Admin endpoints

Every mutation lives behind one authenticated prefix, so a public status page can never be edited by its visitors.

Authentication

Authorization: Bearer <HEYO_STATUS_API_TOKEN>

The token is read from adminToken in the configuration, falling back to the HEYO_STATUS_API_TOKEN environment variable — Workers and Deno do not always expose process.env, so both paths exist.

Comparison is constant time, and the header is matched case-insensitively against Bearer <token>.

heyoStatus({  // …  adminToken: process.env.HEYO_STATUS_API_TOKEN,});

Generate one with openssl rand -hex 32, store it as a platform secret, and rotate it by updating the secret — there is no token list to maintain.

POST /admin/checks/run

Runs every configured monitor once, stores the results, reconciles automatic incidents and dispatches notifications. It is the same code path as the scheduler.

curl -X POST https://status.acme.com/api/heyo-status/admin/checks/run \  -H "authorization: Bearer $HEYO_STATUS_API_TOKEN"

[  {    "name": "Website",    "type": "http",    "status": true,    "message": "HTTP 200",    "latencyMs": 96,    "checkedAt": "2026-01-01T12:00:00.000Z"  }]

Useful as an external trigger for a platform without cron, as a deploy-time warm-up so the page is never empty, and when verifying a monitor change.

GET /admin/notifications/log

Every delivery attempt, newest first.

curl -H "authorization: Bearer $HEYO_STATUS_API_TOKEN" \  "https://status.acme.com/api/heyo-status/admin/notifications/log?status=failed&limit=20"

[  {    "id": "ntf_6ac204",    "channelId": "slack",    "channelType": "slack",    "eventType": "monitor.down",    "status": "failed",    "attempts": 1,    "error": "Slack delivery failed with HTTP 404: no_service",    "monitorName": "API",    "incidentId": null,    "maintenanceId": null,    "createdAt": "2026-01-01T10:02:00.000Z"  }]

The log stores no payload, no webhook URL, no credentials and no recipient. It exists to debug delivery, not to replay it.

Incident and maintenance management

Documented in full on Incident and maintenance endpoints:

Scripting it

const base = "https://status.acme.com/api/heyo-status";const headers = {  authorization: `Bearer ${process.env.HEYO_STATUS_API_TOKEN}`,  "content-type": "application/json",};const incident = await fetch(`${base}/admin/incidents`, {  method: "POST",  headers,  body: JSON.stringify({    title: "Deploy rollback in progress",    severity: "major",    affectedMonitors: ["API"],    message: "Rolling back the 14:02 deploy.",  }),}).then((response) => response.json());await fetch(`${base}/admin/incidents/${incident.id}/updates`, {  method: "POST",  headers,  body: JSON.stringify({ status: "resolved", message: "Rollback complete." }),});

For a local or CI context, the CLI does the same without a token or a network round trip — it talks to the database directly:

heyo-status incident create --title "…" --severity major --monitors API --message "…"