---
title: "What the drift monitor last found for the domain, and what was done"
method: GET
path: "/connections/{id}/monitor"
tags: ["Monitor"]
---

# What the drift monitor last found for the domain, and what was done

`GET /connections/{id}/monitor`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/connections/{id}/monitor`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Every live domain is checked against its records once an hour. This returns the last check (when, the result, the drifted records with expected and observed values), what was done about drift (put back automatically with the continuous access CustomDomain™ holds, or left for the tenant because the record was changed rather than removed, because there is no continuous access, or because automatic repair is not switched on), whether repairs are automatic for this domain and why, the records it is held to, and the drift history. An end user's widget token (scope `connect`) reads this only when it is bound to the domain and minted with the connection's own `end_user_ref`; use an API key otherwise.

Automatic repair runs only where the deployment switched it on (`MONITOR_AUTO_REPAIR`; `repair.paused` is true otherwise). It puts back only the record sets that disappeared, from the records CustomDomain™ wrote (a kept Domain Connect authorization re-applies its template, the only write it allows), and only for drift that began after a clean check. A record missing since monitoring started is left for the tenant. Repairs are paced and capped per hourly pass and per provider account, and after 3 repairs of a domain within 24 hours the monitor stops and reports `fix_failed`.

## Path parameters

- `id` string, required

## Response `200`

The monitoring state

- MonitorView
  - `connection_id` string, required
  - `domain` string, required
  - `watched` boolean, required
  - `active` boolean, required
  - `every` string, required: How often the domain is checked (hour).
  - `last_checked_at` string, date-time, nullable, required
  - `next_check_at` string, date-time
  - `result` 'ok' | 'drift' | 'inconclusive' | 'unconfirmed' | 'not_checked' | 'not_watched', required: The last check. `drift` is only reported after a second, independent look at the zone's own nameservers confirmed it; `inconclusive` means the lookup did not answer and the previous finding stands; `unconfirmed` means the first lookup saw a change the zone's own nameservers could not be asked to confirm (see `reason`): earlier drift stands and nothing is restored.
  - `reason` 'ns_lookup_failed' | 'timeout' | 'all_servers_refused' | 'no_server_answered' | 'delegated' | 'unsupported_type': Set when `result` is `unconfirmed`, why the nameservers could not confirm.
  - `unconfirmed_checks` integer: Set when `result` is `unconfirmed`, how many checks in a row. At 3 the workspace gets one inbox entry.
  - `drift_since` string, date-time
  - `drift` DriftRecord[], required
    - `subdomain` string, required: The record's name relative to the domain ("@" for the domain itself).
    - `type` string, required
    - `verdict` 'record_missing' | 'record_changed', required
    - `expected` string[], required
    - `observed` string[]
  - `checked` integer, required: Records compared in the last check.
  - `error` string
  - `action` object: What was done about the drift: `auto_fixed` (put back), `fix_failed` (the repair failed, did not hold, or the records were put back 3 times in 24 hours and disappeared again) or `action_required` (left for the tenant).
    - `kind` 'auto_fixed' | 'fix_failed' | 'action_required'
    - `at` string, date-time
    - `description` string
  - `attention` 'action_required' | 'fix_failed' | 'drift': Set while drift needs the tenant (action_required, fix_failed) or is being repaired (drift).
  - `repair` object, required
    - `automatic` boolean, required: True when CustomDomain™ holds continuous access and puts disappeared records back itself.
    - `paused` boolean: True when CustomDomain™ holds the access (`via`) but this deployment has automatic repair switched off (`MONITOR_AUTO_REPAIR`): missing records are reported, not put back. Omitted otherwise.
    - `via` 'managed_dns' | 'sign_in' | 'domain_connect' | 'provider_account'
    - `detail` string, required
  - `alerts` object, required
    - `webhooks` boolean
    - `email` boolean
  - `watching` object[]: The records the domain is held to.
    - `name` string
    - `type` string
    - `value` string
  - `history` DomainEvent[]
    - `id` string, required
    - `application_id` string
    - `connection_id` string
    - `domain` string, required
    - `kind` string, required: One of connection.created, connection.applied, connection.live, connection.failed, connection.records.updated, connection.reapply.failed, connection.records_outdated, connection.disconnected, records.removed, records.rewritten, certificate.issued, certificate.renewed, certificate.failed, certificate.expiring, certificate.removed, drift.found, drift.fixed, drift.fix_failed, drift.action_required, drift.restored, access.granted, access.revoked, access.needs_reconnect. A connection or certificate kind that is also a webhook event type is written with the webhook, so the timeline and an integrator see the same history.
    - `detail` object
    - `created_at` string, date-time, required

## Other responses

- `401`: Error envelope: {code, title, details}.
- `403`: Error envelope: {code, title, details}.
- `404`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)