Uptime Monitoring
What is API Monitoring?
API monitoring is the process of collecting and analyzing data about the correctness and performance of application programming interfaces (APIs).
A robust API monitoring tool will allow you to monitor all aspects of availability and performance of the APIs that you use so that you can quickly and efficiently identify and solve problems that impact your business’s performance and bottom line.
Before selecting an API monitoring solution, it's important to first understand what an API is, how API testing works, and how to get the most out of any API monitoring tool.
What Is An Application Programming Interface (API)?
An application programming interface (API) provides a way for one computer system (or subsystem) to communicate with another.
APIs enable programmers to create complex systems by creating custom business logic for a specific use case and exposing it for others to use - including managing shipping and logistics, securely handling payment processing, and running customer service functions.
There are three basic types of APIs.
- Public API: Public APIs are accessible to anyone who wants to use them.
- Private API: Private APIs are internal to an organization and can be used to build and connect internal systems and applications.
- Partner API: Partner APIs are semi-private APIs that allow you to connect with strategic partners and services that grant your business access to their API.
To ensure that your users and customers get the best experience, you want to be able to understand how all three types of APIs are performing over time.
Why Is API Monitoring Important?
Because APIs are critical for running applications and key processes in modern business, it's essential to have a robust and reliable API monitoring tool that allows you to quickly understand the availability and performance of APIs.
For example, let’s say that you are using a payment processing API to allow customers to purchase your product and modify their existing plans. If that payment processing API has any problems, like going down for some period of time, it’s critical that you know right away so that you can work on a solution and avoid losing potential customers or the trust of existing users.
The more APIs that you use to run your business, especially when they are used for important parts of the customer journey, the more important it is to have API monitors running in the background to ensure the APIs are performing as you expect.
With a check, Cronitor requests the API on a schedule from its public regions and applies assertions to the response. Alerts go to the notification list on the monitor. The reference is Website & API monitoring. Private APIs that those regions cannot reach are covered in Monitoring Private Endpoints and APIs.
How API Monitoring Works
API monitoring is a systematic process of assessing the availability and performance of APIs, and it sits next to website monitoring when the page and the API fail separately.
An API exposes the functionalities of a system through its endpoints, and the functionalities and performance of the API are also measured through those endpoints. To implement API monitoring, a remote server sends a request to the API endpoints and receives a response from your API server. These API calls are then used to track and monitor metrics like response time, payload size, throughput, uptime, downtime, lag in the network, and other metrics.
Primary Ways to Assess API Performance
There are two common ways of monitoring and assessing API performance.
Synthetic monitoring: Synthetic monitoring makes API requests on a schedule from locations you choose, whether or not a person is calling the API.
You can implement synthetic API monitoring by automating the testing of your APIs using tools that can send requests from multiple locations, device types, and networks from around the world and track performance. This is a controlled form of API testing, and it gives you full control of the initial testing conditions as well as the volume of data you collect around your API's performance.
Real user monitoring (RUM): RUM records pageviews, page load, Core Web Vitals, and JavaScript errors from real browsers. It does not record each API call your server handled. A slow API can still show up as a slow page. Install steps are in the RUM quickstart.
An important difference between RUM and synthetic monitoring is that you lose control over the testing location, networks, device types, and other conditions. The benefit, however, is that you get access to real user data, which can be helpful in resolving issues that synthetic testing may miss.
A check is the direct measurement of the API. RUM is the downstream view: pages got slower or started throwing errors for some visitors. Use the check when you need the status code and the body. Use RUM when you need to see what the browser did.
The two together show an API error, a stretch of downtime, and the pages that felt it. They do not, by themselves, audit who is allowed to call the API. A 401 assertion can tell you the unauthenticated boundary still refuses callers. See Monitor an MCP Server for that pattern on an OAuth-protected URL.
API Metrics to Monitor
Start with a few measurements that map to assertions on a check.
Response Time
Response time is the total time between when a request is made by the client and when the response is sent back to the client. This time includes the time required to process the request in the server and deliver an output to the user or client.
Another way to look at response time is through transport latency and processing time. Transport latency is the time it takes for a request or response to be sent to or from the processing component (server/client). The processing time is then the time it takes for the system to process the request. Hence, response time = transport latency + processing time.
Postman can measure one call by hand. A check repeats it. The chart is the duration of Cronitor’s request, split into percentiles.
Response Status Code
For every response that is returned to the client, there is always an HTTP status code that indicates the result of the operation. This can be a successful response (2XX), responses that indicate bad requests from the client (4XX), or those that indicate the server might be the cause of the error (5XX).
A check records the status code on every run. Assert response.code = 200 (or whichever code you expect) so a 401 or 500 fails the check. The latest activity row on the monitor page shows the code, the duration, and the region.
The request itself is configured on the check: method, interval, timeout, headers, regions, and whether to verify the certificate and follow redirects.
