PulseWise API Documentation

Getting Started

curl -H "Authorization: Bearer YOUR_API_KEY" \
     https://pulsewise.com/api/v1/status

Authentication

Authorization: Bearer YOUR_API_KEY

API Endpoints

Log Monitor ingest

Your application posts an hourly summary of what happened; PulseWise tells you when those numbers stop looking like your application. Everything below is what you need to write a client — see Log Monitor to create a source and get its key.

Request

{
  "hours": [
    {
      "hour": "2026-09-08T14:00:00Z",     // start of the hour, ISO 8601, UTC
      "events": {                          // omit a type, or send 0 — same thing
        "login_success": 42,
        "login_failure": 3,
        "password_reset": 1
      },
      "distinct_users": 31,                // optional
      "distinct_ips": 28,                  // optional
      "new_ips": 4                         // optional
    }
  ]
}

Event types

Send whichever apply. Unknown names are ignored rather than rejected, so a client reporting something newer than this server does not lose the hours that came with it.

Response

HTTP 202
{
  "success": true,
  "accepted": 1,
  "rejected": [],                          // anything refused is named, never silently dropped
  "next_expected_hour": "2026-09-08T15:00:00+00:00"
}

202 with a non-empty rejected array means some hours were not stored and why. Log it — a client that ignores it will keep resending the same rejected hours forever while its operator believes the site is monitored. 401 is an unknown or rotated key, 403 a paused source, 422 a malformed body.

A worked example

curl -X POST https://pulsewise.com/api/v1/logs/ingest   -H "X-Ingest-Key: ls_your_key_here"   -H "Content-Type: application/json"   -d '{"hours":[{"hour":"2026-09-08T14:00:00Z","events":{"login_success":42,"login_failure":3},"distinct_users":31}]}'

In a Laravel application, an hourly scheduled command is usually the whole client:

// Runs hourly. Reports the hour that has just closed — including
// the hours when nothing happened, which is the point.
$hour = now()->utc()->subHour()->startOfHour();

Http::withHeaders(['X-Ingest-Key' => config('services.pulsewise.ingest_key')])
    ->post('https://pulsewise.com/api/v1/logs/ingest', [
        'hours' => [[
            'hour' => $hour->toIso8601String(),
            'events' => [
                'login_success'  => Activity::type('login')->inHour($hour)->count(),
                'login_failure'  => Activity::type('login_failed')->inHour($hour)->count(),
                'password_reset' => Activity::type('password_reset')->inHour($hour)->count(),
            ],
            'distinct_users' => Activity::inHour($hour)->distinct('user_id')->count(),
        ]],
    ])->throw();

Site Monitor — scheduled malware scanning

The /api/malware/{target} endpoint above is a one-shot check: it fetches a page and tells you whether known malware is being served right now. With no history to compare against, it cannot tell you that something changed.

Site Monitor is the stateful half. Register a website and PulseWise fetches its home page — and any same-domain sub-pages you name — on a cadence you choose, then reports what it finds.

Error Codes

Rate Limits

Support