---
title: "Create Website"
description: "Creates a new website monitor for a customer."
---

`POST /api/websites`

## Example (cURL)

```bash
BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"

curl -X POST "$BASE_URL/api/websites" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "customerId": "059e1469-0f05-4c93-bd4d-89c45bb2afd9",
    "name": "New Landing Page",
    "url": "https://landing.deinkunde.com",
    "monitoringType": "combined",
    "checkInterval": 5
  }'
```

## Request Body

### Core fields

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `customerId` | number\|string | Yes | - | Customer public ID (preferred) or legacy numeric ID |
| `name` | string | Yes | - | Display name (1-255 chars) |
| `url` | string | Yes* | - | URL to monitor (1-2048 chars). Required for non-heartbeat monitors. For DNS monitors, use a hostname without protocol. |
| `monitoringType` | string | No | `combined` | `combined`, `http_status`, `ssl_check`, `playwright`, `heartbeat`, `dns` |
| `status` | string | No | `active` | `active`, `inactive`, `maintenance` (`paused` accepted, mapped to `inactive`) |
| `checkInterval` | number | No | 30 | Check interval in minutes (1-60, min depends on package) |
| `timeoutSeconds` | number | No | 30 | Request timeout in seconds (1-60) |
| `expectedStatusCodes` | string | No | `200,301,302` | Comma-separated expected HTTP status codes |
| `allowedCheckCountryCodes` | string[]\|null | No | org default | Array of 2-letter country codes to restrict monitoring locations |
| `searchTerm` | string\|null | No | null | Keyword to search for in response body (max 255 chars) |
| `customFields` | object\|null | No | null | Custom field values as key-value pairs |
| `managementType` | string | No | `managed` | Ownership class: `managed` or `self_service`: see [Managed vs. Self-Service](/monitoring/managed-vs-self-service). Only organization admins may choose it; customer-scoped creators always get `self_service` (requires `allowSelfService` and free quota). |

### Authentication

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `authMode` | string | No | `none` | `none`, `authorization_header`, `basic` |
| `authorizationHeader` | string\|null | No | null | Required when `authMode` is `authorization_header` (1-4096 chars). Encrypted at rest. |
| `basicAuthUsername` | string\|null | No | null | Required when `authMode` is `basic` (1-255 chars) |
| `basicAuthPassword` | string\|null | No | null | Required when `authMode` is `basic` (1-4096 chars). Encrypted at rest. |

### HTTP Request Configuration

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `httpMethod` | string | No | `GET` | `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS` |
| `customHeaders` | object\|null | No | null | Custom HTTP headers as key-value pairs. Keys: 1-100 chars, values: max 8192 chars. Encrypted at rest. |
| `requestBody` | string\|null | No | null | Request body for POST/PUT/PATCH requests (max 100KB). Encrypted at rest. |
| `followRedirects` | boolean | No | true | Whether to follow HTTP redirects |
| `cookieHandling` | string | No | `none` | `none` or `jar` (maintain cookie jar across redirects) |

### mTLS (Mutual TLS)

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `mtlsEnabled` | boolean | No | false | Enable mutual TLS authentication |
| `mtlsClientCert` | string\|null | No | null | Required when `mtlsEnabled` is true (1-100000 chars). Encrypted at rest. |
| `mtlsClientKey` | string\|null | No | null | Required when `mtlsEnabled` is true (1-100000 chars). Encrypted at rest. |

### Playwright Monitoring

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `playwrightScript` | string\|null | No* | null | Required when `monitoringType` is `playwright` (1-20000 chars) |
| `playwrightEnv` | object\|null | No | {} | Environment variables (max 50, keys 1-64 chars, values max 2000 chars) |
| `playwrightDevice` | string\|null | No | null | Device emulation preset (1-100 chars) |
| `playwrightViewportWidth` | number\|null | No | null | Viewport width (1-3840). Must be set with `playwrightViewportHeight`. |
| `playwrightViewportHeight` | number\|null | No | null | Viewport height (1-3840). Must be set with `playwrightViewportWidth`. |
| `playwrightRetries` | number\|null | No | 0 | Number of retries (0-5) |
| `playwrightTimeoutMs` | number\|null | No | 30000 | Timeout in milliseconds (1000-180000) |

