Fluxguard API Documentation for Website Monitoring

Fluxguard documents a beta API for managing parts of website monitoring and retrieving monitored-page data. Authenticate with an API key in the x-api-key header. Use API calls when your application needs to add pages, start crawls, or fetch page data; use a webhook when you want Fluxguard to send your endpoint a notification after it detects a change.

This guide covers the endpoints and webhook behavior in Fluxguard’s published documentation. Fluxguard says “our API is still in beta.” Endpoint details may change, so check the live API documentation before implementing or updating an integration.

1. What the Fluxguard API covers

The documented API provides operations for account lookup, adding monitored pages, starting a session crawl, retrieving page data, managing webhooks and categories, and deleting sites or pages. The guide does not establish that every feature available in the Fluxguard console has an API endpoint.

Fluxguard organizes monitoring into sites, sessions, and pages. A session can represent a user flow, and a site can contain sessions and monitored pages. Treat these as the documented API’s organization model; do not assume console controls such as crawl frequency or browser actions are available through the API unless Fluxguard documents an endpoint for them.

Need	Use
Check organization account attributes	GET /account
Add a page to monitoring	POST /add-page
Start a crawl for a session	POST /site/{siteId}/session/{sessionId}/crawl
Retrieve monitored-page data	GET /site/{siteId}/session/{sessionId}/page/{pageId}
Receive notifications when changes are detected	Configure a webhook

2. Create and protect an API key

1. Create an API key in your Fluxguard organization settings.
2. Send it on API requests in the x-api-key HTTP header.
3. Keep it in server-side configuration or a secrets manager. Do not put it in browser code, public repositories, or client-visible logs.
4. If a key is removed in organization settings, it no longer works. Update any integrations that used it.

The documented API returns JSON data. The API guide’s authentication example is:

curl -H 'x-api-key: YOUR_API_KEY' https://api.fluxguard.com/account

For production, inject the key from a protected environment variable instead of writing the literal secret into source code. The examples below use FLUXGUARD_API_KEY as a placeholder environment variable; set it in your runtime’s secret configuration before running them.

3. Look up the account

GET /account takes no parameters and returns organization account attributes. This is a useful first request to check that the key is accepted and that the API host is reachable.

cURL

curl --fail-with-body \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Accept: application/json" \
  https://api.fluxguard.com/account

Python

import os
import requests

api_key = os.environ["FLUXGUARD_API_KEY"]
response = requests.get(
    "https://api.fluxguard.com/account",
    headers={"x-api-key": api_key, "Accept": "application/json"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Node.js

const apiKey = process.env.FLUXGUARD_API_KEY;
if (!apiKey) throw new Error("Set FLUXGUARD_API_KEY first");

const response = await fetch("https://api.fluxguard.com/account", {
  headers: {
    "x-api-key": apiKey,
    "accept": "application/json",
  },
});
if (!response.ok) {
  throw new Error(`Fluxguard returned ${response.status}: ${await response.text()}`);
}
console.log(await response.json());

4. Add a page to monitoring

Use POST /add-page with a URL. The documented request can also include site or session identifiers, category selection, and a site nickname. The response includes siteId, sessionId, and pageId; retain these identifiers because the crawl and page-data endpoints use them.

Field	Use
url	Required URL of the page to add.
siteId	Optional site identifier for organizing the page.
sessionId	Optional session identifier for organizing the page.
categories, categoryId, or categoryName	Optional category selection. The guide documents these alternatives; confirm the live API documentation for the exact accepted representation.
siteNickname	Optional nickname for the site.

The API guide demonstrates sending JSON form data to https://api.fluxguard.com/add-page. This example uses only the required URL so it does not assume an existing site, session, or category.

cURL

curl --fail-with-body -X POST \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data '{"url":"https://example.com/"}' \
  https://api.fluxguard.com/add-page

Python

import os
import requests

api_key = os.environ["FLUXGUARD_API_KEY"]
response = requests.post(
    "https://api.fluxguard.com/add-page",
    headers={"x-api-key": api_key, "Accept": "application/json"},
    json={"url": "https://example.com/"},
    timeout=30,
)
response.raise_for_status()
created = response.json()
print(created)
# Save the returned siteId, sessionId, and pageId for later API calls.

