Limits, scope and permissions
The limits on status pages and custom domains, the monitor.statuspages scope for CI tokens, and the IAM actions behind each operation.
Limits
Your organization has a limit on how many status pages it can have, and both published and unpublished pages count. The default limit is one page. To get more, contact support.
Past the limit, creating a page answers 403 with the reason STATUS_PAGE_LIMIT.
An organization with unpaid invoices can't create or publish pages (402), but
pages that are already published stay up.
Custom domains have a
safety cap of 10 per organization. Past it, setting one answers 403 with the
reason STATUS_PAGE_DOMAIN_LIMIT.
The monitor.statuspages scope
CI tokens and other scoped tokens read status pages with any Norcube Monitor
scope. To change anything, they need monitor.statuspages:
| Operation | Scope |
|---|---|
| List and get pages, layouts, logos, custom domains, posted incidents, preview data | Any Norcube Monitor scope |
| Create, update, delete, publish and unpublish pages; set the layout, logo and custom domain; create a preview link; post and correct incidents; post updates | monitor.statuspages |
No other scope includes it, monitor.write included. Everything this scope
changes is public communication on your organization's behalf, so a deploy
pipeline that manages monitors can't announce or hide an outage unless you
granted it this on purpose.
Without the scope, a write answers 403 with the reason INSUFFICIENT_SCOPE.
Permissions
Each operation also checks an IAM action:
| Action | Allows |
|---|---|
monitor:ListStatusPages | Listing pages |
monitor:GetStatusPage | Reading a page, its layout, logo, custom domain, preview data and posted incidents |
monitor:CreateStatusPage | Creating a page |
monitor:UpdateStatusPage | Changing a page, publishing, unpublishing, saving the layout, setting or removing the logo and custom domain, creating a preview link |
monitor:DeleteStatusPage | Deleting a page |
monitor:PostStatusPageIncident | Posting and correcting incidents, and posting updates |
Saving a layout also needs monitor:GetMonitor on every monitor it names.
For finer control than the scope gives, such as a token that posts updates but
can't edit the layout, set a
policy when creating the token,
through the API only. The token may then do only what its scopes and the policy
both allow.