Create a monitor
Start with a public HTTPS URL and set the expected response range to 200–399.
Add monitor →UPnator documentation
Your first trustworthy alert in minutes.
A practical guide to monitors, alerts, incidents, status pages, reports, the API and security — without vague filler.
01
Add an endpointHTTPS · API · TCP · DNS
02Send a test alertE-mail · Telegram · webhook
03Publish a status pageComponents and history
Ready for the first checkQuick start
From zero to working monitoring.
Each step ends with a verifiable result. You do not need to configure everything at once.
Confirm an alert
Add a channel, send a test and confirm that the message was actually delivered.
Alert channels →Show status
Create a public page and assign monitored components.
Status pages →Platform status
Public monitoring runs from three active locations: Germany, Poland and Canada.
The default 2/3 quorum confirms a failure only after matching results from at least two separate hosts.
Choose the check that matches the real failure.
Not every failure is an HTTP error. UPnator separates availability, network, certificate, domain and voice checks so alerts carry useful context.
Website or API
Status code, timing, headers and response body.
Port and service
Connectivity to a database, broker or custom service.
Domain record
Resolver response and expected record value.
Certificate
Validity, hostname and upcoming expiration.
Domain
Expiration date and domain-loss risk.
Scheduled job
A missing signal from a backup, cron job or process.
HTTPSexample configuration
GET https://api.example.com/health
expected status: 200–399
interval: 60 s
timeout: 10 s
quorum: 1 / 1SSRF protection is on by default.
Public probes reject localhost, private and special IP ranges, metadata endpoints and DNS rebinding attempts.
Allowlist all three public probe addresses.
If the monitored server, CDN or WAF blocks unknown sources, allow inbound traffic from the addresses below to the monitored port. For HTTPS this is usually TCP 443; for a TCP monitor, use the port selected in its configuration.
| Region | Public IPv4 | Rule scope |
|---|---|---|
| GermanyFrankfurt | 57.129.40.251 | Monitored service port only |
| Poland | 51.38.134.159 | Monitored service port only |
| CanadaToronto | 209.15.246.235 | Monitored service port only |
Allow all three addresses, not just one.
A 2/3 quorum works correctly only when every region can reach the target. Do not expose administration, Docker, database or NATS ports unless one is the explicit, intentional monitor target.
- Restrict the rule to the source IPv4 and target port, for example
443/TCP. - At HTTP level you can additionally match
User-Agent: UPnator-Probe/0.26.2 (+https://upnator.com), but the IP address remains the network-rule authority. - Private Agent is outbound-only and does not require public probes to enter your private network.
The Network Center is the canonical address list and also publishes JSON and TXT feeds for automation.
Open Network Center →Monitor resources you do not expose to the internet.
The agent is outbound-only: it receives jobs and returns results without opening an inbound port in a LAN, VPN, MPLS or private VPC.
UPnator→ mTLS / outbound →Private Agent→Private resource
- Create an agent in the panel and copy the one-time enrollment material.
- Run it in the network that can reach the monitored target.
- Assign the monitor to the agent probe group and run a manual check.
An alert should reach the right person, once and on time.
A channel is ready only after a successful delivery test. Escalation policies define order and recipients, while maintenance windows silence planned work.
| Channel | Best use | Verification |
|---|---|---|
| Teams and service owners | Delivery test | |
| Telegram | Fast mobile alerts | Bot and chat test |
| Webhook | Automation and custom integrations | HTTP 2xx |
From the first failure to a closed incident.
Retries, failure thresholds, recovery and anti-flap reduce false positives. The timeline keeps results, alerts, acknowledgement, notes and service restoration.
HealthyChecks pass
SuspectRetry and confirmation
DownIncident and alerts
RecoveryRecovery threshold
ResolvedComplete timeline
Quorum does not replace independent infrastructure.
Production regions run on three separate hosts. Use 2/3 to tolerate one unavailable probe, and 3/3 only when a missing regional response must block the decision.
Public status without access to internal systems.
Choose components, a page address and history range. A signed snapshot is served by a separate renderer with no access to PostgreSQL or NATS.
Add components
Group monitors into customer-friendly services.
Set visibility
Control history, description and public address.
Publish updates
Communicate investigation, identification and resolution.
SLA, SLO and history without manual data assembly.
Reports include uptime, incidents, maintenance windows and response metrics. Generate them on demand or schedule recurring delivery.
JSONCSVSHA-256Artifact signatureSecure link
Open reports →SIP and RTP tested like a real call.
OPTIONS checks signaling, REGISTER checks authentication, and Synthetic Call adds SDP, RTP, audio, DTMF, an IVR journey and diagnostic MOS.
Voice requires an active Voice region and a verified destination.
The features are not enabled in the base deployment simply by choosing a plan. Activation requires ready, independent execution infrastructure.
OPTIONSREGISTERRTPDTMFIVRMOS
Automation with tightly scoped permissions.
A key belongs to a service account, has explicit scopes and an expiration date. The secret is shown only once; usage leaves an audit trail.
cURLmonitors:read
curl https://app.upnator.com/api/v1/automation/monitors \
-H "Authorization: Bearer czuwa_api_…"monitors:readmonitors:runincidents:readincidents:ackoperations:readreports:readreports:writeSettings worth enabling immediately.
UPnator protects the execution layer, but organization security also depends on authentication, roles and key lifecycle.
TOTP / passkey
Enable a second factor or hardware key for privileged accounts.
Step-up
Sensitive operations require fresh identity confirmation.
OIDC
Enterprise organizations can enforce their own identity provider.
Roles and audit
Limit administrators and regularly review change history.
Common issues and the first diagnostic step.
Start with the latest monitor result and its execution time. This usually separates target, network and configuration issues immediately.
The monitor remains pending
Check that the monitor is active, has an available probe group and that its interval is within the plan limit.
Manual check works, but no alert arrives
Check the channel test, escalation policy, failure threshold and active maintenance windows.
The public probe rejects an address
The target likely resolves to a private or special IP range. Use a Private Agent in the same network.
I need help with the first setup
Tell us what you want to monitor, what result means success and who should receive the alert.
Could not find the answer?
Contact usDescribe the target and expected result. We will reply with a concrete configuration scenario.