Assertions Based on Response Data
An assertion is simply comparing the response received with the response expected. This process helps to set up checks that are specific to the response of each API and may help in catching cases where the right status code was sent but the body did not contain the right content.
On a JSON health endpoint, two common assertions are response.code = 200 and response.json status = ok. Body assertions use response.body contains when the payload is not JSON, or when the response is an event stream that Cronitor’s JSON assertions cannot open. The form is on the same edit page as the alert settings.
Requests per Minute
Requests per minute count the calls clients make to the API. Related numbers are requests per second and queries per second. Those numbers tell you whether to scale or to throttle.
A Cronitor check does not count your callers. It records its own probes: status, duration, and assertion results. Caller volume stays in your API logs or metrics backend.
API Monitoring Best Practices
It’s helpful to remember a few practices that make the alerts worth reading.
Prioritize Important Endpoints
Of course, every API endpoint is important for you and your business as there is a reason it exists. However, some of these endpoints carry more weight than others. A good way to identify important endpoints is to check if they are part of a critical user journey, such as making a payment or filing a complaint.
For example, an endpoint to retrieve details about a product will be more important for an e-commerce app than endpoints that return comments about that product. Both are essential, but one is more important than the other. Thus, it is very important to identify endpoints like this and set up monitoring for these first. You can prioritize important APIs when setting up alerts.
Set Targets
For all the metrics that you monitor, it is important to tie them to measurable targets. For instance, you can set up alerts when critical APIs are down for longer than a critical time threshold. These alerts, which are tied to the target that matter for your business, will help you identify and resolve the problems that impact your bottom line the most.
Monitor SSL Certificate and Expiration
Security on the internet is more vital than ever. Thus, whichever API monitoring tool you choose should be able to verify the SSL certificates of the endpoints that are being monitored.
HTTPS checks verify the certificate unless you turn that off. Add ssl_certificate.expires_in > 30 days when you want the warning before the renewal window, and pick a threshold longer than the time you need to renew. The Verify SSL Certificate checkbox is on the request form shown above.
Monitor Unauthorized Access or Protected Pages
It is not enough to test if access to a page is possible; you should also set up checks to know if authorized pages can be accessed by unauthorized users. This might indicate a breach in your security and lead you toward a timely fix.
Do Not Forget Alerts
Setting up alerts and notification systems when creating checks or monitors is a very important task because without them, you will never be able to respond to incidents in time. This is why you should choose a monitoring tool that can send customized alerts about issues via the communication medium of your choice.
Set Up Status Pages
While knowing when something's wrong with your web app or APIs is crucial, it is also helpful to provide your users with a way of checking the status of your services by themselves. Status pages are used for this purpose, and with a tool like Cronitor, you can create a status page for your API very easily. Status pages promote transparency with your users and help develop trust.
Choosing an API Monitoring Tool
A good API monitoring strategy starts with a reliable API monitoring tool. If you are new to API monitoring, you might want to start with an API monitoring tool that does the grunt work for you, leaving you with plenty of time to focus on growing your business.
Things to Consider When Choosing an API Monitoring Tool
- Usability: You want an API monitoring tool that is easy to use. If the tool is intuitive, then you will be able to customize it for your specific needs and readily have digestible data about the performance of APIs you’re monitoring.
- Test locations: Run the check from the regions where the callers are. A failure in one region and a pass in another is a different incident from a failure everywhere.
- Customization and flexibility: You’ll want to be able to seamlessly configure the API monitoring tool to fit your current and future API monitoring needs. It’s particularly helpful if a tool allows you to reuse scripts that your API developers and testers already use.
- Accurate data: Data is only useful if it is accurate and verifiable. That means you want a tool that provides you with accurate data and the ability to inspect and verify the content of the data you receive.
- Synthetic and RUM testing: While synthetic monitoring is the primary form of assessing API performance, having a tool that gives you real user monitoring data can help you understand the full picture of the user experience.
- SSL certificates: SSL verification checks are another feature you should look out for in the tool you select. For example, can the tool check for certificate validity and DNS information, and alert you to upcoming expirations?
- Alerts and notifications: The tool should allow you to set up custom alerts and notifications when something important happens, like when an API is down for a certain time or when response time spikes over several requests. Support for setting up alerts in your core communication channels (Slack, email, SMS) is also helpful for making sure your team is notified in a timely manner.
- Cost: Because API monitoring is important, it’s worth paying a little extra to find a tool that provides you with the customization, data, communication, accuracy, and alerts that will help your team identify and solve any errors quickly.
Cronitor: A Reliable API Monitoring Solution
A Cronitor check requests the API on a schedule, stores the status and the response time, and alerts the notification list when an assertion fails. Create the check in the app or with the Monitor API. If the API is an MCP server, use the tools/list recipe in Monitor an MCP Server.
If the API is public but firewalled, allow Cronitor’s static addresses. If it must stay on a private network, report the result from inside that network. Both cases are in Monitoring Private Endpoints and APIs.