# Monitor fields by type

This page lists every member a `POST /monitor` or `PATCH /monitor/{id}` body can carry, type by type, so a valid
request can be built without guessing. Values come from the API's own type registry; where a field's published
description is known to be wrong, the table states what the check **actually** does.

The same schema is served live: `GET /monitor/type/{type}` (one type) and `GET /monitor/type/schema` (all types),
no token needed. For what each setting means for you in the app, follow the link in each type's section.

## Build a valid body in five steps

1. **Pick the type** and read its catalogue row: `GET /monitor/type` (MCP `list_monitor_types`). Note
   `minInterval` (seconds), `fixedInterval` (the four self-scheduling types), `requiresPool` and, with a token,
   `accountLimits.available` (whether your plan includes the type).
2. **Set the address** in `url` in the form the type expects (see each section). Database and SNMP monitors take no
   `url`; a Counter monitor takes `settings.probeUrl` instead.
3. **Set the schedule**: `interval` in **seconds**, one of your plan's values (`GET /account` -> `limits.intervals`)
   and at least the type's `minInterval`. Omit it for the four fixed-cadence types. Omitted on other types, it
   defaults to 180 (3 minutes), which fails on types whose minimum is higher.
4. **Set locations** for the location-based types (`http`, `api`, `waterfall`, `cntCheck`, `tran`, `ping`,
   `port`): `"locations": {"pools": ["allworld"]}` or pool ids from `GET /agent/pool`. The other types refuse
   `locations`.
5. **Add `settings`** for the type, then add `alertSubscriptions` if anyone should be alerted - an API-created
   monitor has none. Try it first with `POST /monitor?dryRun=true`, which validates without creating.

Units used everywhere on this page: time values inside `settings` are **milliseconds** unless the field says
otherwise; `interval` and window lengths are **seconds**; instants are **Unix seconds**.

## Members common to every type

| Member | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `type` | string | `http`, `api`, `waterfall` (input alias `pageSpeed`), `cntCheck`, `tran`, `ping`, `port`, `dnsbl`, `domainExp`, `sslExp`, `webRisk`, `counter`, `database`, `snmp` | - | yes, on create | Cannot be changed after creation. |
| `url` | string | Depends on the type (see each section) | - | yes, except `database`, `snmp` and `counter` | Stored as sent; the normalised form the check uses is read back as `effectiveUrl` when it differs. |
| `name` | string | up to 255 characters | the address | no | Label in alerts, reports and status pages. |
| `interval` | integer, seconds | a value from `limits.intervals`, at least the type's `minInterval` | 180 | no | Ignored (with a warning) for `dnsbl`, `domainExp`, `sslExp` (6 hours) and `webRisk` (12 hours). |
| `cronSchedule` | string or null | 5-field cron expression, UTC | none | no | Replaces `interval`; `null` goes back to the interval. Plan feature. Not for the fixed-cadence types. Check it with `POST /monitor/validate-cron`. |
| `enabled` | boolean | | `true` | no | `false` pauses: no checks, no alerts. |
| `tags` | array of strings | non-blank | none | no | Replaces the whole set. |
| `addTags`, `removeTags` | array of strings | | - | no | Update only; edits the set without replacing it. Never together with `tags`. |
| `locations.pools` | array of strings | pool ids from `GET /agent/pool`, at least one; `"allworld"` = everywhere | none | yes, for location-based types | Refused for the other types. The selection must reach 7 live locations (`insufficient_agents`). |
| `locations.fallback` | string or null | `starve`, `geo`, `world` | `starve` | no | What to do when the chosen locations are unavailable: wait, use the closest, use any. Location-based types only. |
| `locations.excludedAgents` | array of GUIDs | agent ids from `GET /agent` | none | no | Keeps specific locations out even inside a chosen pool. |
| `recheck.strategy` | string | `noRecheck`, `fullAgreement`, `downFullAgreement`, `minNumDown`; `""` resets | majority vote | no | How a failure is confirmed. Has no effect on `cntCheck`, `counter` and the four fixed-cadence types (not stored). |
| `recheck.minNumDown` | integer | 1-10 | - | with `minNumDown` | Locations that must fail. Use 1-7: a recheck asks at most 7 locations, as the app's editor offers. |
| `attached` | object | `dnsbl`, `sslExp`, `domainExp`, `webRisk`: each `true`, `false` or `{"enabled": ...}` | all off | no | Sub-checks on the parent: all four on `http`/`api`, `dnsbl` only on `ping`/`port`. Same as `settings.attached`. |
| `openStat` | boolean | | `false` | no | Makes the statistics page and uptime badge public. |
| `fullLog` | boolean | | `false` | no | Plan feature. Groups identical results over about 5 minutes instead of about 60, so the check log keeps more detail (see [Reading results](/incidents/reading-results/#how-results-are-stored)). |
| `slaTarget` | number or null | 0-100 | none | no | Uptime percent the monitor's summaries measure against. |
| `onOverlimit` | string | `fail`, `disable` | `fail` | no | Write only. `disable` creates the monitor disabled when the plan has no room. |
| `contacts` | array | `{ref, type, address, name?, language?, gateway?, alertDelay?}`; `type` is `email`, `sms`, `voiceCall` or `http`; `alertDelay` in **minutes** | none | no | Create or bind contacts in the same request. Needs `contact:write` and an `Idempotency-Key`. At most `limits.maxInlineContacts`. |
| `alertSubscriptions` | array | `{contactIds?: [GUID], contactRefs?: [ref], alertTypes: ["up","down","repeatedlyDown"]}` | none | no | Create only. Without it an API-created monitor alerts nobody. |
| `reportSubscriptions` | array | `{contactIds?, contactRefs?, frequency: "daily"\|"weekly"\|"monthly"\|"quarterly"\|"yearly"}` | none | no | Create only. Email contacts. |
| `settings` | object | the type's fields below | type defaults | per type | On `PATCH`, the members you send are merged into the stored settings; arrays are replaced whole. |

