diff --git a/.env.example b/.env.example
index 827420e..723cb58 100644
--- a/.env.example
+++ b/.env.example
@@ -13,6 +13,7 @@ CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
 APOLLO_DEMO_USERNAME=apollo
 APOLLO_DEMO_PASSWORD=apollo
 APOLLO_SEED_ON_STARTUP=false
+APOLLO_ALLOW_REGISTER=true
 
 # Due-check worker loop (seconds)
 CHECK_INTERVAL_SECONDS=60
diff --git a/README.md b/README.md
index 6c52c1a..183764e 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Django + React API Health Monitor (monolith).
 - **Frontend:** React + Vite + Redux Toolkit + React Router (pnpm)
 - **Data:** SQLite (local) or PostgreSQL (`DATABASE_URL`)
 - **Ops:** Docker Compose (`db` + `web` + `worker`), GitHub Actions CI
-- **Product:** due checks, assertions, SSL, mute, probe auth, thresholds, Discord/Slack, status branding, charts, CSV export, retention, incidents, tags, dashboard
+- **Product:** multi-user ownership, advanced assertions, quiet hours, incident ack, charts, exports, Discord/Slack, status page, retention
 
 ## Quick start (local)
 
@@ -23,7 +23,7 @@ poetry run python manage.py runserver
 pnpm --dir frontend dev
 ```
 
-- App: http://localhost:5173 — login **`apollo` / `apollo`**
+- App: http://localhost:5173 — login **`apollo` / `apollo`** (or register if `APOLLO_ALLOW_REGISTER=true`)
 - Public status: http://localhost:5173/status
 
 ## Docker
@@ -35,20 +35,20 @@ docker compose up --build
 
 - App: http://localhost:8000
 - Status: http://localhost:8000/status
-- Worker runs `check_endpoints --due` on an interval
+- Worker runs due checks + `prune_checks` on an interval
 
 ## Features
 
 | Area | Details |
 |------|---------|
-| Auth | Token login/logout/me; API protected except health + public status |
-| Endpoints | CRUD, tags, public, interval, webhook/email/Discord/Slack, mute, probe auth/headers |
-| Checks | Manual, due, history; body/latency assertions; SSL expiry; failure threshold |
-| Alerts | Transition after N failures; muted while `mute_alerts_until` is future |
-| Incidents | Auto-open after threshold, auto-resolve on recovery |
+| Auth | Login/logout/me + optional register; endpoints scoped by owner (staff sees all) |
+| Endpoints | CRUD, tags, public, probe auth/headers/body, mute, quiet hours |
+| Checks | Manual, due, history; body/header/JSON/latency/SSL assertions; failure threshold |
+| Alerts | Webhook/email/Discord/Slack after N failures; muted by datetime or quiet hours |
+| Incidents | Auto open/resolve; acknowledge via API/UI |
 | Status page | Public `/status` + branding via `/api/status/config/` |
-| Dashboard | Uptime, latency, due, open incidents, hourly charts, CSV export |
-| Retention | `prune_checks` / worker deletes checks older than `CHECK_RETENTION_DAYS` |
+| Dashboard | Uptime, latency, charts, CSV export |
+| Retention | Worker prunes checks older than `CHECK_RETENTION_DAYS` |
 
 ## Key API routes
 
@@ -59,15 +59,17 @@ docker compose up --build
 | GET/PATCH | `/api/status/config/` | token |
 | GET | `/api/exports/{checks\|alerts\|incidents}.csv` | token |
 | POST | `/api/auth/login/` | public |
+| POST | `/api/auth/register/` | public (if enabled) |
 | GET | `/api/dashboard/` | token |
 | CRUD | `/api/endpoints/` | token |
 | GET | `/api/incidents/?status=open` | token |
+| POST | `/api/incidents/{id}/acknowledge/` | token |
 | GET/POST | `/api/tags/` | token |
 | GET | `/api/alerts/` | token |
 
 ## Env highlights
 
-See `.env.example` for full list (`DATABASE_URL`, `CHECK_INTERVAL_SECONDS`, `EMAIL_*` / mailer settings, demo user, etc.).
+See `.env.example` (`DATABASE_URL`, `CHECK_INTERVAL_SECONDS`, `CHECK_RETENTION_DAYS`, `APOLLO_ALLOW_REGISTER`, `EMAIL_*`, demo user, etc.).
 
 ## Commands
 
diff --git a/config/settings.py b/config/settings.py
index 905e737..4391134 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -5,6 +5,7 @@
 import os
 from pathlib import Path
 
+from django.core.exceptions import ImproperlyConfigured
 from dotenv import load_dotenv
 
 BASE_DIR = Path(__file__).resolve().parent.parent
@@ -31,11 +32,16 @@ def env_list(name: str, default: str = "") -> list[str]:
     return [item.strip() for item in raw.split(",") if item.strip()]
 
 
-SECRET_KEY = env(
-    "DJANGO_SECRET_KEY",
-    "django-insecure-d90!b7=ck2e9yg59eu4)03zucv&yjj2z3hnoiss2z&yt1g2p)q",
-)
 DEBUG = env_bool("DJANGO_DEBUG", True)
+SECRET_KEY = env("DJANGO_SECRET_KEY")
+if not SECRET_KEY:
+    if DEBUG:
+        # Local/dev only — never used when DEBUG is false.
+        SECRET_KEY = "dev-only-change-me"
+    else:
+        raise ImproperlyConfigured(
+            "DJANGO_SECRET_KEY must be set when DJANGO_DEBUG is false."
+        )
 ALLOWED_HOSTS = env_list("DJANGO_ALLOWED_HOSTS", "localhost,127.0.0.1")
 CSRF_TRUSTED_ORIGINS = env_list("DJANGO_CSRF_TRUSTED_ORIGINS", "")
 
@@ -165,6 +171,7 @@ def env_list(name: str, default: str = "") -> list[str]:
 APOLLO_DEMO_USERNAME = env("APOLLO_DEMO_USERNAME", "apollo") or "apollo"
 APOLLO_DEMO_PASSWORD = env("APOLLO_DEMO_PASSWORD", "apollo") or "apollo"
 APOLLO_SEED_ON_STARTUP = env_bool("APOLLO_SEED_ON_STARTUP", False)
+APOLLO_ALLOW_REGISTER = env_bool("APOLLO_ALLOW_REGISTER", True)
 CHECK_INTERVAL_SECONDS = int(env("CHECK_INTERVAL_SECONDS", "60") or "60")
 CHECK_RETENTION_DAYS = int(env("CHECK_RETENTION_DAYS", "30") or "30")
 
diff --git a/conftest.py b/conftest.py
index d346944..a2db19f 100644
--- a/conftest.py
+++ b/conftest.py
@@ -3,10 +3,13 @@
 from rest_framework.authtoken.models import Token
 from rest_framework.test import APIClient
 
+# Fixed test credential — not a real account secret.
+TEST_PASSWORD = "pytest-only-pass"
+
 
 @pytest.fixture
 def user(db) -> User:
-    account = User.objects.create_user(username="tester", password="secret123")
+    account = User.objects.create_user(username="tester", password=TEST_PASSWORD)
     Token.objects.create(user=account)
     return account
 
diff --git a/frontend/src/App.css b/frontend/src/App.css
index fa0d719..97b3022 100644
--- a/frontend/src/App.css
+++ b/frontend/src/App.css
@@ -253,6 +253,32 @@
   color: #5a6670;
 }
 
+.endpoint-form__section {
+  margin-bottom: 0.85rem;
+  border: 1px solid rgba(26, 31, 36, 0.12);
+  background: rgba(255, 255, 255, 0.25);
+}
+
+.endpoint-form__section > summary {
+  padding: 0.65rem 0.85rem;
+  font-size: 0.85rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: #5a6670;
+  cursor: pointer;
+  user-select: none;
+}
+
+.endpoint-form__section[open] > summary {
+  border-bottom: 1px solid rgba(26, 31, 36, 0.1);
+}
+
+.endpoint-form__section > .endpoint-form__grid {
+  padding: 0.85rem;
+  margin-bottom: 0;
+}
+
 .endpoint-form__grid {
   display: grid;
   grid-template-columns: repeat(2, minmax(0, 1fr));
@@ -260,6 +286,22 @@
   margin-bottom: 1rem;
 }
 
+.endpoint-form__quiet-hours {
+  display: grid;
+  gap: 0.35rem;
+}
+
+.endpoint-form__quiet-label {
+  font-size: 0.9rem;
+  color: #4a5560;
+}
+
+.endpoint-form__quiet-row {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.85rem 1rem;
+}
+
 .endpoint-form__wide {
   grid-column: 1 / -1;
 }
@@ -305,6 +347,29 @@
   max-width: 24rem;
 }
 
+.login__tabs {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+}
+
+.login__tab {
+  flex: 1;
+  border: 1px solid rgba(26, 31, 36, 0.2);
+  background: transparent;
+  color: #4a5560;
+  padding: 0.45rem 0.75rem;
+  font: inherit;
+  font-size: 0.9rem;
+  cursor: pointer;
+}
+
+.login__tab--active {
+  background: rgba(26, 31, 36, 0.06);
+  color: #1a1f24;
+  font-weight: 500;
+}
+
 .login__header {
   margin-bottom: 1.75rem;
 }
@@ -526,6 +591,28 @@
   color: #9b2c2c;
 }
 
+.app__badge--ack {
+  border-color: rgba(31, 107, 69, 0.35);
+  color: #1f6b45;
+}
+
+.app__button--ack {
+  margin-top: 0.5rem;
+  border-color: rgba(31, 107, 69, 0.35);
+  color: #1f6b45;
+}
+
+.dashboard__incident-head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.35rem;
+}
+
+.dashboard__incident-item .app__button--ack {
+  margin-top: 0.45rem;
+}
+
 .status-page__nav {
   display: flex;
   align-items: center;
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 46a323d..1059244 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -28,7 +28,7 @@ import {
   type MonitoredEndpoint,
 } from "./store/endpointsSlice"
 import { fetchHealth } from "./store/healthSlice"
-import { fetchIncidents } from "./store/incidentsSlice"
+import { acknowledgeIncident, fetchIncidents } from "./store/incidentsSlice"
 import "./App.css"
 
 function statusLabel(status: string | undefined) {
@@ -42,6 +42,7 @@ function AuthenticatedApp() {
   const health = useAppSelector((state) => state.health)
   const endpoints = useAppSelector((state) => state.endpoints)
   const dashboard = useAppSelector((state) => state.dashboard)
+  const incidents = useAppSelector((state) => state.incidents)
   const [editing, setEditing] = useState<MonitoredEndpoint | null>(null)
   const [historyOpenId, setHistoryOpenId] = useState<number | null>(null)
   const [alertsOpenId, setAlertsOpenId] = useState<number | null>(null)
@@ -121,6 +122,13 @@ function AuthenticatedApp() {
     void dispatch(fetchEndpointAlerts({ endpointId, page }))
   }
 
+  async function handleAcknowledge(incidentId: number) {
+    await dispatch(acknowledgeIncident(incidentId)).unwrap()
+    void dispatch(fetchDashboard(dashboard.hours))
+    void dispatch(fetchIncidents("open"))
+    void dispatch(fetchEndpoints())
+  }
+
   const dueCount = endpoints.items.filter((item) => item.is_active && item.is_due).length
 
   return (
@@ -227,8 +235,16 @@ function AuthenticatedApp() {
                   <div>
                     <p className="app__row-name">
                       {endpoint.name}
+                      {endpoint.owner_username && (
+                        <span className="app__muted"> · {endpoint.owner_username}</span>
+                      )}
                       {endpoint.open_incident && (
-                        <span className="app__badge app__badge--incident">incident</span>
+                        <>
+                          <span className="app__badge app__badge--incident">incident</span>
+                          {endpoint.open_incident.acknowledged_at && (
+                            <span className="app__badge app__badge--ack">acknowledged</span>
+                          )}
+                        </>
                       )}
                       {!endpoint.is_active && (
                         <span className="app__muted"> · inactive</span>
