# Endpoint monitoring: uptime and behavior, with proof-carrying alerts

Service 73 in the services catalog, productized and callable today. Computed live from the platform state on every read: 0 accounts monitoring 0 targets (0 up, 0 down, 0 never checked), 0 checks sealed (0 ok, 0 down) and 0 alerts fired. Every number in this document is computed live from the platform state at the moment of the read — the usage counts from the endpoint targets, the sealed checks and the protection events of live accounts (sandbox and canary accounts excluded). Nothing is cached or stored for this document, no number is invented, and zeros are shown as zeros. Target URLs are never published here: the public document shows aggregate counts only, never a URL or a tenant. Nothing in this service is charged today; verification is free and needs no key.

Data: https://www.a2ally.com/v1/endpoint-monitoring · Catalog: https://www.a2ally.com/services · For agents: https://www.a2ally.com/for-agents · Pricing: https://www.a2ally.com/pricing

## 73. Uptime + behavior monitoring for agent endpoints

proof-carrying alerts. State: live. Spec: rs-endpoint-health/1. Up to 25 targets per account, checked at an interval of at least 5 minutes.

Ok rule: A check counts as ok only when the transport succeeds, TLS verifies for https targets, and the status matches the target's expected_statuses when set; otherwise the status must be 2xx or 3xx for GET and HEAD targets, and any non-5xx status for POST JSON-RPC targets (a 400, 401 or 405 from an RPC endpoint proves it is alive and enforcing; a 5xx does not).

- POST /v1/me/endpoints (account key) — register an https endpoint as a monitoring target (up to 25 per account, checked at an interval of at least 5 minutes)
- GET /v1/me/endpoints (account key) — list this account's monitoring targets with their current state
- GET /v1/me/endpoints/{id}/history (account key) — one target's sealed check history
- POST /v1/me/endpoints/{id}/check (account key) — probe one target now: the check is sealed, and a state flip fires exactly one proof-carrying alert
- POST /v1/me/endpoints/{id}/delete (account key) — delete one of this account's monitoring targets
- GET /v1/endpoint-monitoring (free, no key) — this index document: the service, its callable surfaces, its published ok rule and the live usage counts
- GET /v1/me/protection-events (account key) — read this account's protection events, where the endpoint.health_changed alerts are delivered

Every completed check seals an endpoint.health_check ledger entry whose public payload carries the target id, the status, the latency and the TLS facts, and never the URL. A state flip fires exactly one protection event of kind endpoint.health_changed, carrying the check id and its ledger_seq — the alert carries its own proof, and it is read by the target's own account at GET /v1/me/protection-events.

A target URL lives only in the owner-scoped ep_targets row and in the sealed commitment openings. Public ledger payloads never carry a URL, and this public document shows aggregate counts only — never a URL, a target id or a tenant.