---
title: "uptimeify_website"
description: "A website monitor: HTTP(S) check (combined, http_status, ssl_check) or heartbeat (heartbeat, the monitored system pings Uptimeify). Import with the numeric id or the public id. Updates use the partial mode of PATCH /api/websites/{id} whenever every changed field is one that mode accepts (name, url, status, interval, timeout, checks, keyword, expected response, connect target, SSL/domain days, page sizes, grace period). Changes to the customer, countries, HTTP method, redirects, cookies, auth or the write-only secrets need the full mode, which resets omitted fields to defaults, so the provider then sends every attribute and re-applies any value the full mode coerced (ssl_error_days = 0, min_page_size = 0) with a partial PATCH. Secrets (custom headers, request body, authorization header, basic auth password) are write-only: the API never returns them. Bump the matching *_wo_version to send changed values."
---

A website monitor: HTTP(S) check (`combined`, `http_status`, `ssl_check`) or heartbeat (`heartbeat`, the monitored system pings Uptimeify). Import with the numeric id or the public id.

Updates use the partial mode of `PATCH /api/websites/{id}` whenever every changed field is one that mode accepts (name, url, status, interval, timeout, checks, keyword, expected response, connect target, SSL/domain days, page sizes, grace period). Changes to the customer, countries, HTTP method, redirects, cookies, auth or the write-only secrets need the full mode, which resets omitted fields to defaults, so the provider then sends every attribute and re-applies any value the full mode coerced (`ssl_error_days = 0`, `min_page_size = 0`) with a partial PATCH.

Secrets (custom headers, request body, authorization header, basic auth password) are write-only: the API never returns them. Bump the matching `*_wo_version` to send changed values.

## Example Usage

```terraform
data "uptimeify_customer" "shop" {
  name = "Example Shop GmbH"
}

variable "api_key" {
  type      = string
  sensitive = true
}

# HTTP check with request headers, body, content checks and a connect target.
resource "uptimeify_website" "api" {
  customer_id     = tonumber(data.uptimeify_customer.shop.id)
  name            = "Shop API health"
  url             = "https://shop.example.com/api/health"
  http_method     = "POST"
  check_interval  = 5
  timeout_seconds = 10

  expected_status_codes = "200"
  check_keyword_enabled = true
  search_term           = "\"status\":\"ok\""

  allowed_check_country_codes = ["DE", "NL"]

  # Check the origin directly; SNI and Host header stay shop.example.com.
  connect_host = "origin.example.com"
  connect_port = 8443

  # Write-only: never stored in state, never returned by the API.
  # Bump the version to send changed values.
  custom_headers_wo = [
    { name = "X-Api-Key", value = var.api_key },
    { name = "Accept", value = "application/json" },
  ]
  custom_headers_wo_version = 1
  request_body_wo           = jsonencode({ probe = true })
  request_body_wo_version   = 1
}

# Heartbeat: the monitored job calls the ping URL with heartbeat_token.
resource "uptimeify_website" "nightly_backup" {
  customer_id                    = tonumber(data.uptimeify_customer.shop.id)
  name                           = "Nightly backup"
  monitoring_type                = "heartbeat"
  check_interval                 = 1440
  heartbeat_grace_period_minutes = 60

  # Change to any new value to mint a new token. The old token stops working
  # immediately, so roll out the new ping URL in the same change.
  heartbeat_token_rotation = "2026-10"
}
```

## Schema

### Required

- `customer_id` (Number) Numeric id of the customer that owns the monitor. Changing it moves the monitor.
- `name` (String)