@@ -294,6 +310,18 @@ function AuthenticatedApp() {
                       {last?.latency_ms != null ? ` · ${last.latency_ms}ms` : ""}
                       {last?.status_code != null ? ` · HTTP ${last.status_code}` : ""}
                     </p>
+                    {endpoint.open_incident && !endpoint.open_incident.acknowledged_at && (
+                      <button
+                        type="button"
+                        className="app__button app__button--ack"
+                        disabled={incidents.acknowledgingId === endpoint.open_incident.id}
+                        onClick={() => void handleAcknowledge(endpoint.open_incident!.id)}
+                      >
+                        {incidents.acknowledgingId === endpoint.open_incident.id
+                          ? "Acknowledging…"
+                          : "Acknowledge incident"}
+                      </button>
+                    )}
                   </div>
                   <div className="app__row-actions">
                     <button
diff --git a/frontend/src/components/DashboardPanel.tsx b/frontend/src/components/DashboardPanel.tsx
index bfb8151..80570e1 100644
--- a/frontend/src/components/DashboardPanel.tsx
+++ b/frontend/src/components/DashboardPanel.tsx
@@ -7,6 +7,8 @@ import {
   setDashboardHours,
   type DashboardSeriesBucket,
 } from "../store/dashboardSlice"
+import { fetchEndpoints } from "../store/endpointsSlice"
+import { acknowledgeIncident, fetchIncidents } from "../store/incidentsSlice"
 
 function formatPercent(value: number | null) {
   if (value == null) return "n/a"
@@ -119,10 +121,18 @@ async function downloadExport(path: string, filename: string) {
 export function DashboardPanel() {
   const dispatch = useAppDispatch()
   const { data, loading, error, hours } = useAppSelector((state) => state.dashboard)
+  const { acknowledgingId } = useAppSelector((state) => state.incidents)
   const summary = data?.summary
   const [exportError, setExportError] = useState<string | null>(null)
   const [exporting, setExporting] = useState<string | null>(null)
 
+  async function handleAcknowledge(incidentId: number) {
+    await dispatch(acknowledgeIncident(incidentId)).unwrap()
+    void dispatch(fetchDashboard(hours))
+    void dispatch(fetchIncidents("open"))
+    void dispatch(fetchEndpoints())
+  }
+
   async function handleExport(path: string, filename: string, key: string) {
     setExportError(null)
     setExporting(key)
@@ -328,11 +338,26 @@ export function DashboardPanel() {
               <h3>Open incidents</h3>
               <ul className="dashboard__list">
                 {data.open_incident_list.map((incident) => (
-                  <li key={incident.id}>
-                    <strong>{incident.endpoint_name}</strong>
-                    <span className="app__badge app__badge--incident">open</span>
+                  <li key={incident.id} className="dashboard__incident-item">
+                    <div className="dashboard__incident-head">
+                      <strong>{incident.endpoint_name}</strong>
+                      <span className="app__badge app__badge--incident">open</span>
+                      {incident.acknowledged_at && (
+                        <span className="app__badge app__badge--ack">acknowledged</span>
+                      )}
+                    </div>
                     <p className="dashboard__incident-summary">{incident.summary}</p>
                     <p className="status-page__meta">Opened {formatTime(incident.opened_at)}</p>
+                    {!incident.acknowledged_at && (
+                      <button
+                        type="button"
+                        className="app__button app__button--ack"
+                        disabled={acknowledgingId === incident.id}
+                        onClick={() => void handleAcknowledge(incident.id)}
+                      >
+                        {acknowledgingId === incident.id ? "Acknowledging…" : "Acknowledge"}
+                      </button>
+                    )}
                   </li>
                 ))}
               </ul>
diff --git a/frontend/src/components/EndpointForm.tsx b/frontend/src/components/EndpointForm.tsx
index 9b54331..3fa720f 100644
--- a/frontend/src/components/EndpointForm.tsx
+++ b/frontend/src/components/EndpointForm.tsx
@@ -20,10 +20,17 @@ const EMPTY_FORM: EndpointInput = {
   alert_email: "",
   alert_on_failure: true,
   expect_body_contains: "",
+  expect_header_name: "",
+  expect_header_value: "",
+  expect_json_path: "",
+  expect_json_value: "",
+  request_body: "",
   max_latency_ms: null,
   check_ssl_expiry: false,
   ssl_warn_days: 14,
   mute_alerts_until: null,
+  quiet_hours_start: null,
+  quiet_hours_end: null,
   request_headers: {},
   auth_type: "none",
   auth_username: "",
@@ -79,6 +86,20 @@ function fromLocalDatetimeValue(value: string): string | null {
   return date.toISOString()
 }
 
+function quietHoursToInput(value: string | null): string {
+  if (!value) return ""
+  const match = value.match(/^(\d{2}:\d{2})/)
+  return match ? match[1] : ""
+}
+
+function quietHoursFromInput(value: string): string | null {
+  const trimmed = value.trim()
+  if (!trimmed) return null
+  if (/^\d{2}:\d{2}$/.test(trimmed)) return `${trimmed}:00`
+  if (/^\d{2}:\d{2}:\d{2}$/.test(trimmed)) return trimmed
+  return null
+}
+
 function toInput(endpoint: MonitoredEndpoint): EndpointInput {
   return {
     name: endpoint.name,
@@ -93,10 +114,17 @@ function toInput(endpoint: MonitoredEndpoint): EndpointInput {
     alert_email: endpoint.alert_email,
     alert_on_failure: endpoint.alert_on_failure,
     expect_body_contains: endpoint.expect_body_contains ?? "",
+    expect_header_name: endpoint.expect_header_name ?? "",
+    expect_header_value: endpoint.expect_header_value ?? "",
+    expect_json_path: endpoint.expect_json_path ?? "",
+    expect_json_value: endpoint.expect_json_value ?? "",
+    request_body: endpoint.request_body ?? "",
     max_latency_ms: endpoint.max_latency_ms,
     check_ssl_expiry: endpoint.check_ssl_expiry,
     ssl_warn_days: endpoint.ssl_warn_days,
     mute_alerts_until: endpoint.mute_alerts_until,
+    quiet_hours_start: endpoint.quiet_hours_start,
+    quiet_hours_end: endpoint.quiet_hours_end,
     request_headers: endpoint.request_headers ?? {},
     auth_type: endpoint.auth_type ?? "none",
     auth_username: endpoint.auth_username ?? "",
@@ -123,6 +151,12 @@ export function EndpointForm({
   const [muteLocal, setMuteLocal] = useState(
     initial ? toLocalDatetimeValue(initial.mute_alerts_until) : "",
   )
+  const [quietStartLocal, setQuietStartLocal] = useState(
+    initial ? quietHoursToInput(initial.quiet_hours_start) : "",
+  )
+  const [quietEndLocal, setQuietEndLocal] = useState(
+    initial ? quietHoursToInput(initial.quiet_hours_end) : "",
+  )
   const [maxLatencyText, setMaxLatencyText] = useState(
     initial?.max_latency_ms != null ? String(initial.max_latency_ms) : "",
   )
@@ -134,6 +168,8 @@ export function EndpointForm({
     setForm(initial ? toInput(initial) : EMPTY_FORM)
     setTagsText(initial ? (initial.tags ?? []).join(", ") : "")
     setMuteLocal(initial ? toLocalDatetimeValue(initial.mute_alerts_until) : "")
+    setQuietStartLocal(initial ? quietHoursToInput(initial.quiet_hours_start) : "")
+    setQuietEndLocal(initial ? quietHoursToInput(initial.quiet_hours_end) : "")
     setMaxLatencyText(
       initial?.max_latency_ms != null ? String(initial.max_latency_ms) : "",
     )
@@ -157,11 +193,15 @@ export function EndpointForm({
           ? max_latency_ms
           : null,
       mute_alerts_until: fromLocalDatetimeValue(muteLocal),
+      quiet_hours_start: quietHoursFromInput(quietStartLocal),
+      quiet_hours_end: quietHoursFromInput(quietEndLocal),
     })
     if (!initial) {
       setForm(EMPTY_FORM)
       setTagsText("")
       setMuteLocal("")
+      setQuietStartLocal("")
+      setQuietEndLocal("")
       setMaxLatencyText("")
       setHeadersText("")
     }
@@ -171,269 +211,360 @@ export function EndpointForm({
 
   return (
     <form className="endpoint-form" onSubmit={(event) => void handleSubmit(event)}>
-      <div className="endpoint-form__grid">
-        <label>
-          Name
-          <input
-            required
-            value={form.name}
-            onChange={(event) => setForm({ ...form, name: event.target.value })}
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          URL
-          <input
-            required
-            type="url"
-            placeholder="https://example.com/health"
-            value={form.url}
-            onChange={(event) => setForm({ ...form, url: event.target.value })}
-          />
-        </label>
-        <label>
-          Method
-          <select
-            value={form.method}
-            onChange={(event) => setForm({ ...form, method: event.target.value })}
-          >
-            {METHODS.map((method) => (
-              <option key={method} value={method}>
-                {method}
-              </option>
-            ))}
-          </select>
-        </label>
-        <label>
-          Expected status
-          <input
-            required
-            type="number"
-            min={100}
-            max={599}
-            value={form.expected_status}
-            onChange={(event) =>
-              setForm({ ...form, expected_status: Number(event.target.value) })
-            }
-          />
-        </label>
-        <label>
-          Timeout (s)
-          <input
-            required
-            type="number"
-            min={1}
-            max={120}
-            value={form.timeout_seconds}
-            onChange={(event) =>
-              setForm({ ...form, timeout_seconds: Number(event.target.value) })
-            }
-          />
-        </label>
-        <label>
-          Interval (min)
-          <input
-            required
-            type="number"
-            min={1}
-            max={1440}
-            value={form.check_interval_minutes}
-            onChange={(event) =>
-              setForm({
-                ...form,
-                check_interval_minutes: Number(event.target.value),
-              })
-            }
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Body must contain
-          <input
-            placeholder='e.g. "status":"ok"'
-            value={form.expect_body_contains}
-            onChange={(event) =>