Read-only members you will see on a read: `id`, `state` (`up`, `down`, `paused`, `maintenance`), `since`, `created`,
`updated`, `effectiveUrl`, `expirationDate` and `certNotBefore` (`sslExp` / `domainExp`), `settings.assertsText`,
`settings.forceRecheck`. Credential fields (passwords, community strings, keys, connection strings) read back only
to the owner and to subaccounts with edit rights; others see `{ "set": true, "updatedAt": ... }`. On write, an
absent credential stays as it is and `null` clears it.

## Website / HTTPS (`http`)

Downloads the page like a visitor and judges the response. Location-based; no plan gate for the type itself;
product minimum interval 10 seconds, though your plan's interval list usually starts higher (the `bl:ru` preset:
30 minutes); recheck and fallback accepted. `url`: an absolute `http(s)` url (a bare domain is checked over `http://`). App guide:
[Create a website (HTTPS) monitor](/monitors/types/http/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `method` | string | `H` HEAD, `G` GET, `P` POST, `U` PUT, `D` DELETE, `A` PATCH | `G` | no | OPTIONS, which the app's editor offers, cannot be set through the API. |
| `timeout` | integer, ms | 50-100000 | 40000 | no | |
| `keywords` | string | comma-separated, up to 255 characters in total | none | no | Searched in the downloaded body (a HEAD request downloads none). |
| `keywordMode` | string | `PresentAny`, `PresentAll`, `ReverseAny`, `ReverseAll`, `ReverseWithResult` | `PresentAny` | no | See [what the reverse modes actually do](#what-the-descriptions-get-wrong). |
| `username` | string | up to 255 | none | no | Answers the server's authentication challenge. |
| `password` | string, credential | up to 255 | none | no | |
| `authSchema` | string | `Basic` | none | no | Sends Basic credentials on the first request without waiting for a challenge. |
| `headers` | array of `{name, value}` | all names and values together up to 1023 characters | none | no | `connection`, `content-length` and `date` are dropped. |
| `body` | string | up to 2047 | none | no | Sent with POST, PUT, PATCH. |
| `postParameters` | string | form-encoded, up to 2047 | none | no | Older form field; prefer `body`. |
| `ignoredStatuses` | array of integers | 100-599, up to 20 | none | no | These statuses count as success. |
| `errorStatuses` | array of integers | 100-599, up to 20 | none | no | These statuses count as failure. |
| `followRedirect` | boolean | | `true` | no | |
| `maxRedirects` | integer | 1-20 | 20 | no | |
| `errorOnRedirect` | boolean | | `false` | no | Any 3xx fails the check. |
| `userAgent` | string | up to 255 | HostTracker's own | no | |
| `accept` | string | up to 255 | `*/*` | no | |
| `referer` | string | up to 1023 | a HostTracker results url | no | |
| `maxSize` | integer, bytes | 1024-52428800 | 1048576 (1 MB) | no | Values above 10485760 (10 MB) are stored as 10 MB. Keywords and assertions see only the downloaded part. |
| `dns` | array of IPs | up to 4 | none | no | Your own resolvers. Plan feature (`403 package_limit`, `dnsManual`). |
| `publicDns` | integer | 0 or more; 0 = off | 0 | no | Resolve through public DNS servers of the location's country. Plan feature (`dnsPublic`). |
| `dnsNoCache` | boolean | | `false` | no | Resolve fresh on every check. |
| `expectedDns` | array of IPs | up to 10 | none | no | **Public DNS servers to skip**, not expected ones - see below. |
| `expectedIps` | array of IPs | up to 10 | none | no | The host must resolve to one of these; anything else fails. |
| `requireValidChain` | boolean | | `false` | no | Fail on an expired, self-signed, mismatched or broken certificate chain. Plan feature (SSL policy). |
| `checkRevocation` | boolean | | `false` | no | Fail on a revoked certificate. Needs the SSL policy and revocation features. |
| `requireStrongTls` | boolean | | `false` | no | Fail below TLS 1.2. Plan feature (SSL policy). |
| `blockWeakCiphers` | boolean | | `false` | no | Fail on a 128-bit or weaker cipher. Plan feature (SSL policy). |
| `certWatchDays` | array of integers | 1-3650, up to 8 | none | no | Days-before-expiry reminders for the served certificate; also the thresholds of the attached `sslExp` (which uses 30, 7 and 1 when this is empty). |
| `assertMode` | boolean | | `false` | no | Judge the response by `asserts` instead. While on, `keywords`, `keywordMode`, `ignoredStatuses`, `errorStatuses`, `errorOnRedirect` and `preset` are refused. |
| `asserts` | array of assertion rows | up to 20, or your plan's lower cap | none | no | Row shape [below](#assertion-row-asserts). Not together with `assertsSource`. |
| `assertsSource` | string | assertion source text, one rule per line | - | no | Write only: parsed into `asserts`. See the [assertion language](/reference/assert-language/). |
| `preset` | string | `bl:ru` | none | no | Builds the whole settings object (a check against the Russian register of blocked sites) and pins the locations. Sent alone - any other setting beside it is refused. |
| `attached` | object | see [attached sub-checks](#attached-sub-checks-settingsattached) | all off | no | |