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `allow_duplicate` (Boolean, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Create the monitor even if the customer already has one of this type for the same target. Without it the create fails with 409 `monitorAlreadyExists` and the error names the import command for the existing monitor. Sent with create only.
- `allowed_check_country_codes` (Set of String) Upper-case ISO country codes of the check locations. Unset at create: the package default (null = all). Removing it later keeps the last value.
- `auth_mode` (String) `none`, `authorization_header` (needs `authorization_header_wo`) or `basic` (needs `basic_auth_username` and `basic_auth_password_wo`). Defaults to `none`.
- `auth_wo_version` (Number) Change to resend the auth secrets.
- `authorization_header_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only value of the Authorization header for `auth_mode = "authorization_header"`. Sent with create and whenever `auth_mode`, `basic_auth_username` or `auth_wo_version` changes.
- `basic_auth_password_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only basic auth password, sent like `authorization_header_wo`.
- `basic_auth_username` (String) Username for `auth_mode = "basic"`.
- `check_domain_expiry_enabled` (Boolean) Domain expiry check. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_expected_response_enabled` (Boolean) Compare the response body with `expected_response_value`. Defaults to `false`.
- `check_https_redirect_enabled` (Boolean) HTTP to HTTPS redirect check. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_interval` (Number) Minutes between checks; at least the package minimum, at most 1440 (43200 for heartbeat). Defaults to `30`.
- `check_keyword_enabled` (Boolean) Keyword check against `search_term`; off without a search term. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_response_time_enabled` (Boolean) Response time check (the threshold is not configurable per monitor). Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_size_enabled` (Boolean) Page size check against `min_page_size`/`max_page_size`; off without a limit. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_ssl_enabled` (Boolean) Certificate validity and expiry check. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `check_status_enabled` (Boolean) Status code check against `expected_status_codes`. Unset: the package default. The package may switch it off; a full update switches it off on heartbeat monitors.
- `connect_host` (String) Connect target (`connectHost`): IP or host name to connect to instead of the URL's host; SNI and Host header stay the URL's. Lower case, without port (use `connect_port`), must be public.
- `connect_port` (Number) Port of the connect target; unset = the URL's port.
- `connect_tls_insecure` (Boolean) Skip certificate verification at the connect target; needs `connect_host`. Defaults to `false`.
- `cookie_handling` (String) `none` or `jar` (keep cookies across redirects). Defaults to `none`.
- `custom_headers_wo` (Attributes List, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only request headers. Names and values are stored encrypted and never returned (see `has_custom_headers`). Sent with create and whenever `custom_headers_wo_version` changes; an empty or removed list then clears them. (see [below for nested schema](#nested-schema-for-custom_headers_wo))
- `custom_headers_wo_version` (Number) Change to resend `custom_headers_wo`.
- `domain_expiry_error_days` (Number) Error this many days before domain expiry. Defaults to `7`.
- `domain_expiry_notice_days` (Number) Warn this many days before domain expiry. Defaults to `30`.
- `expected_response_json_path` (String)
- `expected_response_match_type` (String) `contains`, `equals` or `json_path_equals` (needs `expected_response_json_path`). Defaults to `contains`.
- `expected_response_value` (String)
- `expected_status_codes` (String) Comma-separated accepted status codes. Defaults to `200,301,302`.
- `follow_redirects` (Boolean) Defaults to `true`.
- `heartbeat_grace_period_minutes` (Number) Heartbeat monitors: minutes a ping may be late. Server default 5; null for other types.
- `heartbeat_token_rotation` (String) Heartbeat monitors: any value; changing it to a new non-null value mints a new heartbeat token (`heartbeat_token` changes, `url` stays). The old token stops working immediately, so update the pinging job in the same rollout. Setting it at create does not rotate.
- `http_method` (String) `GET`, `QUERY`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD` or `OPTIONS`. Defaults to `GET`.
- `max_page_size` (Number) Bytes; dropped by the server while `check_size_enabled` is off.
- `min_page_size` (Number) Bytes; dropped by the server while `check_size_enabled` is off.
- `monitoring_type` (String) `combined`, `http_status`, `ssl_check` or `heartbeat`. Changing it replaces the monitor. Defaults to `combined`.
- `request_body_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only request body (stored encrypted, never returned, see `has_request_body`). Sent with create and whenever `request_body_wo_version` changes.
- `request_body_wo_version` (Number) Change to resend `request_body_wo`.
- `search_term` (String) Keyword the page must contain (needs `check_keyword_enabled`; the server drops it while that check is off).
- `ssl_error_days` (Number) Error this many days before certificate expiry; at most `ssl_notice_days`. Defaults to `0`.
- `ssl_notice_days` (Number) Warn this many days before certificate expiry. Defaults to `7`.
- `status` (String) `active`, `inactive` or `maintenance`. Defaults to `active`.
- `timeout_seconds` (Number) Request timeout, 1 to 60. Defaults to `30`.
- `url` (String) URL with protocol; required except for heartbeat monitors. Heartbeat monitors get `heartbeat://<monitor id>` from the server (the ping token is `heartbeat_token`), leave it unset there. Must resolve to a public address at create and update.

### Read-Only

- `created_at` (String)
- `has_custom_headers` (Boolean) Whether custom headers are stored.
- `has_request_body` (Boolean) Whether a request body is stored.
- `heartbeat_token` (String, Sensitive) Heartbeat monitors: token of the ping URL (server-generated). Sensitive: anyone with it can report the job as healthy.
- `id` (String) Numeric website id.
- `public_id` (String) Public UUID of the website.
- `updated_at` (String)

### Nested Schema for `custom_headers_wo`

Required:

- `name` (String, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments))
- `value` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments))

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
# Numeric id or public id. Write-only secrets are not imported; set them and their *_wo_version afterwards.
terraform import uptimeify_website.api 42
```