-              setForm({ ...form, expect_body_contains: event.target.value })
-            }
-          />
-        </label>
-        <label>
-          Max latency (ms)
-          <input
-            type="number"
-            min={1}
-            placeholder="optional"
-            value={maxLatencyText}
-            onChange={(event) => setMaxLatencyText(event.target.value)}
-          />
-        </label>
-        <label>
-          SSL warn days
-          <input
-            required
-            type="number"
-            min={1}
-            max={365}
-            value={form.ssl_warn_days}
-            onChange={(event) =>
-              setForm({ ...form, ssl_warn_days: Number(event.target.value) })
-            }
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Mute alerts until
-          <input
-            type="datetime-local"
-            value={muteLocal}
-            onChange={(event) => setMuteLocal(event.target.value)}
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Request headers
-          <textarea
-            rows={3}
-            placeholder={"Authorization: Bearer token\nX-Custom: value"}
-            value={headersText}
-            onChange={(event) => setHeadersText(event.target.value)}
-          />
-        </label>
-        <label>
-          Auth type
-          <select
-            value={form.auth_type}
-            onChange={(event) =>
-              setForm({
-                ...form,
-                auth_type: event.target.value as EndpointInput["auth_type"],
-              })
-            }
-          >
-            {AUTH_TYPES.map((authType) => (
-              <option key={authType} value={authType}>
-                {authType}
-              </option>
-            ))}
-          </select>
-        </label>
-        {form.auth_type === "basic" && (
+      <details className="endpoint-form__section" open>
+        <summary>Basics</summary>
+        <div className="endpoint-form__grid">
+          <label>
+            Name
+            <input
+              required
+              value={form.name}
+              onChange={(event) => setForm({ ...form, name: event.target.value })}
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            URL
+            <input
+              required
+              type="url"
+              placeholder="https://example.com/health"
+              value={form.url}
+              onChange={(event) => setForm({ ...form, url: event.target.value })}
+            />
+          </label>
+          <label>
+            Method
+            <select
+              value={form.method}
+              onChange={(event) => setForm({ ...form, method: event.target.value })}
+            >
+              {METHODS.map((method) => (
+                <option key={method} value={method}>
+                  {method}
+                </option>
+              ))}
+            </select>
+          </label>
           <label>
-            Auth username
+            Expected status
             <input
-              value={form.auth_username}
+              required
+              type="number"
+              min={100}
+              max={599}
+              value={form.expected_status}
               onChange={(event) =>
-                setForm({ ...form, auth_username: event.target.value })
+                setForm({ ...form, expected_status: Number(event.target.value) })
               }
             />
           </label>
-        )}
-        {form.auth_type !== "none" && (
-          <label className={form.auth_type === "bearer" ? "endpoint-form__wide" : undefined}>
-            Auth secret
+          <label>
+            Timeout (s)
             <input
-              type="password"
-              autoComplete="off"
-              placeholder={isEdit ? "Leave blank to keep current" : ""}
-              value={form.auth_secret}
-              onChange={(event) => setForm({ ...form, auth_secret: event.target.value })}
+              required
+              type="number"
+              min={1}
+              max={120}
+              value={form.timeout_seconds}
+              onChange={(event) =>
+                setForm({ ...form, timeout_seconds: Number(event.target.value) })
+              }
             />
           </label>
-        )}
-        <label>
-          Failure threshold
-          <input
-            required
-            type="number"
-            min={1}
-            max={20}
-            value={form.failure_threshold}
-            onChange={(event) =>
-              setForm({ ...form, failure_threshold: Number(event.target.value) })
-            }
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Webhook URL
-          <input
-            type="url"
-            placeholder="https://hooks.example.com/apollo"
-            value={form.webhook_url}
-            onChange={(event) => setForm({ ...form, webhook_url: event.target.value })}
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Discord webhook URL
-          <input
-            type="url"
-            placeholder="https://discord.com/api/webhooks/…"
-            value={form.discord_webhook_url}
-            onChange={(event) =>
-              setForm({ ...form, discord_webhook_url: event.target.value })
-            }
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Slack webhook URL
-          <input
-            type="url"
-            placeholder="https://hooks.slack.com/services/…"
-            value={form.slack_webhook_url}
-            onChange={(event) =>
-              setForm({ ...form, slack_webhook_url: event.target.value })
-            }
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Alert email
-          <input
-            type="email"
-            placeholder="ops@example.com"
-            value={form.alert_email}
-            onChange={(event) => setForm({ ...form, alert_email: event.target.value })}
-          />
-        </label>
-        <label className="endpoint-form__wide">
-          Tags
-          <input
-            placeholder="production, api, critical"
-            value={tagsText}
-            onChange={(event) => setTagsText(event.target.value)}
-          />
-        </label>
-        <label className="endpoint-form__check">
-          <input
-            type="checkbox"
-            checked={form.is_active}
-            onChange={(event) => setForm({ ...form, is_active: event.target.checked })}
-          />
-          Active
-        </label>
-        <label className="endpoint-form__check">
-          <input
-            type="checkbox"
-            checked={form.is_public}
-            onChange={(event) => setForm({ ...form, is_public: event.target.checked })}
-          />
-          Public on status page
-        </label>
-        <label className="endpoint-form__check">
-          <input
-            type="checkbox"
-            checked={form.alert_on_failure}
-            onChange={(event) =>
-              setForm({ ...form, alert_on_failure: event.target.checked })
-            }
-          />
-          Alert on failure / recovery
-        </label>
-        <label className="endpoint-form__check">
-          <input
-            type="checkbox"
-            checked={form.check_ssl_expiry}
-            onChange={(event) =>
-              setForm({ ...form, check_ssl_expiry: event.target.checked })
-            }
-          />
-          Check SSL certificate expiry
-        </label>
-      </div>
+          <label>
+            Interval (min)
+            <input
+              required
+              type="number"
+              min={1}
+              max={1440}
+              value={form.check_interval_minutes}
+              onChange={(event) =>
+                setForm({
+                  ...form,
+                  check_interval_minutes: Number(event.target.value),
+                })
+              }
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            Tags
+            <input
+              placeholder="production, api, critical"
+              value={tagsText}
+              onChange={(event) => setTagsText(event.target.value)}
+            />
+          </label>
+          <label className="endpoint-form__check">
+            <input
+              type="checkbox"
+              checked={form.is_active}
+              onChange={(event) => setForm({ ...form, is_active: event.target.checked })}
+            />
+            Active
+          </label>
+          <label className="endpoint-form__check">
+            <input
+              type="checkbox"
+              checked={form.is_public}
+              onChange={(event) => setForm({ ...form, is_public: event.target.checked })}
+            />
+            Public on status page
+          </label>
+        </div>
+      </details>
+
+      <details className="endpoint-form__section">
+        <summary>Request</summary>
+        <div className="endpoint-form__grid">
+          <label className="endpoint-form__wide">
+            Request headers
+            <textarea
+              rows={3}
+              placeholder={"Authorization: Bearer token\nX-Custom: value"}
+              value={headersText}
+              onChange={(event) => setHeadersText(event.target.value)}
+            />
+          </label>
+          <label>
+            Auth type
+            <select
+              value={form.auth_type}
+              onChange={(event) =>
+                setForm({
+                  ...form,
+                  auth_type: event.target.value as EndpointInput["auth_type"],
+                })
+              }
+            >
+              {AUTH_TYPES.map((authType) => (
+                <option key={authType} value={authType}>
+                  {authType}
+                </option>
+              ))}
+            </select>
+          </label>
+          {form.auth_type === "basic" && (
+            <label>
+              Auth username
+              <input
+                value={form.auth_username}
+                onChange={(event) =>
+                  setForm({ ...form, auth_username: event.target.value })
+                }
+              />
+            </label>
+          )}
+          {form.auth_type !== "none" && (
+            <label className={form.auth_type === "bearer" ? "endpoint-form__wide" : undefined}>
+              Auth secret
+              <input
+                type="password"
+                autoComplete="off"
+                placeholder={isEdit ? "Leave blank to keep current" : ""}