Node.js

const apiKey = process.env.FLUXGUARD_API_KEY;
if (!apiKey) throw new Error("Set FLUXGUARD_API_KEY first");

const response = await fetch("https://api.fluxguard.com/add-page", {
  method: "POST",
  headers: {
    "x-api-key": apiKey,
    "content-type": "application/json",
    "accept": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com/" }),
});
if (!response.ok) {
  throw new Error(`Fluxguard returned ${response.status}: ${await response.text()}`);
}
const created = await response.json();
console.log(created);
// Store created.siteId, created.sessionId, and created.pageId as appropriate.

If you already have a site or session, the guide says you may pass the corresponding identifiers. Add the optional category or nickname fields only after checking the live guide’s accepted request shape. Avoid guessing whether identifiers should be strings, numbers, or nested objects.

5. Start a crawl and retrieve page data

After adding a page, use the identifiers returned by the add-page response. The documented crawl request has no parameters beyond the identifiers in the path. The page-data request also has no query parameters documented.

Start a crawl with cURL

curl --fail-with-body -X POST \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Accept: application/json" \
  "https://api.fluxguard.com/site/$SITE_ID/session/$SESSION_ID/crawl"

Retrieve page data with cURL

curl --fail-with-body \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Accept: application/json" \
  "https://api.fluxguard.com/site/$SITE_ID/session/$SESSION_ID/page/$PAGE_ID"

Set SITE_ID, SESSION_ID, and PAGE_ID to the actual identifiers. URL-encode path values if your identifiers contain characters that have meaning in a URL path. The documentation does not specify crawl completion timing or a polling interval; do not treat a successful crawl-start request as proof that capture and processing have finished.

6. Choose API polling or webhooks

The API and webhooks solve different integration problems. API calls are initiated by your application: the documented API can start crawls and retrieve page data. Webhooks are push-based: when Fluxguard detects a change, it POSTs change data to the destination you configure. Fluxguard describes a webhook as a “reverse API.”

Question	API calls	Webhook
Who initiates the request?	Your application calls Fluxguard.	Fluxguard sends a POST to your endpoint after a detected change.
Best fit	Start a crawl or request page data on demand.	React to detected changes without repeatedly checking for them.
Payload shape	JSON response from the requested endpoint.	JSON metadata and references to larger artifacts.
Operational concern	Handle request failures and any polling your workflow requires.	Verify authenticity if configured, accept deliveries reliably, and save needed artifacts.

Webhook payloads can reference screenshots, HTML, and diff artifacts stored separately instead of embedding all file contents. The webhook guide says referenced files may only be available for a limited time. If your workflow needs durable records, download and store the required artifacts off-site when they arrive.

7. Manage webhooks

The documented webhook endpoints are:

Method and path	Purpose
GET /account/webhook/sample	Return a sample webhook.
PUT /account/webhook	Create a webhook using a destination url; returns an ID.
GET /account/webhook	List organization webhooks.
DELETE /account/webhook	Delete a webhook using its id.

For example, inspect the sample using the same API key header:

curl --fail-with-body \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Accept: application/json" \
  https://api.fluxguard.com/account/webhook/sample

Webhook creation uses a destination URL. Consult the current API guide for the exact body encoding and any optional settings before configuring it:

curl --fail-with-body -X PUT \
  -H "x-api-key: $FLUXGUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data '{"url":"https://your-service.example/fluxguard-webhook"}' \
  https://api.fluxguard.com/account/webhook

The endpoint and required URL field are documented; verify the accepted encoding against the live guide if the request is rejected. Protect the receiver with HTTPS, validate incoming requests, and make its processing idempotent so retries or duplicate events do not create duplicate downstream work.

8. Authenticate incoming webhook requests

Webhook authentication is optional in Fluxguard’s webhook guide. It describes a per-webhook secret and an HMAC-SHA256 signature represented in the fluxguard-signature header. The guide also describes a timestamp and signature; verify both according to the exact current implementation details in the webhook documentation.

• Use the raw request body for signature verification if the guide’s signing procedure requires it. Parsing and re-serializing JSON can change the bytes and invalidate a signature.
• Use a constant-time comparison for the expected and received signature where your framework supports it.
• Check the signed timestamp against a reasonable age window to reduce replay risk, following the vendor’s documented format and procedure.
• Reject invalid signatures before triggering side effects. Keep the webhook secret out of source control and logs.
• Do not assume a signature format, prefix, delimiter, or timestamp unit. Follow the live guide exactly.

