Everything the console shows rides public endpoints — anything you can see, you can script. GET /v1/status/cas for CA and generation health including freshest CRL, /v1/status/components for the fleet, /v1/status/metrics?window= for per-role CPU, memory and dependency latency (samples kept 35 days), /v1/status/datastores for database and module probes, /v1/events for the replayable lifecycle feed.
Be honest about what is not there: no Prometheus /metrics endpoint and no shipped alert pack. Scrape /v1/status/metrics — the same data the console charts — and write alerts against it plus the notification rules, which are the built, server-side conditions. Prometheus exposition and OpenTelemetry tracing are designed, not built.
The short alert list: CRL remaining validity under 24 hours; any stale component heartbeat; audit/verify not intact; PostgreSQL unavailable; disk on the database volume. Most of that can page you through notifications — what cannot is PostgreSQL itself down (nothing can write the event) and database disk. Those two still need your infrastructure monitoring, and no product feature substitutes for them.
Now I can script my monitoring from the same data the console reads.