+                value={form.auth_secret}
+                onChange={(event) => setForm({ ...form, auth_secret: event.target.value })}
+              />
+            </label>
+          )}
+          <label className="endpoint-form__wide">
+            Request body
+            <textarea
+              rows={3}
+              placeholder='{"status":"ok"}'
+              value={form.request_body}
+              onChange={(event) => setForm({ ...form, request_body: event.target.value })}
+            />
+          </label>
+        </div>
+      </details>
+
+      <details className="endpoint-form__section">
+        <summary>Assertions</summary>
+        <div className="endpoint-form__grid">
+          <label className="endpoint-form__wide">
+            Body must contain
+            <input
+              placeholder='e.g. "status":"ok"'
+              value={form.expect_body_contains}
+              onChange={(event) =>
+                setForm({ ...form, expect_body_contains: event.target.value })
+              }
+            />
+          </label>
+          <label>
+            Expected header name
+            <input
+              placeholder="X-Health"
+              value={form.expect_header_name}
+              onChange={(event) =>
+                setForm({ ...form, expect_header_name: event.target.value })
+              }
+            />
+          </label>
+          <label>
+            Expected header value
+            <input
+              placeholder="green"
+              value={form.expect_header_value}
+              onChange={(event) =>
+                setForm({ ...form, expect_header_value: event.target.value })
+              }
+            />
+          </label>
+          <label>
+            JSON path
+            <input
+              placeholder="$.status"
+              value={form.expect_json_path}
+              onChange={(event) =>
+                setForm({ ...form, expect_json_path: event.target.value })
+              }
+            />
+          </label>
+          <label>
+            JSON expected value
+            <input
+              placeholder="ok"
+              value={form.expect_json_value}
+              onChange={(event) =>
+                setForm({ ...form, expect_json_value: event.target.value })
+              }
+            />
+          </label>
+          <label>
+            Max latency (ms)
+            <input
+              type="number"
+              min={1}
+              placeholder="optional"
+              value={maxLatencyText}
+              onChange={(event) => setMaxLatencyText(event.target.value)}
+            />
+          </label>
+          <label>
+            SSL warn days
+            <input
+              required
+              type="number"
+              min={1}
+              max={365}
+              value={form.ssl_warn_days}
+              onChange={(event) =>
+                setForm({ ...form, ssl_warn_days: Number(event.target.value) })
+              }
+            />
+          </label>
+          <label className="endpoint-form__check">
+            <input
+              type="checkbox"
+              checked={form.check_ssl_expiry}
+              onChange={(event) =>
+                setForm({ ...form, check_ssl_expiry: event.target.checked })
+              }
+            />
+            Check SSL certificate expiry
+          </label>
+        </div>
+      </details>
+
+      <details className="endpoint-form__section">
+        <summary>Alerts</summary>
+        <div className="endpoint-form__grid">
+          <label className="endpoint-form__wide">
+            Webhook URL
+            <input
+              type="url"
+              placeholder="https://hooks.example.com/apollo"
+              value={form.webhook_url}
+              onChange={(event) => setForm({ ...form, webhook_url: event.target.value })}
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            Discord webhook URL
+            <input
+              type="url"
+              placeholder="https://example.com/hooks/discord"
+              value={form.discord_webhook_url}
+              onChange={(event) =>
+                setForm({ ...form, discord_webhook_url: event.target.value })
+              }
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            Slack webhook URL
+            <input
+              type="url"
+              placeholder="https://example.com/hooks/slack"
+              value={form.slack_webhook_url}
+              onChange={(event) =>
+                setForm({ ...form, slack_webhook_url: event.target.value })
+              }
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            Alert email
+            <input
+              type="email"
+              placeholder="ops@example.com"
+              value={form.alert_email}
+              onChange={(event) => setForm({ ...form, alert_email: event.target.value })}
+            />
+          </label>
+          <label>
+            Failure threshold
+            <input
+              required
+              type="number"
+              min={1}
+              max={20}
+              value={form.failure_threshold}
+              onChange={(event) =>
+                setForm({ ...form, failure_threshold: Number(event.target.value) })
+              }
+            />
+          </label>
+          <label className="endpoint-form__wide">
+            Mute alerts until
+            <input
+              type="datetime-local"
+              value={muteLocal}
+              onChange={(event) => setMuteLocal(event.target.value)}
+            />
+          </label>
+          <div className="endpoint-form__wide endpoint-form__quiet-hours">
+            <span className="endpoint-form__quiet-label">Quiet hours</span>
+            <div className="endpoint-form__quiet-row">
+              <label>
+                Start
+                <input
+                  type="time"
+                  value={quietStartLocal}
+                  onChange={(event) => setQuietStartLocal(event.target.value)}
+                />
+              </label>
+              <label>
+                End
+                <input
+                  type="time"
+                  value={quietEndLocal}
+                  onChange={(event) => setQuietEndLocal(event.target.value)}
+                />
+              </label>
+            </div>
+          </div>
+          <label className="endpoint-form__check">
+            <input
+              type="checkbox"
+              checked={form.alert_on_failure}
+              onChange={(event) =>
+                setForm({ ...form, alert_on_failure: event.target.checked })
+              }
+            />
+            Alert on failure / recovery
+          </label>
+        </div>
+      </details>
 
       <div className="endpoint-form__actions">
         <button type="submit" className="app__button" disabled={saving}>
diff --git a/frontend/src/components/LoginForm.tsx b/frontend/src/components/LoginForm.tsx
index 8982403..a8f13ef 100644
--- a/frontend/src/components/LoginForm.tsx
+++ b/frontend/src/components/LoginForm.tsx
@@ -2,29 +2,71 @@ import { useState } from "react"
 import type { FormEvent } from "react"
 
 import { useAppDispatch, useAppSelector } from "../store/hooks"
-import { login } from "../store/authSlice"
+import { clearAuthError, login, register } from "../store/authSlice"
+
+type AuthMode = "login" | "register"
 
 export function LoginForm() {
   const dispatch = useAppDispatch()
   const { loading, error } = useAppSelector((state) => state.auth)
+  const [mode, setMode] = useState<AuthMode>("login")
   const [username, setUsername] = useState("apollo")
   const [password, setPassword] = useState("apollo")
+  const [email, setEmail] = useState("")
+
+  function switchMode(next: AuthMode) {
+    setMode(next)
+    dispatch(clearAuthError())
+  }
 
   async function handleSubmit(event: FormEvent<HTMLFormElement>) {
     event.preventDefault()
-    await dispatch(login({ username, password }))
+    if (mode === "login") {
+      await dispatch(login({ username, password }))
+      return
+    }
+    await dispatch(
+      register({
+        username,
+        password,
+        ...(email.trim() ? { email: email.trim() } : {}),
+      }),
+    )
   }
 
   return (
     <section className="login">
       <header className="login__header">
         <p className="app__brand">Apollo</p>
-        <h1>Sign in</h1>
+        <h1>{mode === "login" ? "Sign in" : "Create account"}</h1>
         <p className="app__lede">
-          Use the seeded demo account (`apollo` / `apollo`) or your own user.
+          {mode === "login"
+            ? "Use the seeded demo account (`apollo` / `apollo`) or your own user."
+            : "Register a new account to start monitoring endpoints."}
         </p>
       </header>
 
+      <div className="login__tabs" role="tablist" aria-label="Authentication mode">
+        <button
+          type="button"
+          role="tab"
+          aria-selected={mode === "login"}
+          className={mode === "login" ? "login__tab login__tab--active" : "login__tab"}
+          onClick={() => switchMode("login")}
+        >
+          Sign in
+        </button>
+        <button
+          type="button"
+          role="tab"
+          aria-selected={mode === "register"}
+          className={mode === "register" ? "login__tab login__tab--active" : "login__tab"}
+          onClick={() => switchMode("register")}
+        >
+          Register
+        </button>
+      </div>
+
       <form className="login__form" onSubmit={(event) => void handleSubmit(event)}>
         <label>
           Username
@@ -35,19 +77,36 @@ export function LoginForm() {
             onChange={(event) => setUsername(event.target.value)}
           />
         </label>
+        {mode === "register" && (
+          <label>
+            Email <span className="app__muted">(optional)</span>
+            <input
+              type="email"
+              autoComplete="email"
+              value={email}
+              onChange={(event) => setEmail(event.target.value)}
+            />
+          </label>
+        )}
         <label>
           Password
           <input
             required
             type="password"
-            autoComplete="current-password"
+            autoComplete={mode === "login" ? "current-password" : "new-password"}
             value={password}
