Admin endpoints

The public page can be read without a token. To trigger checks or change incidents and maintenance through HTTP, configure adminToken and send it with requests under /admin/*. Without a token configured, those routes stay closed.

Authentication

Authorization: Bearer <admin-token>

The token comes only from adminToken in the configuration. There is no environment-variable fallback; omitting it keeps the management API closed.

Comparison is constant time, and the header is matched case-insensitively against Bearer <token>.

heyoStatus({  // …  adminToken: "your-private-token", // do not commit production credentials});

Generate one with openssl rand -hex 32 and provide it to the config from a private secret source. Do not commit production credentials; there is no token list to maintain. In the shell examples below, $ADMIN_TOKEN means the same configured token; it is not an environment variable read by Heyo Status.

POST /admin/checks/run

Runs every configured monitor once, stores the results, reconciles automatic incidents and dispatches notifications. It is the same code path as the scheduler.

curl -X POST https://status.acme.com/api/heyo-status/admin/checks/run \  -H "authorization: Bearer $ADMIN_TOKEN"

[  {    "name": "Website",    "type": "http",    "status": true,    "message": "HTTP 200",    "latencyMs": 96,    "checkedAt": "2026-01-01T12:00:00.000Z"  }]

Call it from an external scheduler if your platform has no cron, or run it after deployment to verify a monitor change. It runs checks, but not the summary or cleanup jobs.

GET /admin/notifications/log

Every delivery attempt, newest first.

curl -H "authorization: Bearer $ADMIN_TOKEN" \  "https://status.acme.com/api/heyo-status/admin/notifications/log?status=failed&limit=20"

[  {    "id": "ntf_6ac204",    "channelId": "slack",    "channelType": "slack",    "eventType": "monitor.down",    "status": "failed",    "attempts": 1,    "error": "Slack delivery failed with HTTP 404: no_service",    "monitorName": "API",    "incidentId": null,    "maintenanceId": null,    "createdAt": "2026-01-01T10:02:00.000Z"  }]

The log stores no payload, no webhook URL, no credentials and no recipient. It exists to debug delivery, not to replay it.

Incident and maintenance management

Documented in full in the incident endpoints and maintenance endpoints:

Scripting it

const base = "https://status.acme.com/api/heyo-status";const adminToken = "your-private-token"; // load from a private sourceconst headers = {  authorization: `Bearer ${adminToken}`,  "content-type": "application/json",};const incident = await fetch(`${base}/admin/incidents`, {  method: "POST",  headers,  body: JSON.stringify({    title: "Deploy rollback in progress",    severity: "major",    affectedMonitors: ["API"],    message: "Rolling back the 14:02 deploy.",  }),}).then((response) => response.json());await fetch(`${base}/admin/incidents/${incident.id}/updates`, {  method: "POST",  headers,  body: JSON.stringify({ status: "resolved", message: "Rollback complete." }),});

For a local or CI context, the CLI does the same without a token or a network round trip — it talks to the database directly:

heyo-status incident create --title "…" --severity major --monitors API --message "…"