HTTP policies from the app's editor are not part of the API settings.

```json
{
  "type": "http",
  "url": "https://example.com/",
  "interval": 300,
  "locations": { "pools": ["allworld"] }
}
```

## API monitor (`api`)

An `http` check plus analysis of the response content. It accepts **every field of the `http` table above**, with
the same rules, plus the three below. Location-based; plan feature `apiTask`; recheck and fallback accepted.
App guide: [Monitor an API response](/monitors/types/api/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `contentType` | string | `application/json` (selector is a JSONPath), `text/xml` (XPath), `text/plain` (multiline, case-insensitive regex) | none | yes, unless `assertMode` is on | How the body is parsed before `valueSelector` runs. |
| `valueSelector` | string | JSONPath, XPath or regex, by `contentType` | none | no | Compiled on save: a malformed selector is refused. |
| `expectation` | object | `{func, args, change, cpt}` - see [below](#api-expectation-settingsexpectation) | none | no | Up to 1024 characters serialized. |

With `assertMode: true` the three fields above are refused and `asserts` / `assertsSource` decide the verdict.

```json
{
  "type": "api",
  "url": "https://api.example.com/health",
  "interval": 300,
  "locations": { "pools": ["allworld"] },
  "settings": {
    "contentType": "application/json",
    "valueSelector": "$.status",
    "expectation": { "func": "eq", "args": ["ok"] }
  }
}
```

### API expectation (`settings.expectation`)

| Field | Type | Allowed values | Default | Note |
|---|---|---|---|---|
| `func` | string | `eq`, `neq`, `in`, `out`, `ls`, `le`, `ge`, `gt`, `inr`, `outr`, `no`, `null` | - (required) | `in`/`out`: one of / none of `args`; `inr`/`outr`: inside / outside the range `[args[0], args[1]]`; `no`: no comparison; `null`: the value is absent. |
| `args` | array of strings | 1 value for `eq`, `neq`, `ls`, `le`, `ge`, `gt`; at least 1 for `in`, `out`; exactly 2 ascending numbers for `inr`, `outr` | - | Numbers are sent as strings (`"100"`). |
| `change` | integer | 0, 1, 2 | 0 | `0` judges the value itself; `1` the change since the previous check; `2` the change of that change. Numbers only. |
| `cpt` | string | `""`, `ms`, `s`, `m`, `h` | `""` | **The time unit for a rate of change**, not a capture name: with `change` 1 or more, the change is divided by the time since the previous check in that unit (per second, per minute...). |

