Domain Monitoring

Set up continuous monitoring for your most important domains. ComplianceLayer automatically runs scheduled scans and alerts you when security posture changes or critical issues are detected.

Adding a Domain

Add a domain to your monitoring list with a scan frequency and alert threshold:

curl -X POST "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "scan_frequency": "daily",
    "alert_on_score_drop": true,
    "alert_threshold": 10
  }'

Request Fields

The endpoint responds 200 OK with the created record. Adding a domain you are already monitoring returns 400, and exceeding your plan's domain limit returns 403.

Scan Frequencies

Every plan can use any of the three frequencies. The practical limit is your monthly scan quota, not your tier.

Alert Configuration

Score Drop Alerts

Score-drop alerting is the per-domain control. Set alert_on_score_drop to enable it, and alert_threshold to choose how large a drop must be, in points, before an alert is raised:

• alert_threshold: 5 — Very sensitive monitoring
• alert_threshold: 10 — Alert on a 10+ point drop (default)
• alert_threshold: 20 — Alert on major changes only

Other Alert Types

Alerts for critical findings, certificate expiry, and configuration changes are controlled at the account level rather than per domain, through PUT /v1/settings/alert-preferences — see Settings. Alert types you may see on a monitored domain include score_drop, critical_issue, cert_expired, cert_expiring_soon, and config_change.

Listing Monitored Domains

curl "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Only active domains are listed. limit_used and limit_maxshow how much of your plan's domain allowance is in use. Grades are A through F.

Triggering Manual Scans

Trigger an immediate scan outside of the regular schedule. This consumes a scan from your monthly quota and responds 202 Accepted with the queued job:

curl -X POST "https://api.compliancelayer.net/v1/domains/123/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

If your monthly scan limit is already used up, this returns 403 with a detailof "Monthly scan limit reached". If a scan for the domain is already in flight, the existing job is returned instead of queueing a duplicate.

Viewing Alerts

curl "https://api.compliancelayer.net/v1/domains/alerts?unread_only=true&limit=20" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

The response is a bare array, newest first — there is no wrapper object. Filter it with these query parameters:

Read state is tracked with is_read. Mark one alert read with POST /v1/domains/alerts/{alert_id}/read, or several at once with POST /v1/domains/alerts/mark-all-read (which accepts the same severity, alert_type, and domain_id filters).

Removing a Domain

Stop monitoring a domain:

curl -X DELETE "https://api.compliancelayer.net/v1/domains/123" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Plan Limits

The number of domains you can monitor at once depends on your plan. Scan frequency is not restricted by plan.

Best Practices

1. Prioritize Critical Domains

Reserve hourly scanning — and the quota it consumes — for:

• Production customer-facing applications
• Payment processing systems
• Domains handling sensitive data
• High-value targets

2. Set Appropriate Thresholds

• Threshold 5: Very sensitive, may generate false positives
• Threshold 10: Balanced, catches most important changes
• Threshold 20: Only major security degradations

3. Combine with Webhooks

On the Pro plan and above, configure webhooks to receive alert.triggered events as they happen. This enables automated responses like:

• Creating tickets in your issue tracker
• Posting to Slack/Teams channels
• Triggering remediation workflows
• Updating dashboards

4. Review Historical Data

Track score trends over time to identify:

• Gradual security drift
• Impact of security improvements
• Seasonal patterns
• Correlation with deployments