Monitoring

API Transaction Monitoring

Chain multiple HTTP requests into one scripted transaction — extract a value from one response and reuse it in a later request.

An API Transaction monitor runs a sequence of HTTP requests in order — the API equivalent of Synthetic Monitoring's browser scenario, without a browser. Log in, extract an auth token from the response, and use it in every request that follows. Any step failing (network error, unexpected status, a missing assertion, or an extraction that finds nothing) fails the whole check.

Availability

API Transaction Monitoring is a plan-gated feature — chaining requests with variable extraction is meaningfully more capability than a single custom request (Advanced HTTP Monitoring). Check Settings > Plan, or ask your organization's Owner.

Steps

Each step is one HTTP request:

Field	What it does
`method`, `url`	The request to send — defaults to GET
`headers`, `body`	Sent with the request; both support `{{variable}}` substitution
`expectedStatus`	Fails the step unless the response matches — defaults to any 2xx
`assertBodyContains`	Fails the step unless the response body contains this substring
`extractPath` + `extractAs`	Pull a value out of a JSON response (dot-notation, e.g. `data.token`) and save it as a named variable for later steps

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msk_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Login + Fetch Profile",
    "type": "api-transaction",
    "target": "Login + fetch profile",
    "intervalSeconds": 300,
    "timeoutSeconds": 30,
    "config": {
      "apiTransactionSteps": [
        {
          "method": "POST",
          "url": "https://api.example.com/login",
          "headers": { "Content-Type": "application/json" },
          "body": "{\"email\":\"probe@example.com\",\"password\":\"...\"}",
          "extractPath": "data.token",
          "extractAs": "token"
        },
        {
          "method": "GET",
          "url": "https://api.example.com/profile",
          "headers": { "Authorization": "Bearer {{token}}" },
          "assertBodyContains": "probe@example.com"
        }
      ]
    }
  }'

extractPath is deliberately a small dot-notation extractor (object fields only, no arrays or wildcards) rather than full JSONPath — enough to pull a token or ID out of a typical API response.

What's not encrypted yet

Like Synthetic Monitoring's steps, headers and body values are stored and returned in the open, not encrypted like Basic Auth. A short-lived token your own transaction extracts (the actual point of this feature) never touches storage at all — it only exists in memory during one check run. Don't put a real long-lived credential (an API key, a fixed Authorization header) into a step until this gets the same encrypted, never-round-trips treatment Basic Auth has.

How it runs

API Transaction monitors don't go through Blackbox Exporter or Prometheus — no Blackbox module chains requests or carries state between them. They run on MonSPHERE's own internal scheduler, the same one Heartbeat, Synthetic, and WHOIS monitors use, so there's no region to pick.