API reference
Internal cron
This is an internal operational endpoint, documented for completeness and self-hosting. It is the entrypoint a scheduled workflow calls to run monitoring rescans that are due. It is not part of the customer-facing API and is not authenticated with your API key.
POST
/internal/run-due-scansOperators only
You do not call this endpoint. It is invoked by Sift Health’s scheduler. It’s documented here so self-hosters and the curious understand how monitoring runs without a always-on worker.
How it works
A scheduled workflow (for example, a cron-triggered GitHub Actions job) calls this endpoint on an interval with a shared secret. The call doubles as a keep-alive ping for a free-tier instance. On each tick the endpoint:
- Selects MonitoringSubscriptions whose next_run_at is in the past.
- Processes a small batch per tick (pages per scan capped at ~15–20) to stay within free-tier budgets.
- Diffs each result against the site baseline and emits alerts for new, resolved, score-drop, and cert-expiry events.
- Advances each subscription's next_run_at according to its cadence.
Authentication
The endpoint is gated by a shared secret carried in a header (not your customer API key). Requests without the correct secret are rejected.
bash
# Illustrative — run by the scheduler, not by customers
curl -s -X POST https://api.sifthealth.app/internal/run-due-scans \
-H "X-Cron-Secret: $SIFT_CRON_SECRET"