## Page speed (`waterfall`)

Loads the page in a real browser and fails when a threshold is broken. Also accepted as `pageSpeed` on input.
Location-based; plan feature `waterfall`; minimum interval 600 seconds; recheck and fallback accepted. `url`: an
absolute `http(s)` url. Every threshold is off when absent or 0. App guide:
[Monitor page load in a real browser](/monitors/types/page-speed/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `timeout` | integer, ms | 0-40000 | off | no | Fails when the page takes at least this long to load. |
| `xhr` | integer, ms | 0-40000 | off | no | Same, not counting XHR/fetch requests. |
| `totalCount` | integer | 0-50 | off | no | Fails when this many resources of any kind **fail to load**. |
| `onDocument` | integer | 0-50 | off | no | Failed documents or iframes. |
| `onScript` | integer | 0-50 | off | no | Failed scripts. |
| `onStylesheet` | integer | 0-50 | off | no | Failed stylesheets. |
| `onImage` | integer | 0-50 | off | no | Failed images. |
| `onFont` | integer | 0-50 | off | no | Failed fonts. |
| `onAjax` | integer | 0-50 | off | no | Failed XHR/fetch requests. |
| `onCpu` | integer, percent | 80-100 | off | no | Sustained CPU use above this fails; a brief spike does not. |
| `onRam` | integer, MB | 0-1000 | off | no | Sustained memory use above this fails. |
| `onConsoleWarning` | integer | 0-50 | off | no | Console warnings. |
| `onConsoleError` | integer | 0-50 | off | no | Console errors. |
| `deviceEmulation` | string | a device name from `GET /check/device` | `Desktop` | no | |

The count thresholds count resources that **failed** (never finished, or answered 0 or 400 and above) and fail the
check when the count **reaches** the threshold. The published descriptions say "the number of requests" and
"exceeds", which is not what the check does.

```json
{
  "type": "waterfall",
  "url": "https://example.com/",
  "interval": 600,
  "locations": { "pools": ["allworld"] },
  "settings": { "timeout": 15000, "totalCount": 1 }
}
```

## Content check (`cntCheck`)

Loads the page in a real browser and looks for keywords in the rendered text. Location-based; plan feature
`contentCheck`; fallback accepted, `recheck` not accepted. `url`: an absolute `http(s)` url. App guide:
[Check rendered page content](/monitors/types/content-check/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `keyword` | string | 1-255 characters; several keywords separated by `;` | - | **yes** | |
| `keywordPresent` | boolean | | `true` | no | `true`: the keywords must be present; `false`: they must be absent. |
| `keywordAny` | boolean | | `false` | no | **`true` means every keyword** (all present, or all absent); `false` means any one keyword is enough. The published description says the opposite. |
| `caseSensitive` | boolean | | `false` | no | |
| `onlyVisible` | boolean | | `true` | no | Search only visible text. |
| `timeout` | integer, ms | 50-120000 | 40000 | no | Page-load budget. |

| `keywordPresent` | `keywordAny` | The check fails when |
|---|---|---|
| `true` | `false` | none of the keywords is found |
| `true` | `true` | any keyword is missing |
| `false` | `true` | any keyword is found |
| `false` | `false` | every keyword is found |

```json
{
  "type": "cntCheck",
  "url": "https://app.example.com/pricing",
  "interval": 600,
  "locations": { "pools": ["allworld"] },
  "settings": { "keyword": "Add to cart" }
}
```

## Transaction (`tran`)

Runs a scripted user flow in a real browser. Location-based; plan feature `tranCount`; recheck and fallback
accepted. `url`: the page the flow starts on - an implicit first step opens it. App guide:
[Monitor a user flow](/monitors/types/transaction/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `steps` | array of steps | 1-10 steps | - | **yes** | Run in order; the first failing step ends the check. Replaced whole on `PATCH`. Shapes [below](#transaction-steps-settingssteps). |
| `timeout` | integer, ms | 0-40000 | 40000 | no | Whole check. A value above 40000 is refused, not clamped. |
| `skipMedia` | boolean | | `true` | no | Skip images and media. |
| `finalScreenshot` | boolean | | `true` | no | Screenshot after the last step. |
| `consoleError` | boolean | | `false` | no | Fail on a browser console error. |
| `expectedConsoleErrors` | array of strings | up to 10, each up to 127 characters | `[]` | no | Console-error text to tolerate when `consoleError` is on. |

