# Monitoring

import {
  Accordion,
  AccordionContent,
  AccordionItem,
  AccordionTrigger,
} from "zudoku/ui/Accordion";

<Accordion type="single" collapsible className="not-prose mb-6 rounded-md border px-3 text-sm">
<AccordionItem value="endpoints" className="border-none">
<AccordionTrigger className="py-2 text-sm hover:no-underline">API endpoints used in this page</AccordionTrigger>
<AccordionContent className="pb-3 [&_ul]:my-0 [&_ul]:list-disc [&_ul]:ps-5 [&_ul]:space-y-1.5 [&_li]:leading-6">

- [`GET /v1/devices`](/api/devices)
- [`GET /v1/devices/{id}`](/api/devices)
- [`GET /v1/sites`](/api/sites)

</AccordionContent>
</AccordionItem>
</Accordion>

The API exposes the operational state of every device and site, so fleet health can be delivered to
the systems your teams already operate, on a schedule you define, and combined with data held
outside SecuriThings.

## Scenarios

- **NOC dashboards.** Forward device and site state into the dashboards and monitoring stack your
  NOC already operates.
- **Custom alerting.** Evaluate conditions such as offline for longer than a set period, or a single
  probe down across an entire site, and raise them in your own alerting system.
- **CMDB correlation.** Join device state with records held outside SecuriThings, such as asset
  ownership, maintenance windows, or support contracts.
- **SIEM ingestion.** Deliver device state into your SIEM alongside your other security telemetry.
- **Availability reporting.** Responses describe current state, so recording them on a schedule
  produces the availability and trend reporting your organization requires.
- **Automated response.** Pair a detection with an
  [executed task](/use-cases/device-remediation) to remediate without manual intervention.

## Device connectivity

`status` reports the connectivity of a device, and `lastSeen` reports the last time the device was
not offline, that is, the last time it was `online` or `partial`. Filter server-side rather than
retrieving the full inventory:

```bash
curl "https://api.securithings.com/v1/devices?status=offline&limit=100" \
     -H "Accept: application/json" \
     -H "Authorization: Bearer <token>"
```

```json
{
  "name": "Headquarters camera1",
  "status": "partial",
  "lastSeen": "2026-07-09T11:20:00Z",
  "maintenanceMode": false,
  "probe": {
    "agent": "unmonitored",
    "deviceSource": "down",
    "edge": "up",
    "host": "up",
    "app": "up"
  }
}
```

A `status` of `partial` indicates that some, but not all, of the device's probes are reporting. The
`probe` fields identify which component is affected, and each one is also available as a filter.

:::info

`maintenanceMode` identifies devices under planned work. Exclude them when generating alerts to
avoid reporting expected downtime.

:::

## Site connectivity

Sites expose their own `status`, so connectivity per location can be retrieved without paging
through every device:

```bash
curl "https://api.securithings.com/v1/sites?status=offline&limit=100" \
     -H "Accept: application/json" \
     -H "Authorization: Bearer <token>"
```