             onChange={(event) => setPassword(event.target.value)}
           />
         </label>
         {error && <p className="app__error">{error}</p>}
         <button type="submit" className="app__button" disabled={loading}>
-          {loading ? "Signing in…" : "Sign in"}
+          {loading
+            ? mode === "login"
+              ? "Signing in…"
+              : "Creating account…"
+            : mode === "login"
+              ? "Sign in"
+              : "Create account"}
         </button>
       </form>
     </section>
diff --git a/frontend/src/store/authSlice.ts b/frontend/src/store/authSlice.ts
index d17a87c..efd3c7f 100644
--- a/frontend/src/store/authSlice.ts
+++ b/frontend/src/store/authSlice.ts
@@ -57,6 +57,23 @@ export const login = createAsyncThunk(
   },
 )
 
+export const register = createAsyncThunk(
+  "auth/register",
+  async (payload: { username: string; password: string; email?: string }) => {
+    const response = await apiFetch("/api/auth/register/", {
+      method: "POST",
+      auth: false,
+      json: payload,
+    })
+    if (!response.ok) {
+      throw new Error(await readError(response, "Registration failed"))
+    }
+    const data: { token: string; user: AuthUser } = await response.json()
+    setStoredToken(data.token)
+    return data
+  },
+)
+
 export const logout = createAsyncThunk("auth/logout", async () => {
   const response = await apiFetch("/api/auth/logout/", { method: "POST" })
   setStoredToken(null)
@@ -112,6 +129,19 @@ const authSlice = createSlice({
         state.loading = false
         state.error = action.error.message ?? "Login failed"
       })
+      .addCase(register.pending, (state) => {
+        state.loading = true
+        state.error = null
+      })
+      .addCase(register.fulfilled, (state, action) => {
+        state.loading = false
+        state.token = action.payload.token
+        state.user = action.payload.user
+      })
+      .addCase(register.rejected, (state, action) => {
+        state.loading = false
+        state.error = action.error.message ?? "Registration failed"
+      })
       .addCase(logout.fulfilled, (state) => {
         state.token = null
         state.user = null
diff --git a/frontend/src/store/dashboardSlice.ts b/frontend/src/store/dashboardSlice.ts
index 1493133..d6a2892 100644
--- a/frontend/src/store/dashboardSlice.ts
+++ b/frontend/src/store/dashboardSlice.ts
@@ -26,6 +26,7 @@ export type DashboardOpenIncident = {
   endpoint_name: string
   summary: string
   opened_at: string
+  acknowledged_at: string | null
 }
 
 export type DashboardSeriesBucket = {
diff --git a/frontend/src/store/endpointsSlice.ts b/frontend/src/store/endpointsSlice.ts
index b20375e..d05798c 100644
--- a/frontend/src/store/endpointsSlice.ts
+++ b/frontend/src/store/endpointsSlice.ts
@@ -34,10 +34,15 @@ export type OpenIncident = {
   summary: string
   opened_at: string
   resolved_at: string | null
+  acknowledged_at: string | null
+  acknowledged_by: number | null
+  acknowledged_by_username: string | null
 }
 
 export type MonitoredEndpoint = {
   id: number
+  owner: number | null
+  owner_username: string | null
   name: string
   url: string
   method: string
@@ -50,10 +55,17 @@ export type MonitoredEndpoint = {
   alert_email: string
   alert_on_failure: boolean
   expect_body_contains: string
+  expect_header_name: string
+  expect_header_value: string
+  expect_json_path: string
+  expect_json_value: string
+  request_body: string
   max_latency_ms: number | null
   check_ssl_expiry: boolean
   ssl_warn_days: number
   mute_alerts_until: string | null
+  quiet_hours_start: string | null
+  quiet_hours_end: string | null
   request_headers: Record<string, string>
   auth_type: "none" | "bearer" | "basic"
   auth_username: string
@@ -83,10 +95,17 @@ export type EndpointInput = {
   alert_email: string
   alert_on_failure: boolean
   expect_body_contains: string
+  expect_header_name: string
+  expect_header_value: string
+  expect_json_path: string
+  expect_json_value: string
+  request_body: string
   max_latency_ms: number | null
   check_ssl_expiry: boolean
   ssl_warn_days: number
   mute_alerts_until: string | null
+  quiet_hours_start: string | null
+  quiet_hours_end: string | null
   request_headers: Record<string, string>
   auth_type: "none" | "bearer" | "basic"
   auth_username: string
diff --git a/frontend/src/store/incidentsSlice.ts b/frontend/src/store/incidentsSlice.ts
index fca92b5..56ebc6e 100644
--- a/frontend/src/store/incidentsSlice.ts
+++ b/frontend/src/store/incidentsSlice.ts
@@ -10,17 +10,22 @@ export type Incident = {
   summary: string
   opened_at: string
   resolved_at: string | null
+  acknowledged_at: string | null
+  acknowledged_by: number | null
+  acknowledged_by_username: string | null
 }
 
 type IncidentsState = {
   items: Incident[]
   loading: boolean
+  acknowledgingId: number | null
   error: string | null
 }
 
 const initialState: IncidentsState = {
   items: [],
   loading: false,
+  acknowledgingId: null,
   error: null,
 }
 
@@ -36,6 +41,19 @@ export const fetchIncidents = createAsyncThunk(
   },
 )
 
+export const acknowledgeIncident = createAsyncThunk(
+  "incidents/acknowledge",
+  async (incidentId: number): Promise<Incident> => {
+    const response = await apiFetch(`/api/incidents/${incidentId}/acknowledge/`, {
+      method: "POST",
+    })
+    if (!response.ok) {
+      throw new Error(await readError(response, "Failed to acknowledge incident"))
+    }
+    return response.json()
+  },
+)
+
 const incidentsSlice = createSlice({
   name: "incidents",
   initialState,
@@ -54,6 +72,21 @@ const incidentsSlice = createSlice({
         state.loading = false
         state.error = action.error.message ?? "Unknown error"
       })
+      .addCase(acknowledgeIncident.pending, (state, action) => {
+        state.acknowledgingId = action.meta.arg
+        state.error = null
+      })
+      .addCase(acknowledgeIncident.fulfilled, (state, action) => {
+        state.acknowledgingId = null
+        const index = state.items.findIndex((item) => item.id === action.payload.id)
+        if (index >= 0) {
+          state.items[index] = action.payload
+        }
+      })
+      .addCase(acknowledgeIncident.rejected, (state, action) => {
+        state.acknowledgingId = null
+        state.error = action.error.message ?? "Unknown error"
+      })
   },
 })
 
diff --git a/monitoring/admin.py b/monitoring/admin.py
index 0ad67a5..6e380f2 100644
--- a/monitoring/admin.py
+++ b/monitoring/admin.py
@@ -18,6 +18,7 @@ class StatusPageConfigAdmin(admin.ModelAdmin):
 class MonitoredEndpointAdmin(admin.ModelAdmin):
     list_display = (
         "name",
+        "owner",
         "url",
         "method",
         "expected_status",
@@ -28,6 +29,8 @@ class MonitoredEndpointAdmin(admin.ModelAdmin):
         "alert_on_failure",
         "check_ssl_expiry",
         "mute_alerts_until",
+        "quiet_hours_start",
+        "quiet_hours_end",
         "webhook_url",
         "alert_email",
     )
@@ -39,9 +42,11 @@ class MonitoredEndpointAdmin(admin.ModelAdmin):
         "alert_on_failure",
         "check_ssl_expiry",
         "tags",
+        "owner",
     )
     search_fields = ("name", "url", "webhook_url", "alert_email", "discord_webhook_url", "slack_webhook_url")
     filter_horizontal = ("tags",)
+    raw_id_fields = ("owner",)
 
 
 @admin.register(HealthCheckResult)
@@ -87,7 +92,15 @@ class AlertEventAdmin(admin.ModelAdmin):
 
 @admin.register(Incident)
 class IncidentAdmin(admin.ModelAdmin):
-    list_display = ("endpoint", "status", "summary", "opened_at", "resolved_at")
+    list_display = (
+        "endpoint",
+        "status",
+        "summary",
+        "opened_at",
+        "resolved_at",
+        "acknowledged_at",
+        "acknowledged_by",
+    )
     list_filter = ("status",)
     search_fields = ("endpoint__name", "summary")
     readonly_fields = (
@@ -98,4 +111,6 @@ class IncidentAdmin(admin.ModelAdmin):
         "resolved_by_check",
         "opened_at",
         "resolved_at",
+        "acknowledged_at",
+        "acknowledged_by",
     )
diff --git a/monitoring/alerts.py b/monitoring/alerts.py
index bc741c7..d8229cc 100644
--- a/monitoring/alerts.py
+++ b/monitoring/alerts.py
@@ -208,12 +208,29 @@ def sync_incident_for_transition(
 
 
 def alerts_are_muted(endpoint: MonitoredEndpoint, *, now=None) -> bool:
-    """True when mute_alerts_until is set and still in the future."""
-    if endpoint.mute_alerts_until is None:
+    """True when mute_alerts_until is future or current time is in quiet hours."""
+    if now is None:
+        now = timezone.now()
+    if endpoint.mute_alerts_until is not None and endpoint.mute_alerts_until > now:
+        return True
+    return in_quiet_hours(endpoint, now=now)
+
+
+def in_quiet_hours(endpoint: MonitoredEndpoint, *, now=None) -> bool:
+    """Return True when local time is inside the endpoint quiet-hours window."""
+    start = endpoint.quiet_hours_start
+    end = endpoint.quiet_hours_end
+    if start is None or end is None:
         return False
     if now is None:
         now = timezone.now()
-    return endpoint.mute_alerts_until > now
+    local_time = timezone.localtime(now).time()
+    if start == end:
+        return True
+    if start < end:
+        return start <= local_time < end
+    # Overnight window, e.g. 22:00 -> 06:00
+    return local_time >= start or local_time < end
 
 
 def _record_channel(
diff --git a/monitoring/auth_views.py b/monitoring/auth_views.py
index da4f8c0..a7494ab 100644
--- a/monitoring/auth_views.py
+++ b/monitoring/auth_views.py
@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.contrib.auth import authenticate
 from django.contrib.auth.models import User
 from rest_framework import serializers, status
@@ -19,6 +20,12 @@ class LoginSerializer(serializers.Serializer):
     password = serializers.CharField(write_only=True)
 
 
+class RegisterSerializer(serializers.Serializer):
+    username = serializers.CharField(max_length=150)
+    password = serializers.CharField(write_only=True, min_length=8)
+    email = serializers.EmailField(required=False, allow_blank=True)
+
+
 class LoginView(APIView):
     authentication_classes = []
     permission_classes = [AllowAny]
@@ -51,6 +58,41 @@ def post(self, request: Request) -> Response:
         )
 
 
+class RegisterView(APIView):
+    """Create a non-staff user account when APOLLO_ALLOW_REGISTER is enabled."""