A read returns the implicit opening step as `steps[0]` with `synthesized: true`. Sending the array back is safe:
that step is dropped on write and the 10-step limit counts only your own steps.

```json
{
  "type": "tran",
  "url": "https://app.example.com/login",
  "interval": 600,
  "locations": { "pools": ["allworld"] },
  "settings": {
    "steps": [ { "action": "checkContent", "keywords": ["Sign in"] } ]
  }
}
```

## Ping (`ping`)

ICMP reachability. Location-based; no plan gate; recheck and fallback accepted. `url`: a host name or IP address.
App guide: [Monitor reachability with ping](/monitors/types/ping/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `dns` | array of IPs | up to 4 | none | no | Your own resolvers (plan feature). |
| `publicDns` | integer | 0 or more; 0 = off | 0 | no | Plan feature. |
| `expectedDns` | array of IPs | up to 10 | none | no | Public DNS servers to skip. |
| `expectedIps` | array of IPs | up to 10 | none | no | The host must resolve to one of these. |
| `attached` | object | `{"dnsbl": ...}` only | off | no | |

```json
{
  "type": "ping",
  "url": "203.0.113.10",
  "interval": 60,
  "locations": { "pools": ["allworld"] }
}
```

## Port (`port`)

Opens a TCP connection, optionally with TLS and a banner match. Location-based; no plan gate; recheck and fallback
accepted. `url`: `host:port`. App guide: [Monitor a TCP port](/monitors/types/port/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `pattern` | string | up to 1023 | none | no | Text expected in the banner the port sends. |
| `ssl` | boolean | | `false` | no | Negotiate TLS on the connection. |
| `dns` | array of IPs | up to 4 | none | no | Plan feature. |
| `publicDns` | integer | 0 or more; 0 = off | 0 | no | Plan feature. |
| `expectedDns` | array of IPs | up to 10 | none | no | Public DNS servers to skip. |
| `expectedIps` | array of IPs | up to 10 | none | no | |
| `requireValidChain`, `checkRevocation`, `requireStrongTls`, `blockWeakCiphers` | boolean | | `false` | no | As on `http`; read only while `ssl` is on. |
| `certWatchDays` | array of integers | 1-3650, up to 8 | none | no | Reminders for the served certificate. |
| `attached` | object | `{"dnsbl": ...}` only | off | no | |

```json
{
  "type": "port",
  "url": "mail.example.com:25",
  "interval": 180,
  "locations": { "pools": ["allworld"] }
}
```

## DNS blacklist (`dnsbl`)

Looks the host up in DNS blacklists. Runs every 6 hours from HostTracker's internal network: no `interval`, no
`locations`. Plan feature `dnsbl`. `url`: a domain or IP address. App guide:
[Watch DNS blacklists](/monitors/types/dnsbl/).

| Field | Type | Allowed values | Default | Required | Note |
|---|---|---|---|---|---|
| `scope` | string | `firstWebIp`, `allWebIps`, `webAndMx` | `firstWebIp` | no | Which addresses are looked up: the first A record, every A record, or every A record plus the MX hosts. Editing only `url` keeps the stored scope. |

```json
{ "type": "dnsbl", "url": "example.com" }
```

## Domain expiry (`domainExp`)

Watches a domain's registration expiry. Runs every 6 hours from the internal network: no `interval`, no
`locations`, no `settings`. Plan feature `domainExp`. `url`: a registrable domain; a leading `www.` is stripped, and
IP addresses and single-label names are refused. App guide:
[Watch a domain's registration expiry](/monitors/types/domain-expiry/).

```json
{ "type": "domainExp", "url": "example.com" }
```

## Certificate expiry (`sslExp`)

Watches the TLS certificate an endpoint serves. Runs every 6 hours from public checkpoints HostTracker picks itself
(not the internal network): no `interval`, no `locations`, no `settings`. Plan feature `sslExp`. `url`: `host` or `host:port` (port 443 when omitted). App guide:
[Watch a TLS certificate's expiry](/monitors/types/ssl-expiry/).

```json
{ "type": "sslExp", "url": "mail.example.com:465" }
```

## Web Risk (`webRisk`)

Checks a url against Google's Web Risk lists. Runs every 12 hours from the internal network: no `interval`, no
`locations`, no `settings`. Plan feature `attachedWebrisk`. `url`: the full url to check. App guide:
[Watch Google Web Risk flags](/monitors/types/web-risk/).

```json
{ "type": "webRisk", "url": "https://www.example.com/" }
```

