Web API Monitoring: Choosing the Right Protocol

Dotcom-Monitor supports REST, SOAP, GraphQL, gRPC, WebSockets, and Webhooks. REST monitors validate JSONPath assertions and HTTP methods. SOAP monitors parse WSDL and validate XML with XPath. GraphQL monitors handle queries, mutations, and nested data structures. gRPC monitors decode Protobuf responses. WebSocket monitors track bidirectional message flows. Webhook monitors verify delivery and retry logic.

Multi-step monitors chain up to 20 API calls in sequence. Each step can extract data from the previous response using JSONPath or XPath, then pass it to the next request as a header, query parameter, or body field. For example, step 1 might POST to /login and extract a JWT token, step 2 uses that token in the Authorization header for GET /cart, and step 3 uses the cart ID from step 2 to POST /checkout. Each step tracks timing, status codes, and response payloads independently.

Dotcom-Monitor supports OAuth 2.0 (with automatic token refresh), JWT, API keys, Basic Auth, and custom header schemes. Credentials are encrypted in the Secure Vault. For OAuth 2.0, the monitor can automatically refresh access tokens when they expire. Certificate-based authentication (mTLS) is supported for gRPC and HTTPS endpoints. SOAP monitors support WS-Security username tokens and X.509 certificates.

Yes. Dotcom-Monitor imports Postman Collections (v2.1) and Insomnia exports with one click. The import process converts requests, headers, authentication, and environment variables into Dotcom-Monitor monitors. Multi-step workflows are preserved, and JSONPath assertions can be added after import. Variables like {{baseUrl}} and {{authToken}} are automatically mapped to Dotcom-Monitor variables.

Use JSONPath assertions for REST and GraphQL (e.g., $.status == “success” or $.items.length > 0). Use XPath for SOAP XML responses (e.g., //OrderStatus/text() = “Confirmed”). You can also validate HTTP status codes (200, 201, 204, 400, 500), response headers (Content-Type, Cache-Control), and response time thresholds (e.g., step 1 < 500ms, step 3 < 2000ms). Regex pattern matching is available for custom validation.

When a monitor fails (status code error, assertion failure, timeout, or DNS resolution failure), Dotcom-Monitor sends alerts to Slack, PagerDuty, Microsoft Teams, email, or webhook within 30 seconds. The alert includes step-by-step diagnostics: DNS resolution time, SSL handshake duration, response time per step, full response payloads, and error messages. Monitors retry 3 times before triggering an alert to avoid false positives.

Yes. Dotcom-Monitor’s Private Agent runs inside your network to monitor internal APIs, staging environments, and firewall-protected endpoints. The agent connects outbound to Dotcom-Monitor’s platform (no inbound firewall rules required), executes monitors on your schedule, and reports results back. Private Agents support all protocols (REST, SOAP, GraphQL, gRPC, WebSockets, Webhooks) and all authentication methods.

Dotcom-Monitor provides a REST API and Terraform provider to manage monitors as code. You can create, update, or delete monitors from CI/CD pipelines using YAML configuration files. Trigger on-demand API checks from Jenkins, GitLab CI, GitHub Actions, or CircleCI. Fail builds if API response times exceed thresholds or assertions fail. Export monitor configurations to version control for audit trails.