API
API keys are live. You create them in the app under Integrations, API keys (owner and admin only), and send them as a bearer token:
Authorization: Bearer pst_...A key belongs to one organization. It carries scopes, monitors, incidents,
status-pages and webhooks, each as :read or :write, plus org:read; a write scope
implies read on the same resource. You can narrow a key further to selected projects, or to
individual monitors. Revocation and expiry take effect on the next request, not at the end
of some cache window.
Keys cannot manage keys. The management endpoints require a browser session by construction, so a leaked key can read what its scopes allow and can never mint itself a successor.
What accepts a key today
Section titled “What accepts a key today”Key authentication is active on seven read endpoints:
| endpoint | what it returns |
|---|---|
| monitors in a project | the list with state, type, interval, regions |
| a single monitor | detail as the cockpit shows it |
| monitor checks | the raw check results behind that monitor |
| monitor time series | response times over a window |
| monitor incidents | incidents attached to that monitor |
| incidents in an organization | the list |
| a single incident | detail with its timeline |
Which scope unlocks what
Section titled “Which scope unlocks what”Not every scope is honoured yet. Selecting one that is not changes nothing, so this table says plainly where each one works today:
| Scope | REST with an API key | MCP |
|---|---|---|
monitors:read |
4 endpoints | read tools, according to the connected tools/list |
monitors:write |
not honoured | write tools, also checked against the current role |
incidents:read |
3 endpoints | read tools, according to the connected tools/list |
incidents:write |
not honoured | acknowledge and resolve tools when authorized |
status-pages:read |
not honoured | a read tool when offered by tools/list |
status-pages:write |
reserved | reserved |
webhooks:read |
reserved | reserved |
webhooks:write |
reserved | reserved |
org:read |
reserved | reserved |
Reserved means the scope exists and can be selected, but nothing checks it yet. A key that carries only reserved scopes can do nothing at all. We list them here rather than hide them, because a scope picker that offers more than the product honours is worse than a short list.
The catalogue below is deliberately limited to these seven key-authenticated endpoints. The curated public OpenAPI contract can also describe session-authenticated operations, but is not a catalogue of every internal route.
The full reference
Section titled “The full reference”Every endpoint the public contract carries is documented, all 73 operations across 52 paths, currently version 1.0.0-beta.1.
The pages are generated at build time from the vendored contract. Each one carries its parameters, its request body, and every documented response, with the schemas expanded.
The spec is also served by the product itself at api.perstat.io/openapi.json. The copy here belongs to the build you are reading and is the one the pages below were generated from; the product’s copy is whatever is deployed right now. They are normally the same file, and when they are not, the product is ahead.
Feature areas that are not released, such as multi-step checks, are excluded until they ship.