## Counter (`counter`)

Reads one number from a probe script on your server (CPU, RAM, disk, a connect time or a Windows performance
counter) and compares it with a threshold. Runs from the internal network: no `locations`, no `recheck`. Plan feature
`counterTask`. No `url` needed: the address checked is `settings.probeUrl`. App guide:
[Monitor CPU, RAM and disk](/monitors/types/counter/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `probeUrl` | string | url | - | yes (in place of `url`) | The endpoint the probe request is POSTed to. |
| `monitorType` | string | `aspnet4` (`<probeUrl>/host-tracker-monitor.ashx`), `php` (`<probeUrl>/host-tracker-monitor.php`), `custom` (`probeUrl` as is) | `custom` | no | With `custom` the `counterType` block is not validated. |
| `counterType` | string | `cpu`, `ram`, `disk`, `port`, `mssql`, `mysql`, `perfCounter` | `cpu` | no | Windows-only metrics are refused with `php`. |
| `host` | string | 1-1000 | - | when `counterType` is `port` | |
| `port` | integer | 0-65535 | 80 | no | For `port`. |
| `label` | string | 1-255 | - | when `counterType` is `disk` | Disk path or drive label. |
| `connectionString` | string, credential | 1-255 | - | when `counterType` is `mssql` or `mysql` | |
| `category` | string | 1-255 | - | when `counterType` is `perfCounter` | |
| `name` | string | 1-255 | - | when `counterType` is `perfCounter` | |
| `instance` | string | 0-255 | `""` | no | |
| `deploymentType` | string | `manual` | `manual` | no | |
| `errorCondition` | string | `no`, `eq`, `ne`, `gt`, `ls`, `ge`, `le`, `in`, `out`, `ine`, `oute`, `ine1`, `ine2`, `oute1`, `oute2` | none | no | The overload test; `no` only collects the value. |
| `errorLevel1` | number | | - | for one- and two-level conditions | |
| `errorLevel2` | number | at least `errorLevel1` | - | for `in`, `out`, `ine`, `oute`, `ine1`, `ine2`, `oute1`, `oute2` | |
| `errorCheckCount` | integer | 0-100 | none | no | Consecutive overloaded readings before the monitor goes Down. |

Condition meanings: `eq` value = level1, `ne` not equal, `gt` greater, `ls` less, `ge` greater or equal, `le` less
or equal; `in` level1 < value < level2, `out` value < level1 or > level2, `ine` level1 <= value <= level2, `oute`
value <= level1 or >= level2, `ine1` level1 <= value < level2, `ine2` level1 < value <= level2, `oute1` value <=
level1 or > level2, `oute2` value < level1 or >= level2.

```json
{
  "type": "counter",
  "interval": 300,
  "settings": {
    "monitorType": "php",
    "probeUrl": "https://web-1.example.com/ht",
    "counterType": "cpu",
    "errorCondition": "gt",
    "errorLevel1": 90
  }
}
```

## Database (`database`)

Connects to your database, optionally runs a query and compares the result. Runs from the internal network: no
`locations`; `recheck` is accepted but there is no multi-location vote. Plan feature `db`; minimum interval 600
seconds. No `url`: the address is composed from the settings. App guide:
[Monitor a database](/monitors/types/database/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `serverType` | string | `mssql` (port 1433), `oracle` (1521), `mysql` (3306), `postgresql` (5432), `firebird` (3050) | `mssql` | no | |
| `server` | string | 1-100; no `;` `,` `"` `:` `'` `(` `)` `=` or spaces | - | **yes** | Host or address only; the port goes in `port`. |
| `port` | integer | 1-65535 | the engine's default | no | |
| `database` | string | 0-100 | none | no | For Oracle, the instance name (letters, digits, `_`, starting with a letter). |
| `service` | string | 0-100 | none | no | Oracle service name. |
| `login` | string | 0-100 | none | no | |
| `password` | string, credential | 0-100 | none | no | |
| `query` | string | 0-500 | none | no | SQL run after connecting. |
| `mode` | string | `Scalar` (first column of the first row), `NonQuery` (affected-row count) | none | no | |
| `comparisonMode` | string | `No`, `Equal`, `NotEqual`, `GreaterThan`, `LessThan`, `InInterval`, `OutInterval` | none | no | |
| `value1` | number | | - | when `comparisonMode` is set to anything but `No` | |
| `value2` | number | | - | for `InInterval`, `OutInterval` | |
| `includeValue1`, `includeValue2` | boolean | | `false` | no | Make the interval bounds inclusive. |
| `retrying` | boolean | | `false` | no | Retry the connection once. |
| `retryingCmd` | boolean | | `false` | no | Retry the query once. |

```json
{
  "type": "database",
  "interval": 600,
  "settings": {
    "serverType": "postgresql",
    "server": "db.example.com",
    "login": "monitor",
    "password": "<password>",
    "query": "SELECT 1",
    "mode": "Scalar"
  }
}
```