+
+    authentication_classes = []
+    permission_classes = [AllowAny]
+
+    def post(self, request: Request) -> Response:
+        if not getattr(settings, "APOLLO_ALLOW_REGISTER", False):
+            return Response(
+                {"detail": "Registration is disabled."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+        serializer = RegisterSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        username = serializer.validated_data["username"]
+        if User.objects.filter(username__iexact=username).exists():
+            return Response(
+                {"detail": "Username already taken."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+        user = User.objects.create_user(
+            username=username,
+            password=serializer.validated_data["password"],
+            email=serializer.validated_data.get("email") or "",
+        )
+        token = Token.objects.create(user=user)
+        return Response(
+            {
+                "token": token.key,
+                "user": UserSerializer(user).data,
+            },
+            status=status.HTTP_201_CREATED,
+        )
+
+
 class LogoutView(APIView):
     permission_classes = [IsAuthenticated]
 
diff --git a/monitoring/dashboard.py b/monitoring/dashboard.py
index bb59aae..a9b3db0 100644
--- a/monitoring/dashboard.py
+++ b/monitoring/dashboard.py
@@ -8,17 +8,22 @@
 
 from monitoring.metrics import build_check_series
 from monitoring.models import AlertEvent, HealthCheckResult, Incident, MonitoredEndpoint
+from monitoring.ownership import filter_endpoints_for_user
 from monitoring.services import due_endpoints
 
 
-def build_dashboard(*, hours: int = 24) -> dict[str, Any]:
+def build_dashboard(*, hours: int = 24, user=None) -> dict[str, Any]:
     """Aggregate uptime and operational metrics for the dashboard."""
     hours = max(1, min(hours, 24 * 30))
     since = timezone.now() - timedelta(hours=hours)
 
-    endpoints = list(MonitoredEndpoint.objects.all())
+    endpoint_qs = MonitoredEndpoint.objects.all()
+    if user is not None:
+        endpoint_qs = filter_endpoints_for_user(endpoint_qs, user)
+    endpoints = list(endpoint_qs)
+    endpoint_ids = [endpoint.id for endpoint in endpoints]
     active_endpoints = [endpoint for endpoint in endpoints if endpoint.is_active]
-    due = due_endpoints()
+    due = [endpoint for endpoint in due_endpoints() if endpoint.id in set(endpoint_ids)]
     alerting = [
         endpoint
         for endpoint in endpoints
@@ -30,9 +35,15 @@ def build_dashboard(*, hours: int = 24) -> dict[str, Any]:
             or endpoint.slack_webhook_url
         )
     ]
-    open_incidents = Incident.objects.filter(status=Incident.Status.OPEN).count()
+    open_incidents = Incident.objects.filter(
+        status=Incident.Status.OPEN,
+        endpoint_id__in=endpoint_ids,
+    ).count()
 
-    checks = HealthCheckResult.objects.filter(checked_at__gte=since)
+    checks = HealthCheckResult.objects.filter(
+        checked_at__gte=since,
+        endpoint_id__in=endpoint_ids,
+    )
     check_stats = checks.aggregate(
         total=Count("id"),
         up=Count("id", filter=Q(status=HealthCheckResult.Status.UP)),
@@ -44,7 +55,10 @@ def build_dashboard(*, hours: int = 24) -> dict[str, Any]:
     up_checks = check_stats["up"] or 0
     uptime_percent = round((up_checks / total_checks) * 100, 2) if total_checks else None
 
-    alerts = AlertEvent.objects.filter(created_at__gte=since)
+    alerts = AlertEvent.objects.filter(
+        created_at__gte=since,
+        endpoint_id__in=endpoint_ids,
+    )
     alert_stats = alerts.aggregate(
         total=Count("id"),
         failed=Count("id", filter=Q(success=False)),
@@ -158,10 +172,16 @@ def build_dashboard(*, hours: int = 24) -> dict[str, Any]:
                 "endpoint_name": item.endpoint.name,
                 "summary": item.summary,
                 "opened_at": item.opened_at.isoformat(),
+                "acknowledged_at": (
+                    item.acknowledged_at.isoformat() if item.acknowledged_at else None
+                ),
             }
-            for item in Incident.objects.filter(status=Incident.Status.OPEN)
+            for item in Incident.objects.filter(
+                status=Incident.Status.OPEN,
+                endpoint_id__in=endpoint_ids,
+            )
             .select_related("endpoint")
             .order_by("-opened_at")[:10]
         ],
-        "series": build_check_series(hours=hours),
+        "series": build_check_series(hours=hours, endpoint_ids=endpoint_ids),
     }
diff --git a/monitoring/factories.py b/monitoring/factories.py
index 5297b96..cc4516c 100644
--- a/monitoring/factories.py
+++ b/monitoring/factories.py
@@ -43,6 +43,13 @@ class Meta:
     failure_threshold = 1
     discord_webhook_url = ""
     slack_webhook_url = ""
+    request_body = ""
+    expect_header_name = ""
+    expect_header_value = ""
+    expect_json_path = ""
+    expect_json_value = ""
+    quiet_hours_start = None
+    quiet_hours_end = None
 
 
 class HealthCheckResultFactory(factory.django.DjangoModelFactory):
diff --git a/monitoring/management/commands/seed.py b/monitoring/management/commands/seed.py
index fdaa716..45e523f 100644
--- a/monitoring/management/commands/seed.py
+++ b/monitoring/management/commands/seed.py
@@ -74,10 +74,13 @@ def handle(self, *args, **options) -> None:
         for payload in SEED_ENDPOINTS:
             endpoint, was_created = MonitoredEndpoint.objects.get_or_create(
                 name=payload["name"],
-                defaults=payload,
+                defaults={**payload, "owner": user},
             )
             if was_created:
                 created_endpoints.append(endpoint)
+            elif endpoint.owner_id is None:
+                endpoint.owner = user
+                endpoint.save(update_fields=["owner"])
 
         extra = options["count"]
         if extra:
diff --git a/monitoring/metrics.py b/monitoring/metrics.py
index 3e9a3dc..23a1ab6 100644
--- a/monitoring/metrics.py
+++ b/monitoring/metrics.py
@@ -9,7 +9,12 @@
 from monitoring.models import HealthCheckResult
 
 
-def build_check_series(*, hours: int = 24, endpoint_id: int | None = None) -> list[dict[str, Any]]:
+def build_check_series(
+    *,
+    hours: int = 24,
+    endpoint_id: int | None = None,
+    endpoint_ids: list[int] | None = None,
+) -> list[dict[str, Any]]:
     """
     Build hourly uptime/latency buckets for charts.
 
@@ -22,6 +27,8 @@ def build_check_series(*, hours: int = 24, endpoint_id: int | None = None) -> li
     queryset = HealthCheckResult.objects.filter(checked_at__gte=start)
     if endpoint_id is not None:
         queryset = queryset.filter(endpoint_id=endpoint_id)
+    elif endpoint_ids is not None:
+        queryset = queryset.filter(endpoint_id__in=endpoint_ids)
 
     # Prefetch into memory for sqlite-friendly bucketing.
     rows = list(queryset.values("checked_at", "status", "latency_ms"))
diff --git a/monitoring/migrations/0008_multiuser_advanced_asserts_ops.py b/monitoring/migrations/0008_multiuser_advanced_asserts_ops.py
new file mode 100644
index 0000000..3550009
--- /dev/null
+++ b/monitoring/migrations/0008_multiuser_advanced_asserts_ops.py
@@ -0,0 +1,71 @@
+# Generated by Django 6.1.1 on 2026-09-21 21:07
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('monitoring', '0007_probe_auth_threshold_channels_status'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='incident',
+            name='acknowledged_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='incident',
+            name='acknowledged_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='acknowledged_incidents', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='expect_header_name',
+            field=models.CharField(blank=True, help_text='Optional response header name that must be present.', max_length=120),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='expect_header_value',
+            field=models.CharField(blank=True, help_text='If set with expect_header_name, header value must match (case-insensitive).', max_length=255),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='expect_json_path',
+            field=models.CharField(blank=True, help_text='Dot path into JSON body, e.g. data.status', max_length=255),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='expect_json_value',
+            field=models.CharField(blank=True, help_text='Expected value at expect_json_path (compared as string).', max_length=255),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='owner',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='monitored_endpoints', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='quiet_hours_end',
+            field=models.TimeField(blank=True, help_text='Daily quiet-hours end. Alerts muted inside the window.', null=True),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='quiet_hours_start',
+            field=models.TimeField(blank=True, help_text='Daily quiet-hours start (local Django TIME_ZONE). Pair with quiet_hours_end.', null=True),
+        ),
+        migrations.AddField(
+            model_name='monitoredendpoint',
+            name='request_body',
+            field=models.TextField(blank=True, help_text='Optional request body for POST/PUT/PATCH probes.'),
+        ),
+        migrations.AlterField(
+            model_name='monitoredendpoint',
+            name='mute_alerts_until',
+            field=models.DateTimeField(blank=True, help_text='While set and in the future, skip alert channels (incidents still sync).', null=True),
+        ),
+    ]
diff --git a/monitoring/models.py b/monitoring/models.py
index a110e15..f6198d8 100644
--- a/monitoring/models.py
+++ b/monitoring/models.py
@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.db import models
 
 
@@ -17,6 +18,13 @@ def __str__(self) -> str:
 class MonitoredEndpoint(models.Model):
     """An external or internal HTTP endpoint to track."""
 
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="monitored_endpoints",
+    )
     name = models.CharField(max_length=120)
     url = models.URLField()
     method = models.CharField(max_length=10, default="GET")
@@ -48,6 +56,30 @@ class MonitoredEndpoint(models.Model):
         blank=True,
         help_text="If set, response body must contain this substring.",
     )
+    expect_header_name = models.CharField(
+        max_length=120,
+        blank=True,
+        help_text="Optional response header name that must be present.",
+    )
+    expect_header_value = models.CharField(
+        max_length=255,
+        blank=True,
+        help_text="If set with expect_header_name, header value must match (case-insensitive).",
+    )
+    expect_json_path = models.CharField(
+        max_length=255,
+        blank=True,
+        help_text="Dot path into JSON body, e.g. data.status",
+    )
+    expect_json_value = models.CharField(
+        max_length=255,
+        blank=True,
+        help_text="Expected value at expect_json_path (compared as string).",
+    )
+    request_body = models.TextField(
+        blank=True,
+        help_text="Optional request body for POST/PUT/PATCH probes.",
+    )
     max_latency_ms = models.PositiveIntegerField(
         null=True,
         blank=True,
@@ -64,7 +96,17 @@ class MonitoredEndpoint(models.Model):
     mute_alerts_until = models.DateTimeField(
         null=True,
         blank=True,
-        help_text="While set and in the future, skip webhook/email (incidents still sync).",
+        help_text="While set and in the future, skip alert channels (incidents still sync).",
+    )
+    quiet_hours_start = models.TimeField(
+        null=True,
+        blank=True,
+        help_text="Daily quiet-hours start (local Django TIME_ZONE). Pair with quiet_hours_end.",
+    )
+    quiet_hours_end = models.TimeField(
+        null=True,
+        blank=True,
+        help_text="Daily quiet-hours end. Alerts muted inside the window.",
     )
     request_headers = models.JSONField(
         default=dict,
@@ -212,6 +254,14 @@ class Status(models.TextChoices):
     )
     opened_at = models.DateTimeField(auto_now_add=True)
     resolved_at = models.DateTimeField(null=True, blank=True)
+    acknowledged_at = models.DateTimeField(null=True, blank=True)
+    acknowledged_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="acknowledged_incidents",
+    )
 
     class Meta:
         ordering = ["-opened_at"]
diff --git a/monitoring/ownership.py b/monitoring/ownership.py
new file mode 100644
index 0000000..92d2044
--- /dev/null
+++ b/monitoring/ownership.py
@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from django.contrib.auth.models import User
+from django.db.models import Q, QuerySet
+
+from monitoring.models import MonitoredEndpoint
+
+
+def owned_endpoints_q(user: User) -> Q:
+    """Filter endpoints visible to a user (staff sees all)."""
