API Reference

Base URL, authentication, response envelopes, and the auto-generated endpoint reference.

The fastmon REST API is the same surface the dashboard uses. The endpoint reference is auto-generated from the backend's OpenAPI document on every docs build, so it never drifts from the running service.

The API is not production-ready

Endpoints, request shapes, response shapes, field names, and error formats can change at any time without notice. There is no deprecation window and no compatibility guarantee yet.

Use the API for prototypes, internal tooling, and exploration. Don't build production systems against it. We'll cut a stable contract and announce a deprecation policy before recommending it for production use.

Cross-cutting topics

Authentication

API keys as Bearer tokens: personal (fm_…) and organization-owned (fmo_…).

OAuth apps

How first-party integrations connect: PKCE, short-lived tokens, rotating refresh.

MCP server

Read-only analytics for the customer's own AI client, over the Model Context Protocol.

Errors

Error envelope, status codes, and what each common code means.

Pagination

Offset by default, cursor for high-volume endpoints.

Endpoints

Pages are auto-generated per OpenAPI tag. Each operation has its own page with split-layout schema, language tabs (curl, JS, Python, Go, Java, C#), and a Try-it playground.

Organizations

Top-level account container: members, plans, billing.

Members

Organization membership: list, remove, transfer ownership.

Organization keys

API keys the organization owns: mint, edit, rotate, revoke.

Connections

The apps connected to an organization, and how to disconnect one.

Applications

The tracking embed: source and collector hashes, collection config, hash rotation.

Sites

The domains an application runs on. Each has its own dashboard and traffic.

Releases

Versioned markers on a site, used for before/after comparisons.

Analytics

Web Vitals, sessions, errors, third-party impact queries.

Synthetic

Lighthouse lab tests: pages, runs, results, lab-vs-field.

Notifications

Notification rules: create, evaluate, test, history.

Partners

Partner accounts: client sites and usage.

Base URL

https://api.fastmon.eu

Endpoints sit directly under it: GET /organizations, POST /sites/{site_id}/releases.

Every path also answers under a leading /v1. That is a permanent alias for the URLs minted before the prefix was dropped, kept so nothing built against it has to move; leave it off in new code. Public ingest (POST /c/{collector_hash} and GET /s/{source_hash}.js) has never carried a prefix and has its own contract, and so does the MCP server at POST /mcp.

Quick example

curl https://api.fastmon.eu/organizations \
  -H "Authorization: Bearer fm_$YOUR_TOKEN"

{
  "data": [
    { "id": "01HZX…", "name": "Acme", "plan": "pro" }
  ],
  "meta": { "limit": 50, "offset": 0, "total": 1, "has_more": false }
}

Conventions

IDs are UUID v7 strings: sortable by creation time.
Timestamps are ISO-8601 UTC with Z: 2026-04-18T12:34:56.123456Z.
Single resources are returned raw; lists wrap with data + meta; errors wrap with error. See Errors.
Default limit is 50; max is 100 on every list endpoint.
X-Request-ID is on every response. Mirror it back when reporting issues.

Schema document

The raw OpenAPI document lives at api.fastmon.eu/openapi.json. Drop it into your favorite generator (openapi-typescript, oapi-codegen) for a typed client.