## SNMP (`snmp`)

Reads one numeric OID from network equipment. Runs from the internal network: no `locations`; `recheck` accepted.
Plan feature `snmp`. No `url`: the address is composed from `host` and `oid`. App guide:
[Monitor network equipment over SNMP](/monitors/types/snmp/).

| Field | Type | Allowed values / range | Default | Required | Note |
|---|---|---|---|---|---|
| `host` | string | 1-255 | - | **yes** | |
| `oid` | string | dotted numeric OID, at least two parts | - | **yes** | Symbolic names are refused. |
| `port` | integer | 0-65535 | 161 | no | |
| `version` | integer | 1, 2 (v2c), 3 | 1 | no | |
| `verb` | string | `Get`, `GetNext` | none | no | |
| `community` | string, credential | 0-255 | none | no | v1/v2c only; refused with version 3. |
| `securityName` | string | 1-255 | - | when `version` is 3 | |
| `securityLevel` | string | `noAuthNoPriv`, `authNoPriv`, `authPriv` | - | when `version` is 3 | |
| `authProtocol` | string | `MD5`, `SHA`, `SHA1`, `SHA-1`, `SHA256`, `SHA-256` | - | with `authNoPriv` / `authPriv` | |
| `authKey` | string, credential | 8-255 | - | with `authNoPriv` / `authPriv` | |
| `privProtocol` | string | `DES`, `AES`, `AES128`, `AES-128`, `AES192`, `AES-192`, `AES256`, `AES-256` | - | with `authPriv` | |
| `privKey` | string, credential | 8-255 | - | with `authPriv` | |

```json
{
  "type": "snmp",
  "interval": 300,
  "settings": { "host": "switch.example.net", "oid": "1.3.6.1.2.1.1.3.0", "version": 2, "community": "<community>" }
}
```

## Shared shapes

### Attached sub-checks (`settings.attached`)

| Member | Shape | Default | Note |
|---|---|---|---|
| `dnsbl` | `{"enabled": boolean}` | off | Blacklist check on the parent's host. `http`, `api`, `ping`, `port`. |
| `sslExp` | `{"enabled": boolean}` | off | Certificate expiry of the parent's own endpoint; reminders follow the parent's `certWatchDays`. `http`, `api`. |
| `domainExp` | `{"enabled": boolean}` | off | Registration expiry of the parent's domain. `http`, `api`. |
| `webRisk` | `{"enabled": boolean, "interval": integer}` | off | Web Risk lookup. `interval` (seconds, default 43200) is accepted but has no effect: attached checks run on a fixed 12-hour schedule. |

A member that is absent means off; inside a sent object, a missing `enabled` means on. The top-level `attached`
member takes the same kinds as `true` / `false`. Attaching a kind to a monitor that is itself of that type is
refused. See [Attach sub-checks to a monitor](/monitors/types/attached-sub-checks/).

### Assertion row (`asserts[]`)

| Field | Type | Note |
|---|---|---|
| `sub` | string, required | The subject, as an assertion-language expression: `status`, `header("etag")`, `body.json.path("$.ok")`. |
| `op` | string, required | `eq`, `lt`, `le`, `gt`, `ge`, `contains`, `startsWith`, `endsWith`, `matches`, `containsAny`, `containsAll`, `in`, `exists`, `isNumber`, `unique`. |
| `not` | boolean | Negates the predicate. Default `false`. |
| `val` | string, number, boolean or null | The operand; its JSON type is part of the value (`200` is not `"200"`). Not with `valSub`. |
| `valT` | string | `json`, `xml`, `yaml` - compare `val` as a document. Only with `eq` and `contains`. |
| `vals` | array | Operand list for `containsAny`, `containsAll`, `in`; `in` also takes ranges such as `"200..299"`. |
| `valSub` | string | A second subject to compare against. |
| `nocase` | boolean | Case-insensitive text comparison. Default `false`. |
| `name` | string | A label used in the failure message. |

Writing rules as text (`assertsSource`) is usually easier. See the
[assertion language reference](/reference/assert-language/).