### Expected Response Validation

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `checkExpectedResponseEnabled` | boolean | No | false | Enable response body validation |
| `expectedResponseMatchType` | string\|null | No | `contains` | `contains`, `equals`, `json_path_equals` |
| `expectedResponseValue` | string\|null | No | null | Required when `checkExpectedResponseEnabled` is true (max 10000 chars) |
| `expectedResponseJsonPath` | string\|null | No | null | Required when `expectedResponseMatchType` is `json_path_equals` (max 500 chars) |

### Check Configuration

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `checkSslEnabled` | boolean | No | true | Enable SSL certificate checks (disabled for Playwright) |
| `checkHttpsRedirectEnabled` | boolean | No | true | Check HTTPS redirect (disabled for Playwright) |
| `checkStatusEnabled` | boolean | No | true | Check HTTP status (disabled for Playwright) |
| `checkSizeEnabled` | boolean | No | true | Check response size (disabled for Playwright) |
| `checkResponseTimeEnabled` | boolean | No | true | Check response time (disabled for Playwright) |
| `checkKeywordEnabled` | boolean | No | true | Enable keyword search (disabled for Playwright) |

### SSL & Domain Thresholds

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `sslNoticeDays` | number | No | 7 | Days before SSL expiry to trigger notice (1-365) |
| `sslErrorDays` | number | No | 0 | Days before SSL expiry to trigger error (0-365, must be ≤ `sslNoticeDays`) |
| `checkDomainExpiryEnabled` | boolean | No | true | Enable domain expiry checks (disabled for Playwright) |
| `domainExpiryNoticeDays` | number | No | 30 | Days before domain expiry to trigger notice (1-365) |
| `domainExpiryErrorDays` | number | No | 7 | Days before domain expiry to trigger error (0-365, must be ≤ `domainExpiryNoticeDays`) |

### Page Size Limits

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `minPageSize` | number\|null | No | null | Minimum expected page size in bytes (disabled for Playwright) |
| `maxPageSize` | number\|null | No | null | Maximum expected page size in bytes (disabled for Playwright) |

### DNS Monitoring

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `dnsConfig` | object | No | {} | DNS query configuration (only for `monitoringType: dns`) |

### Heartbeat

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `heartbeatToken` | string\|null | No | auto-generated | Custom heartbeat token (max 255 chars) |
| `heartbeatGracePeriodMinutes` | number | No | 5 | Grace period in minutes (1-10080, max 1 week) |

## Response

Returns the created website record. Encrypted fields (`authorizationHeader`, `basicAuthPassword`, `customHeaders`, `requestBody`, `mtlsClientCert`, `mtlsClientKey`) are never returned in API responses.

```json
{
  "id": 103,
  "customerId": 1,
  "name": "New Landing Page",
  "url": "https://landing.deinkunde.com",
  "status": "active",
  "monitoringType": "combined",
  "checkInterval": 5,
  "httpMethod": "GET",
  "followRedirects": true,
  "cookieHandling": "none",
  "mtlsEnabled": false,
  "createdAt": "2026-02-26T12:05:00.000Z"
}
```

## Common errors

- `401 Unauthorized` when you are not logged in
- `403 Forbidden` when you cannot create websites for the organization/customer
- `403 Forbidden` (`selfServiceNotAllowed`) when a customer-scoped caller creates a monitor but the customer's resolved `allowSelfService` is false
- `403 Forbidden` (`selfServiceQuotaReached`) when the customer's total self-service monitors (across all monitor types) already meet `maxSelfServiceUrls`
- `404 Customer not found` when `customerId` does not resolve to an existing customer