| API key | A secret code that lets a script use the obsrvly API. It starts with obs_ and is shown once. Create it under secrets → api keys. Send it in the header Authorization: Bearer <key>. |
| Bearer token | The API key sent in the header Authorization: Bearer <key>. |
| CDN | A content delivery network. It serves your site from many places around the world. A site behind a CDN may change its IP address often. |
| Certificate authority (CA) | A company that issues certificates, such as Let's Encrypt. Discovery shows the issuer of your certificate. |
| CI | Continuous integration. A system that runs your build and deploy jobs. |
| Cron, crontab | Cron runs jobs at set times on Linux and macOS. A crontab is the file that lists those jobs and their schedules. A heartbeat can use a cron expression as its schedule. obsrvly accepts an expression even if it never runs, so check yours. |
| CSS selector | A pattern that points to an element on a web page, such as #login or button.submit. Browser monitor steps use selectors to click, fill in and check elements. |
| Endpoint | One address of a website or API that you send requests to, such as https://api.acme.io/v1/orders. |
| Exit code | The number a program returns when it ends. 0 means success. Any other number, up to 255, means it failed. A heartbeat can report it. |
| Health endpoint | A page whose only job is to report that a service is running, such as /health. Discovery labels these health-path. The discovery page lists the probe as health-paths. |
| HMAC | A signature made from a message and a shared secret. When a webhook channel has a signing secret, obsrvly signs each request with it. You use the signature to check that a request came from obsrvly. See chapter 11. |
| Host | A computer on the internet, named by a host name (such as api.acme.io) or an IP address. A host has no https://, port or path. |
| HTTP, https | The way browsers and apps talk to websites. https is the secure, encrypted form. URL monitors need an address that starts with http:// or https://. |
| IPv4, IPv6 | The two forms of IP address. IPv4 looks like 203.0.113.7. IPv6 looks like 2001:db8::7. DNS monitors check A records for IPv4 and AAAA records for IPv6. |
| JSON | A common text format for data, such as {"status": "ok"}. |
| Payload | The body of a message or request. |
| Port | The number a service listens on, such as 443. |
| Regular expression (regex) | A pattern that describes text. For example, ^ok$ means exactly ok. URL, API and multi-step API monitors use the RE2 style of regex. Browser monitors use JavaScript regex (4.1). |
| Resolve | To look up a name, such as acme.io, and find its IP address. A name that does not resolve cannot be reached. |
| RFC 3339 | The date-time form 2026-10-27T18:00:00Z, in UTC. |
| Status code | A three-digit number a website sends with every reply. 2xx means success, such as 200. 3xx means a redirect to another address. 4xx means a problem with the request, such as 404 Not Found. 5xx means a problem on the server, such as 503. |
| TLS, certificate | TLS is what makes https secure. A certificate is the file a site uses to prove who it is. It is valid for a limited time. A TLS certificate monitor warns you when warn_days days or fewer are left (21 in the dashboard, 30 through the API if you leave it out). |
| Webhook | A web address that accepts messages from another service. Slack, Microsoft Teams and Discord give you one to post into a channel. A webhook channel sends alerts to your own system. |