### Transaction steps (`settings.steps`)

Every step has `action` (required), `name` (up to 19 characters), `timeout` (ms, 0-40000), and optionally
`screenshot` and `waitForNavigation` sub-steps to run after it. Action-specific fields:

| `action` | Fields |
|---|---|
| `navigate` | `url` (required, absolute, up to 2047), `skipMedia`; `timeout` default 20000 |
| `click` | `select` (a CSS selector string or a select object) **or** `x` + `y`; `delay` (ms held, 0-10000, default 0); `button` (`left`, `right`, `middle`); `sleep` |
| `type` | `text` (required, 1-255), `select`, `delay` (ms between keystrokes, 0-10000), `sleep` |
| `select` | `selector` (required, CSS, up to 127), `delay` (ms to wait, default 1000), `onlyVisible` (default `true`), `selectStrategy` (`all`, `first`, `random`; default `all`), `validationStrategy` (`zero`, `one`, `oneOrMore`, `zeroOrMore`; default `oneOrMore`) |
| `hover` | `select`, `sleep` |
| `checkContent` | `keywords` (required, 1-10 strings, each up to 127), `caseSensitive`, `reverse` (pass when absent), `all` (require every keyword), `onlyVisible` (default `false`), `highlightKeywords` (default `true`) |
| `sleep` | `delay` (required, ms, 1-10000), `dispersion` (random extra ms, 0-5000) |
| `screenshot` | no fields of its own |
| `waitForNavigation` | `delay` (ms, 0-10000, default 1000), `failWhenNoNav` (default `false`) |
| `back` | `timeout` default 20000 |

A `select` object takes the same fields as the `select` action; a string is shorthand for
`{"selector": "...", "selectStrategy": "first"}`. A `sleep` object is `{"delay", "dispersion"}`; a number is
shorthand for the delay. A `waitForNavigation` object is `{"delay", "failWhenNoNav", "timeout"}`; `true` is
shorthand for the defaults.

## Opt-in: site crawl (`crawl`) and indexability

These exist only on accounts where the site-health features are switched on, and are not in the published schema.

**Site crawl (`crawl`)** walks a whole site and reports what changed between runs. It is scheduled by
`cronSchedule` only (at most once a day; `interval` is refused) and runs from exactly one pool
(`locations.pools` with one entry). Settings: `pageBudget` (10-500, default 100, capped by the plan's monthly page
allowance), `delayMs` (100-5000, default 500), `parallelism` (1-10, default 2), `seoMode` (`none`, `basic`; default
`basic`), `seoFails` (default `false`), `failThreshold` (1-500, default 5), `includeSubdomains` (default `false`),
`notifyOnChanges` (default `false`) with `changeThreshold` (1-500 pages, default 20), `notifyOnHealthDrop` (default
`false`) with `healthDropPoints` (1-100, default 10).

**Indexability** is a fifth attached sub-check on `http` monitors only:
`settings.attached.indexability` = `{enabled, metaRobots, robotsHeader, canonical, robotsTxt, sitemap}`. Enabling it
without naming signals turns on `metaRobots`, `robotsHeader` and `canonical`; an attach with every signal off is
refused.

## What the descriptions get wrong

The live schema (`GET /monitor/type/{type}`) carries a description for every field. These ones do not match what the
check does; the tables above describe the actual behaviour.

| Field | Published description | What actually happens |
|---|---|---|
| `http` / `api` `keywordMode: "ReverseAny"` | passes while any keyword is absent | Fails as soon as **any** keyword is found - passes only while every keyword is absent. |
| `http` / `api` `keywordMode: "ReverseAll"` | passes while every keyword is absent | Fails only when **every** keyword is found - passes while at least one is absent. |
| `cntCheck` `keywordAny` | with several keywords, passes on any one | `true` requires **every** keyword (all present, or all absent); `false` accepts any one. |
| `expectedDns` (`http`, `api`, `ping`, `port`) | resolver IPs the lookup is expected to come from | A list of public DNS servers to **exclude** when resolving through public DNS. |
| `expectation.cpt` (`api`) | a legacy capture name | The time unit (`ms`, `s`, `m`, `h`) a change is divided by, turning `change` into a rate. |
| `waterfall` count thresholds | fail when the number of requests exceeds the value | Count **failed** resources and fail when the count **reaches** the value. |
| `maxSize` (`http`, `api`) | up to 52428800 bytes | Accepted up to 50 MB, but anything above 10 MB is stored as 10 MB. |
| `attached.webRisk.interval` | seconds between lookups | Accepted and ignored; attached checks run every 12 hours. |
| `fullLog` | keep the full response body of every check | Groups identical results over about 5 minutes instead of about 60 in the check log; no response bodies are kept. |

## Related

- [Do anything in HostTracker: task map](/reference/operator-task-map/)
- [Monitor settings reference](/reference/monitor-settings/)
- [Check intervals](/monitors/intervals/)
- [Monitoring locations reference](/reference/locations/)