The available documentation summary does not specify enough of the signature’s byte-level format to give a safe generic verification function here. Copy the current verification procedure from Fluxguard’s guide for your server framework rather than implementing an inferred format.

9. Categories and destructive operations

Categories

Categories help organize monitored sites. The documented endpoints are GET /account/category to list category data and POST /account/category to create a site category using name. The add-page operation can select categories using the documented category fields. Confirm the live API guide for exact JSON shapes before combining these operations.

Delete a site or page

These operations remove monitored data and should be treated as destructive:

• DELETE /site/{siteId} deletes a site and its sessions, pages, and captures.
• DELETE /site/{siteId}/session/{sessionId}/page/{pageId} deletes a page and its captures.

Before calling either endpoint, verify the identifiers and confirm that any data needed for audits or downstream records has been saved. The API documentation is the source of truth for current response and deletion behavior.

10. Troubleshooting

Symptom	Likely cause	What to check
Authentication is rejected	The key is missing, malformed, or was removed.	Send the key as x-api-key; confirm it remains active in organization settings and that the request reaches the documented API host.
Add-page request fails	The required URL is missing or the body does not match the expected encoding.	Include url, send JSON as shown in the guide, and verify optional field names and formats against the live documentation.
Crawl or page lookup fails	An ID is wrong, belongs to another path hierarchy, or was not captured from the add-page response.	Use the returned site, session, and page IDs together; check that the path has no accidental whitespace or unescaped characters.
Webhook is not received	The destination may be unreachable or the webhook may not be configured as intended.	List configured webhooks, inspect the sample endpoint, and check your server’s HTTPS reachability and request logs.
Webhook signature verification fails	The wrong secret or body bytes were used, or the implementation assumes a signature format.	Use the per-webhook secret and the exact timestamp/signature procedure in the current guide; verify against the unmodified raw body when required.
Artifact link no longer works	Referenced files may only be available for a limited time.	Download required screenshot, HTML, or diff artifacts when the notification arrives and retain them in your own storage.
Endpoint behavior differs from an older integration	The API is beta and details can change.	Recheck the current API guide and adjust the integration to its latest documented contract.

11. Reliability, performance, and cost considerations

Reliability

• Keep API credentials server-side and rotate them through organization settings when needed.
• Handle non-success HTTP responses explicitly; do not assume every response is successful JSON.
• Persist IDs returned by page creation so subsequent operations target the intended resources.
• For webhooks, acknowledge valid deliveries promptly, queue slower work, and make downstream processing idempotent.
• Save artifact files your system must retain because the vendor says referenced files may be temporary.
• Because the API is beta, review the live documentation before upgrades and avoid relying on undocumented behavior.

Performance

The provided API documentation does not publish latency, rate limits, crawl completion times, or throughput benchmarks. Avoid hard-coding assumptions about these values. Set request timeouts appropriate to your application, use webhooks when you need change notifications rather than frequent polling, and follow any limits or retry guidance in the current Fluxguard documentation.

Cost

The reviewed API and webhook documentation does not establish Fluxguard pricing. Check Fluxguard’s current plan and account terms for costs relevant to your monitoring volume, retention needs, and integration. The available sources do not support a direct pricing comparison.

12. Or skip the browser setup

If your workflow needs screenshots as files or image responses, ScreenshotNeo is a website screenshot API and MCP server. It takes one GET request with a URL and returns a PNG, JPEG, WebP, or PDF. Its capture options include full-page and element screenshots, custom waits, and browser settings. See the ScreenshotNeo API documentation.

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

ScreenshotNeo removes cookie banners, popups, and chat widgets before the shot. Bot checks, blank pages, and failed loads are never billed; response headers say the page verdict and whether the request was billed. Its MCP server lets AI agents take screenshots. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000.

Sign up for ScreenshotNeo’s free 1,000 screenshots a month, with no card required.

13. FAQ

Does the API cover every Fluxguard console feature?

The published guide documents a set of account, page, crawl, webhook, category, and deletion operations. It does not claim that every console feature has an API endpoint.

Should I poll the API to learn about every change?

If you need event-driven change notifications, configure a webhook. Use API calls for operations such as starting crawls or retrieving page data.

Can I rely on webhook artifact links indefinitely?

No. Fluxguard says referenced files may be available for a limited time. Download artifacts your integration needs to retain.

Where should I confirm the current API contract?

Use Fluxguard’s API guide and webhook guide. The API is beta, and operational details can change.