | A screenshot of the loaded page (WebP image) | On the browser check's run |
| Ping, Port, DNSBL, SSL / domain expiry, Web Risk, Database, SNMP, Counter | Nothing - there is no page to capture | - |

A successful HTTP check stores no snapshot: snapshots exist to show evidence of a failure.

## Find a snapshot in the app

1. Open the monitor's statistics page (`/sites/stats/{id}`).
2. Open the outage from **Latest incidents** or the **Outages** view of **Recent checks**.
3. In the outage panel, the **Snapshot** section shows what was captured. For an HTTP snapshot, switch between
   **plain** (the raw response text) and **html** (the page rendered from the captured body).

## Read a snapshot with the API

A result that has one carries `hasSnapshot: true` and a `snapshotUrl`:

```bash
curl "https://api2.host-tracker.com/monitor/MONITOR_ID/result?state=down&from=START&to=END" \
  -H "Authorization: Bearer $HT_TOKEN"
```

Download it with `GET /monitor/{monitorId}/result/{resultId}/snapshot` (scope `monitor:read`):

- HTTP/API snapshots are returned as `text/plain` (headers and body). Add `?as=html` to get the captured page as
  HTML, with its original content type, a `<base>` tag so relative links resolve, and a `noindex` marker.
- Browser snapshots are returned as `image/webp`.
- Responses carry `ETag` and `Last-Modified`; send `If-None-Match` to get `304 Not Modified` for a copy you already
  have. Snapshots never change once stored.

For a monitor with public statistics (`openStat`), its snapshots are public too.

## Reading an HTTP snapshot

- **Status line and headers** show what the server really answered - for example a `403` with a `cf-ray` header
  from a CDN challenge, or a `503` from a load balancer.
- **The body** shows whether the page was an error page, a maintenance page, a login form or your real content
  missing an expected keyword. See [Why is it down](/incidents/why-is-it-down/).

## Related

- [Reading results and incidents](/incidents/reading-results/)
- [Why is it down](/incidents/why-is-it-down/)
- [What is an incident](/incidents/what-is-an-incident/)