StatusCake
DEVELOPER · DEVELOPER
Uptime, pagespeed, SSL and heartbeat checks with their history in that account.
Connecting StatusCake in practice
StatusCake ties its API rate limit to your subscription: an account without one is capped at 60 requests per minute, a paid account has no per-minute cap, and both share a burst limit of 5 requests per second. The quota is per account "regardless of which token was used", so issuing a second token buys no extra throughput.
Scopes that draw scrutiny
Authorization: Bearer ${API_TOKEN}One account-wide bearer token with no scopes, and multiple tokens share a single quota, so there is no way to isolate an agent’s traffic from the rest of the account.
Rate limits
- Accounts without a subscription: a maximum of 60 requests per minute.
- Accounts with a paid subscription: no per-minute limit.
- All accounts: a burst limit of 5 requests per second.
- Headers are x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset, where the limit header carries a composite such as "5, 60;w=60, 5;w=1" and the first value is the limit currently enforced.
- Over the limit returns 429, and x-ratelimit-reset gives the seconds until the enforced limit lifts.
Worth knowing
- The composite x-ratelimit-limit value means a naive parser reads "5" as the whole story and misses the per-minute window entirely.
- Pagination defaults to 25 and caps at 100, so a large estate of checks is always several pages.
- Several fields are enums rather than free integers: an SSL check rate must be one of 300, 600, 1800, 3600, 86400 or 2073600 seconds.
- SSL alert scheduling requires "exactly 3 numerical values" for the days on which alerts fire, so you cannot supply one or five.
Checked against StatusCake API reference (2026-09-29), API rate limiting (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put StatusCake behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.