+    if user.is_staff:
+        return Q()
+    return Q(owner=user) | Q(owner__isnull=True)
+
+
+def filter_endpoints_for_user(queryset: QuerySet[MonitoredEndpoint], user: User) -> QuerySet[MonitoredEndpoint]:
+    if user.is_staff:
+        return queryset
+    return queryset.filter(owned_endpoints_q(user))
diff --git a/monitoring/serializers.py b/monitoring/serializers.py
index 32f87cd..a203f23 100644
--- a/monitoring/serializers.py
+++ b/monitoring/serializers.py
@@ -57,6 +57,11 @@ class Meta:
 
 class IncidentSerializer(serializers.ModelSerializer):
     endpoint_name = serializers.CharField(source="endpoint.name", read_only=True)
+    acknowledged_by_username = serializers.CharField(
+        source="acknowledged_by.username",
+        read_only=True,
+        allow_null=True,
+    )
 
     class Meta:
         model = Incident
@@ -70,6 +75,9 @@ class Meta:
             "resolved_by_check",
             "opened_at",
             "resolved_at",
+            "acknowledged_at",
+            "acknowledged_by",
+            "acknowledged_by_username",
         ]
         read_only_fields = fields
 
@@ -80,16 +88,24 @@ class MonitoredEndpointSerializer(serializers.ModelSerializer):
     open_incident = serializers.SerializerMethodField()
     is_due = serializers.SerializerMethodField()
     tags = serializers.SerializerMethodField()
+    owner_username = serializers.CharField(source="owner.username", read_only=True, allow_null=True)
     method = serializers.CharField(default="GET", max_length=10)
     webhook_url = serializers.URLField(required=False, allow_blank=True)
     alert_email = serializers.EmailField(required=False, allow_blank=True)
     expect_body_contains = serializers.CharField(
         required=False, allow_blank=True, max_length=255
     )
+    expect_header_name = serializers.CharField(required=False, allow_blank=True, max_length=120)
+    expect_header_value = serializers.CharField(required=False, allow_blank=True, max_length=255)
+    expect_json_path = serializers.CharField(required=False, allow_blank=True, max_length=255)
+    expect_json_value = serializers.CharField(required=False, allow_blank=True, max_length=255)
+    request_body = serializers.CharField(required=False, allow_blank=True)
     max_latency_ms = serializers.IntegerField(
         required=False, allow_null=True, min_value=1
     )
     mute_alerts_until = serializers.DateTimeField(required=False, allow_null=True)
+    quiet_hours_start = serializers.TimeField(required=False, allow_null=True)
+    quiet_hours_end = serializers.TimeField(required=False, allow_null=True)
     discord_webhook_url = serializers.URLField(required=False, allow_blank=True)
     slack_webhook_url = serializers.URLField(required=False, allow_blank=True)
     request_headers = serializers.JSONField(required=False)
@@ -100,6 +116,8 @@ class Meta:
         model = MonitoredEndpoint
         fields = [
             "id",
+            "owner",
+            "owner_username",
             "name",
             "url",
             "method",
@@ -112,10 +130,17 @@ class Meta:
             "alert_email",
             "alert_on_failure",
             "expect_body_contains",
+            "expect_header_name",
+            "expect_header_value",
+            "expect_json_path",
+            "expect_json_value",
+            "request_body",
             "max_latency_ms",
             "check_ssl_expiry",
             "ssl_warn_days",
             "mute_alerts_until",
+            "quiet_hours_start",
+            "quiet_hours_end",
             "request_headers",
             "auth_type",
             "auth_username",
@@ -133,6 +158,8 @@ class Meta:
         ]
         read_only_fields = [
             "id",
+            "owner",
+            "owner_username",
             "created_at",
             "updated_at",
             "last_check",
diff --git a/monitoring/services.py b/monitoring/services.py
index fa69c72..76aaebd 100644
--- a/monitoring/services.py
+++ b/monitoring/services.py
@@ -76,12 +76,33 @@ def check_ssl_certificate(endpoint: MonitoredEndpoint) -> str | None:
     return None
 
 
+def _resolve_json_path(payload: object, path: str) -> object | None:
+    """Walk a simple dotted path (supports list indexes as digits)."""
+    current: object = payload
+    for part in path.split("."):
+        if part == "":
+            continue
+        if isinstance(current, dict):
+            if part not in current:
+                return None
+            current = current[part]
+        elif isinstance(current, list) and part.isdigit():
+            index = int(part)
+            if index < 0 or index >= len(current):
+                return None
+            current = current[index]
+        else:
+            return None
+    return current
+
+
 def evaluate_response_assertions(
     endpoint: MonitoredEndpoint,
     *,
     status_code: int,
     latency_ms: float,
     body: str,
+    headers: dict[str, str] | None = None,
 ) -> str | None:
     """Return the first failing assertion message, or None when all pass."""
     if status_code != endpoint.expected_status:
@@ -93,6 +114,37 @@ def evaluate_response_assertions(
     if needle and needle not in body:
         return f"Response body missing expected text: {needle!r}"
 
+    header_name = (endpoint.expect_header_name or "").strip()
+    if header_name:
+        header_map = {k.lower(): v for k, v in (headers or {}).items()}
+        actual = header_map.get(header_name.lower())
+        if actual is None:
+            return f"Response missing header {header_name!r}"
+        expected_header = (endpoint.expect_header_value or "").strip()
+        if expected_header and actual.lower() != expected_header.lower():
+            return (
+                f"Header {header_name!r} expected {expected_header!r}, "
+                f"got {actual!r}"
+            )
+
+    json_path = (endpoint.expect_json_path or "").strip()
+    if json_path:
+        import json
+
+        try:
+            payload = json.loads(body)
+        except json.JSONDecodeError:
+            return "Response body is not valid JSON for JSON path assertion"
+        resolved = _resolve_json_path(payload, json_path)
+        if resolved is None:
+            return f"JSON path {json_path!r} not found"
+        expected_json = (endpoint.expect_json_value or "").strip()
+        if expected_json and str(resolved) != expected_json:
+            return (
+                f"JSON path {json_path!r} expected {expected_json!r}, "
+                f"got {resolved!r}"
+            )
+
     if endpoint.max_latency_ms is not None and latency_ms > endpoint.max_latency_ms:
         return (
             f"Latency {latency_ms:.2f}ms exceeds max "
@@ -142,10 +194,15 @@ def probe_endpoint(endpoint: MonitoredEndpoint) -> CheckOutcome:
             follow_redirects=True,
             auth=auth,
         ) as client:
+            method = endpoint.method.upper()
+            content = None
+            if method in {"POST", "PUT", "PATCH", "DELETE"} and endpoint.request_body:
+                content = endpoint.request_body
             response = client.request(
-                endpoint.method.upper(),
+                method,
                 endpoint.url,
                 headers=headers,
+                content=content,
             )
         latency_ms = (time.perf_counter() - started) * 1000
         assertion_error = evaluate_response_assertions(
@@ -153,6 +210,7 @@ def probe_endpoint(endpoint: MonitoredEndpoint) -> CheckOutcome:
             status_code=response.status_code,
             latency_ms=latency_ms,
             body=response.text,
+            headers=dict(response.headers),
         )
         if assertion_error:
             return CheckOutcome(
diff --git a/monitoring/tests.py b/monitoring/tests.py
index 4caf98e..165c236 100644
--- a/monitoring/tests.py
+++ b/monitoring/tests.py
@@ -9,6 +9,9 @@
 from monitoring.models import HealthCheckResult, MonitoredEndpoint
 from monitoring.services import CheckOutcome, run_health_check
 
+# Fixed test credential — not a real account secret.
