Update Website

PATCH /api/websites/:websitePublicId

A request is treated as a full update when customerId, name, and url are all present in the body. Otherwise, it is treated as a partial update.

Example (cURL): Partial updateCopy Anchor Link

BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"

curl -X PATCH "$BASE_URL/api/websites/9a3d4d4d-7a4b-4f37-a9df-2a6f6d9d7a10" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "name": "Updated Website Name",
    "checkInterval": 5,
    "timeoutSeconds": 10
  }'

Example (cURL): Full update with HTTP configurationCopy Anchor Link

curl -X PATCH "$BASE_URL/api/websites/9a3d4d4d-7a4b-4f37-a9df-2a6f6d9d7a10" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "customerId": 5,
    "name": "API Endpoint Monitor",
    "url": "https://api.deinkunde.com/health",
    "httpMethod": "POST",
    "customHeaders": { "X-API-Key": "abc123", "Content-Type": "application/json" },
    "requestBody": "{\"check\": true}",
    "followRedirects": false,
    "cookieHandling": "jar",
    "mtlsEnabled": true,
    "mtlsClientCert": "<PEM-encoded client certificate>",
    "mtlsClientKey": "<PEM-encoded private key>"
  }'

Request BodyCopy Anchor Link

For a full update, customerId, name and url are required; every other field is optional.

A partial update applies these fields: name, url, status, managementType, checkInterval, timeoutSeconds, expectedStatusCodes, searchTerm, checkExpectedResponseEnabled, expectedResponseMatchType, expectedResponseValue, expectedResponseJsonPath, heartbeatGracePeriodMinutes, connectHost, connectPort, connectTlsInsecure, the six check fields, checkDomainExpiryEnabled, sslNoticeDays, sslErrorDays, domainExpiryNoticeDays, domainExpiryErrorDays, minPageSize and maxPageSize. Everything else in the tables below (monitoringType, allowedCheckCountryCodes, customFields, the authentication, HTTP request, mTLS and Playwright fields, and dnsConfig) is applied by a full update only: sent on its own it is ignored, without an error. Send customerId, name and url alongside it, or use the dedicated endpoints where they exist.

Core fieldsCopy Anchor Link

AuthenticationCopy Anchor Link

HTTP Request ConfigurationCopy Anchor Link

Connect target (Ersatzziel)Copy Anchor Link

Applies on a partial update as well as a full update. Not available for playwright scenarios or heartbeat monitors: both bypass the HTTP/SSL check pipeline connectHost plugs into. If checkHttpsRedirectEnabled is on, the http-to-https redirect probe follows connectHost too, so it measures the origin - a WAF-owned redirect can then turn the monitor red even though the public site redirects correctly.

mTLS (Mutual TLS)Copy Anchor Link

Playwright MonitoringCopy Anchor Link

Expected Response ValidationCopy Anchor Link

Check ConfigurationCopy Anchor Link

An omitted check field leaves the stored value unchanged. Your organization's package may forbid a given check: sending true for a check the package does not allow is only clamped back to false when the check is not already running; a check already stored as true is never turned off by the package, on this or any other update.

SSL & Domain ThresholdsCopy Anchor Link

Page Size & OtherCopy Anchor Link

ResponseCopy Anchor Link

Returns the updated website record. Encrypted fields are never included in responses.

{
  "id": 101,
  "customerId": 1,
  "name": "Updated Website Name",
  "url": "https://deinkunde.com",
  "status": "active",
  "monitoringType": "combined",
  "checkInterval": 5,
  "timeoutSeconds": 10,
  "httpMethod": "POST",
  "followRedirects": false,
  "cookieHandling": "jar",
  "mtlsEnabled": true,
  "connectHost": null,
  "connectPort": null,
  "connectTlsInsecure": false,
  "updatedAt": "2026-02-26T12:34:56.000Z"
}

Common errorsCopy Anchor Link

• 400 Website public ID (UUID) is required when :websitePublicId is missing
• 401 Unauthorized when you are not logged in
• 403 Forbidden when you cannot write to the website (e.g. readonly/global supporter)
• 403 Forbidden (managed_by_organization) when a customer-scoped caller edits a managed monitor without the canEditManaged exception
• 403 Forbidden (managementTypeOrgOnly) when a non-org-admin tries to change managementType
• 403 Forbidden (selfServiceQuotaReached) when flipping to self_service would exceed the customer's quota
• 404 Customer not found when customerId does not resolve to an existing customer
• 400 Invalid check configuration (invalidCheckConfig) when a partial update sends a check field outside its range (e.g. sslNoticeDays: 400)
• 400 Bad Request (connectHostInvalid) when connectHost is not a valid host, or carries a protocol or a path
• 400 Bad Request (connectHostNotPublic) when connectHost resolves to a private, loopback, link-local or otherwise blocked address
• 400 Bad Request (connectTlsInsecureWithoutHost) when the resulting connectTlsInsecure is true while the resulting connectHost is empty
• 500 Failed to update website on server errors