Skip to main content
APIContext
Talk to salesStart free
Start HereGuidesConceptsCLIReferenceChangelogStatus

Network Conformance Checks

Network monitoring conformance checks extend your monitors to verify not just whether an API responds correctly, but whether the underlying network and certificate infrastructure meets your requirements, including DNS, TLS handshake, CDN routing, and cross-cloud performance.

Network checks are set per project, not per monitor. You configure them in the Manage Network Checks section of Conformance Settings: in the left sidebar, select Conformance, then the Settings tab.

TLS certificate expiry monitoring​

APIContext can alert you before your API's TLS certificate expires, giving you time to renew before users are affected.

Configure expiry alerts​

  1. Open Conformance Settings and find the Manage Network Checks section.
  2. Turn on Enable TLS Certificate checks.
  3. In Fail when TLS certificates are close to expiry, choose when the check fails:
OptionThe check fails when
Only fail for expired certificatesThe certificate has expired
1 day before certificate expiresThe certificate expires within 1 day
7 days before certificate expiresThe certificate expires within 7 days
30 days before certificate expiresThe certificate expires within 30 days

A failing check shows on the Conformance Summary under Network TLS Certificates.

CDN allowlist verification​

If your API is served through a CDN, you can verify that requests are being routed through your expected CDN network and not bypassing it.

APIContext supports allowlist verification for 24 CDN providers, including:

  • Akamai
  • Amazon CloudFront
  • Azure Front Door
  • Cloudflare
  • Edgio
  • Fastly
  • Gcore CDN
  • And more: see the Manage Network Checks section of Conformance Settings for the full list.

Configure a CDN allowlist check​

  1. In the Manage Network Checks section of Conformance Settings, turn on Enable Content Delivery checks.
  2. Under Require calls to be handled by one of the following CDNs, choose the expected CDN providers.
  3. APIContext verifies that the X-Cache, X-CDN, or server header matches the expected CDN signature.

Geo-fencing and data sovereignty checks​

Data sovereignty requirements may require that API traffic stays within specific geographic boundaries. Geo-fencing checks verify three things, each set on its own tab:

  • Origin: calls only pass when they are made from the locations you allow.
  • Destination: calls only pass when they are served by services hosted in the locations you allow.
  • Routing: calls from specific locations only pass when they are routed to services hosted in specific locations.

Configure geo-fencing​

  1. In the Manage Network Checks section of Conformance Settings, turn on Enable Geo-fencing and data sovereignty checks.
  2. Open the Origin, Destination, or Routing tab and choose the approved locations. On Origin, pick the locations in Allow calls from. On Destination, pick the locations in Allow services hosted in. On Routing, pair Allow calls from with a destination, so that calls from one location must be served from another.
  3. A call that breaks a rule fails the check.

If you add rules on more than one tab, a warning appears: "There are rules defined in multiple tabs. This may result in overly permissive conformance checks." Use one tab for each requirement where you can.

See also​