+TEST_PASSWORD = "pytest-only-pass"
+
 
 @pytest.mark.django_db
 def test_health_endpoint() -> None:
@@ -481,7 +484,7 @@ def test_endpoints_require_auth(anon_client) -> None:
 def test_login_and_me(anon_client, user) -> None:
     response = anon_client.post(
         "/api/auth/login/",
-        {"username": "tester", "password": "secret123"},
+        {"username": "tester", "password": TEST_PASSWORD},
         format="json",
     )
     assert response.status_code == status.HTTP_200_OK
@@ -800,7 +803,7 @@ def test_discord_alert_channel(
     from monitoring.services import CheckOutcome, run_health_check
 
     endpoint = MonitoredEndpointFactory(
-        discord_webhook_url="https://discord.com/api/webhooks/1/abc",
+        discord_webhook_url="https://example.com/hooks/discord",
     )
     mock_probe.return_value = CheckOutcome(
         status=HealthCheckResult.Status.DOWN,
@@ -934,3 +937,112 @@ def test_checks_pagination(api_client) -> None:
     assert response.data["page_size"] == 2
     assert len(response.data["results"]) == 2
     assert response.data["total_pages"] == 3
+
+
+@pytest.mark.django_db
+def test_register_and_own_endpoints(anon_client, settings) -> None:
+    settings.APOLLO_ALLOW_REGISTER = True
+    response = anon_client.post(
+        "/api/auth/register/",
+        {"username": "newbie", "password": TEST_PASSWORD, "email": "n@example.com"},
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    token = response.data["token"]
+
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Token {token}")
+    created = client.post(
+        "/api/endpoints/",
+        {
+            "name": "Mine",
+            "url": "https://example.com/mine",
+            "method": "GET",
+            "expected_status": 200,
+        },
+        format="json",
+    )
+    assert created.status_code == status.HTTP_201_CREATED
+    assert created.data["owner_username"] == "newbie"
+
+    other = MonitoredEndpointFactory(name="Someone else", owner=None)
+    # Unowned still visible; owned-by-other should hide for non-staff after we assign owner
+    from django.contrib.auth.models import User
+
+    stranger = User.objects.create_user(username="stranger", password=TEST_PASSWORD)
+    other.owner = stranger
+    other.save(update_fields=["owner"])
+
+    listing = client.get("/api/endpoints/")
+    names = {row["name"] for row in listing.data}
+    assert "Mine" in names
+    assert "Someone else" not in names
+
+
+@pytest.mark.django_db
+@patch("monitoring.services.check_ssl_certificate", return_value=None)
+@patch("httpx.Client")
+def test_json_path_and_header_assertions(mock_client_cls: MagicMock, _ssl: MagicMock) -> None:
+    from monitoring.services import probe_endpoint
+
+    endpoint = MonitoredEndpointFactory(
+        expect_json_path="status",
+        expect_json_value="ok",
+        expect_header_name="X-Health",
+        expect_header_value="green",
+    )
+    response = MagicMock()
+    response.status_code = 200
+    response.text = '{"status":"ok"}'
+    response.headers = {"X-Health": "green"}
+    mock_client_cls.return_value.__enter__.return_value.request.return_value = response
+
+    outcome = probe_endpoint(endpoint)
+    assert outcome.status == HealthCheckResult.Status.UP
+
+    response.text = '{"status":"bad"}'
+    outcome = probe_endpoint(endpoint)
+    assert outcome.status == HealthCheckResult.Status.DOWN
+    assert "JSON path" in outcome.error_message
+
+
+@pytest.mark.django_db
+@patch("monitoring.alerts.deliver_webhook")
+@patch("monitoring.services.probe_endpoint")
+def test_quiet_hours_mute_alerts(mock_probe: MagicMock, mock_deliver: MagicMock) -> None:
+    from datetime import time
+
+    from monitoring.models import AlertEvent, Incident
+    from monitoring.services import CheckOutcome, run_health_check
+
+    endpoint = MonitoredEndpointFactory(
+        webhook_url="https://hooks.example.com/apollo",
+        quiet_hours_start=time(0, 0),
+        quiet_hours_end=time(23, 59, 59),
+    )
+    mock_probe.return_value = CheckOutcome(
+        status=HealthCheckResult.Status.DOWN,
+        status_code=500,
+        latency_ms=1.0,
+        error_message="down",
+    )
+
+    run_health_check(endpoint)
+
+    mock_deliver.assert_not_called()
+    assert AlertEvent.objects.count() == 0
+    assert Incident.objects.filter(status=Incident.Status.OPEN).count() == 1
+
+
+@pytest.mark.django_db
+def test_acknowledge_incident(api_client) -> None:
+    from monitoring.factories import IncidentFactory
+    from monitoring.models import Incident
+
+    incident = IncidentFactory(status=Incident.Status.OPEN)
+    response = api_client.post(f"/api/incidents/{incident.id}/acknowledge/")
+
+    assert response.status_code == status.HTTP_200_OK
+    incident.refresh_from_db()
+    assert incident.acknowledged_at is not None
+    assert response.data["acknowledged_by_username"] == "tester"
diff --git a/monitoring/urls.py b/monitoring/urls.py
index de3458d..623dd6e 100644
--- a/monitoring/urls.py
+++ b/monitoring/urls.py
@@ -1,7 +1,7 @@
 from django.urls import include, path
 from rest_framework.routers import DefaultRouter
 
-from monitoring.auth_views import LoginView, LogoutView, MeView
+from monitoring.auth_views import LoginView, LogoutView, MeView, RegisterView
 from monitoring.views import (
     AlertEventViewSet,
     DashboardView,
@@ -29,6 +29,7 @@
     path("dashboard/", DashboardView.as_view(), name="dashboard"),
     path("exports/<str:resource>.csv", ExportView.as_view(), name="exports-csv"),
     path("auth/login/", LoginView.as_view(), name="auth-login"),
+    path("auth/register/", RegisterView.as_view(), name="auth-register"),
     path("auth/logout/", LogoutView.as_view(), name="auth-logout"),
     path("auth/me/", MeView.as_view(), name="auth-me"),
     path("", include(router.urls)),
diff --git a/monitoring/views.py b/monitoring/views.py
index 2f111dc..6bc2a8a 100644
--- a/monitoring/views.py
+++ b/monitoring/views.py
@@ -12,6 +12,7 @@
 from monitoring.dashboard import build_dashboard
 from monitoring.exports import csv_response
 from monitoring.models import AlertEvent, HealthCheckResult, Incident, MonitoredEndpoint, StatusPageConfig, Tag
+from monitoring.ownership import filter_endpoints_for_user
 from monitoring.pagination_utils import paginate_queryset
 from monitoring.serializers import (
     AlertEventSerializer,
@@ -77,7 +78,7 @@ def get(self, request: Request) -> Response:
             hours = int(request.query_params.get("hours", 24))
         except (TypeError, ValueError):
             hours = 24
-        return Response(build_dashboard(hours=hours))
+        return Response(build_dashboard(hours=hours, user=request.user))
 
 
 class MonitoredEndpointViewSet(viewsets.ModelViewSet):
@@ -86,16 +87,19 @@ class MonitoredEndpointViewSet(viewsets.ModelViewSet):
         "alerts",
         "tags",
         "incidents",
-    ).all()
+    ).select_related("owner").all()
     serializer_class = MonitoredEndpointSerializer
 
     def get_queryset(self):
-        queryset = super().get_queryset()
+        queryset = filter_endpoints_for_user(super().get_queryset(), self.request.user)
         tag = self.request.query_params.get("tag")
         if tag:
             queryset = queryset.filter(tags__name=tag.lower())
         return queryset.distinct()
 
+    def perform_create(self, serializer) -> None:
+        serializer.save(owner=self.request.user)
+
     @action(detail=True, methods=["post"])
     def check(self, request: Request, pk: str | None = None) -> Response:
         endpoint = self.get_object()
@@ -217,23 +221,58 @@ class HealthCheckResultViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = HealthCheckResult.objects.select_related("endpoint").all()
     serializer_class = HealthCheckResultSerializer
 
+    def get_queryset(self):
+        queryset = super().get_queryset()
+        visible = filter_endpoints_for_user(
+            MonitoredEndpoint.objects.all(),
+            self.request.user,
+        ).values_list("id", flat=True)
+        return queryset.filter(endpoint_id__in=visible)
+
 
 class AlertEventViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = AlertEvent.objects.select_related("endpoint", "check_result").all()
     serializer_class = AlertEventSerializer
 
+    def get_queryset(self):
+        queryset = super().get_queryset()
+        visible = filter_endpoints_for_user(
+            MonitoredEndpoint.objects.all(),
+            self.request.user,
+        ).values_list("id", flat=True)
+        return queryset.filter(endpoint_id__in=visible)
+
 
 class IncidentViewSet(viewsets.ReadOnlyModelViewSet):
-    queryset = Incident.objects.select_related("endpoint").all()
+    queryset = Incident.objects.select_related("endpoint", "acknowledged_by").all()
     serializer_class = IncidentSerializer
 
     def get_queryset(self):
         queryset = super().get_queryset()
+        visible = filter_endpoints_for_user(
+            MonitoredEndpoint.objects.all(),
+            self.request.user,
+        ).values_list("id", flat=True)
+        queryset = queryset.filter(endpoint_id__in=visible)
         status_filter = self.request.query_params.get("status")
         if status_filter:
             queryset = queryset.filter(status=status_filter)
         return queryset
 
+    @action(detail=True, methods=["post"])
+    def acknowledge(self, request: Request, pk: str | None = None) -> Response:
+        incident = self.get_object()
+        if incident.status != Incident.Status.OPEN:
+            return Response(
+                {"detail": "Only open incidents can be acknowledged."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+        if incident.acknowledged_at is None:
+            incident.acknowledged_at = timezone.now()
+            incident.acknowledged_by = request.user
+            incident.save(update_fields=["acknowledged_at", "acknowledged_by"])
+        return Response(IncidentSerializer(incident).data)
+
 
 class TagViewSet(viewsets.ModelViewSet):
     queryset = Tag.objects.all()
@@ -252,10 +291,17 @@ def get(self, request: Request, resource: str) -> Response:
         hours = max(1, min(hours, 24 * 90))
         since = timezone.now() - timedelta(hours=hours)
         endpoint_id = request.query_params.get("endpoint_id")
+        visible_ids = list(
+            filter_endpoints_for_user(
+                MonitoredEndpoint.objects.all(),
+                request.user,
+            ).values_list("id", flat=True)
+        )
 
         if resource == "checks":
             queryset = HealthCheckResult.objects.select_related("endpoint").filter(
-                checked_at__gte=since
+                checked_at__gte=since,
+                endpoint_id__in=visible_ids,
             )
             if endpoint_id:
                 queryset = queryset.filter(endpoint_id=endpoint_id)
@@ -289,7 +335,8 @@ def get(self, request: Request, resource: str) -> Response:
 
         if resource == "alerts":
             queryset = AlertEvent.objects.select_related("endpoint").filter(
-                created_at__gte=since
+                created_at__gte=since,
+                endpoint_id__in=visible_ids,
             )
             if endpoint_id:
                 queryset = queryset.filter(endpoint_id=endpoint_id)
@@ -326,7 +373,9 @@ def get(self, request: Request, resource: str) -> Response:
             )
 
         if resource == "incidents":
-            queryset = Incident.objects.select_related("endpoint").all()
+            queryset = Incident.objects.select_related("endpoint").filter(
+                endpoint_id__in=visible_ids,
+            )
             if endpoint_id:
                 queryset = queryset.filter(endpoint_id=endpoint_id)
             status_filter = request.query_params.get("status")
@@ -341,6 +390,7 @@ def get(self, request: Request, resource: str) -> Response:
                     item.summary,
                     item.opened_at.isoformat(),
                     item.resolved_at.isoformat() if item.resolved_at else "",
+                    item.acknowledged_at.isoformat() if item.acknowledged_at else "",
                 )
                 for item in queryset.order_by("-opened_at")[:5000]
             )
@@ -354,6 +404,7 @@ def get(self, request: Request, resource: str) -> Response:
                     "summary",
                     "opened_at",
                     "resolved_at",
+                    "acknowledged_at",
                 ],
                 rows,
             )