Continuous uptime monitoring

PreFlight continuously monitors the production surface it can safely discover. You provide the app URL; endpoint discovery builds and maintains the route inventory automatically.

Automatic endpoint discovery

Discovery runs when an app is created, its URLs change, ownership is verified, a production deployment succeeds, monitoring is enabled, and during a daily refresh.

It combines:

• the configured site, API, and health URLs;
• same-party links and JavaScript bundle references;
• sitemap entries;
• OpenAPI documents and concrete GET/HEAD operations;
• conventional health and status routes on explicit or verified first-party origins.

PreFlight never auto-invokes POST, PUT, PATCH, DELETE, form actions, dynamic identifier routes, logout routes, or destructive-looking paths. A protected endpoint that returns 401 or 403 is monitored in reachability mode: the auth boundary is treated as healthy without storing or inventing credentials.

Monitoring cadence

Up to 20 high-confidence routes are active per app. Up to five primary, health, status, or explicit API routes use the plan's fastest monitoring cadence. Supporting pages and API routes run every five minutes.

Each route keeps independent status, latency, failure streak, recovery state, and alert cooldowns. Project uptime is the conservative, time-weighted minimum across critical endpoints, so a healthy homepage cannot hide a failed API.

Run and review

1. Open Health → Continuous uptime monitoring.
2. Enable monitoring for the app.
3. Review the discovered surface and use Rediscover endpoints after a routing change if you do not want to wait for the next automatic refresh.
4. Configure the failure threshold, latency SLO, cadence, and alert destinations.

The authenticated API exposes the same endpoint inventory and 24-hour, 7-day, and 30-day time-weighted windows. Manual “Run now” requests sample the full active inventory, not only the homepage.

Shared audit surface

The inventory is shared with site and security audits. Page-oriented audits crawl discovered pages, while active security audits issue bounded, safe GET requests to discovered API routes to check authentication boundaries, exposed collections, CORS posture, and unstable server-error paths. Exposed-secret scans also inspect discovered first-party origins.