These docs are a work in progress: some pages may still be incomplete or contain inaccuracies.
fastmon Docs

Authentication

API requests authenticate with an fm_… Bearer token.

Every /v1/ endpoint requires authentication. The public API uses a single scheme: a Bearer token.

The dashboard SPA uses session cookies, but they're only valid for the dashboard's own origin. Programmatic clients (CI jobs, scripts, backend services) must use a Bearer token.

Bearer token

Generate a token in the dashboard under Account → API token. It looks like fm_<long-random-suffix> and is shown once. Store it in your secret manager immediately; there is no recovery flow.

Send it on every request:

Authorization: Bearer fm_abcdef…
Example
curl https://api.fastmon.eu/v1/sites \
  -H "Authorization: Bearer fm_abcdef…"

Lost tokens are unrecoverable. Server-side they're hashed; only the fm_ prefix is queryable. To rotate, regenerate from the dashboard; the previous token stops working immediately.

What a token can do

  • Per-user. A token carries the identity of the user who generated it. Regenerating from the dashboard replaces it (the previous value stops working immediately).
  • Same scope as the user. A token from a member does what a member can; a token from an owner does what an owner can.
  • Org-spanning. If the user is in multiple organizations, the token works against all of them.

Common surprises

  • You can't manage another user's token. Even an owner can only regenerate their own.
  • API overview: base URL and conventions.
  • Errors: 401 unauthorized and 403 forbidden responses.

API Reference

Base URL, authentication, response envelopes, and the auto-generated endpoint reference.

Errors

Error envelope, status codes, and what each common code means.

On this page

Bearer tokenWhat a token can doCommon surprisesRelated