<p>In my case the API requires HMAC authentication and is served by IIS. I use an external HTTP and PING monitoring service (initials SC, excellent service, if I am allowed to say). Dynamic HMAC tokens are not an option on the service.</p>
<p>What worked for me was to use an HTTP test on the API base URL and check the response. I am getting a <code>403 Access Denied</code> response when the API is alive, and a <code>503 Service Unavailable</code> response when the application is stopped.</p>

CC BY-SA 4.0
2024-06-07T13:10:14.763Z
If it works, it works :). is the 403 due to the lack of a HMAC hash in the request? One way to get something less fragile is to have an endpoint that does nothing and doesn't require HMAC. If you get 200 from that, it's "healthy", otherwise it's "not healthy." I realize that infrastructure- and infosec-wise that's not necessarily something you can "just" do.
Peter Ritchie
CC BY-SA 4.0
2024-06-06T14:04:35.480Z
2024-06-06T14:04:35.480Z
simonpa71
<p><code>It would be nice if there was a more... official way. (:</code> If this is not an official way how to check it? One could also say that if there are only POST's then why not using a POST? </p>

<p>Some services only have POST and these are checked by doing an automated POST every X minutes and check the output. If the POST fails then the monitor system will notify the team.</p>

CC BY-SA 3.0
2017-08-07T11:35:18.803Z
2017-08-07T11:35:18.803Z
030
<p>As a developer, I have been involved in producing a number of assorted web-APIs, both for internal and public use.</p>

<p><strong>Is there a standard (or de facto) way of checking if a web API is up and running?</strong></p>

<p>(And possibly report back e.g. deployment info and other metadata.)</p>

<p>Web APIs usually don't have a handler for a <code>GET</code> to the root-URL, and often require authentication for the other URLs. Sometimes I have solved this by adding a specific <code>GET http://example.com/alive</code> or <code>GET http://example.com/hello</code> handler in order to enable our devops to monitor the API and to make it easier for myself to quickly check if it is running. It would be nice if there was a more... official way. (:</p>

CC BY-SA 4.0
2024-06-07T13:06:11.527Z
I'd paste the xkcd strip that talked about multiple standards for the same thing, but... 
 With several of my clients, we've gone with a _health_ endpoint. e.g., the ASP.NET default is `healthz`.  "healthz" stems from some Google practices.  Basically, it's an endpoint that does nothing, but may return a result with more detailed data.  If you can get to it (200) the API is "healthy". using it in Docker: `HEALTHCHECK CMD curl --fail http://localhost:5000/healthz || exit`
Peter Ritchie
<deployment><monitoring>
Is there a standard way to check if a web API is alive?
Reyhn
# Is there a standard way to check if a web API is alive?

(Asked by: username_0 on 2017-08-07)

As a developer, I have been involved in producing a number of assorted web-APIs, both for internal and public use.

**Is there a standard (or de facto) way of checking if a web API is up and running?**

(And possibly report back e.g. deployment info and other metadata.)

Web APIs usually don't have a handler for a `GET` to the root-URL, and often require authentication for the other URLs. Sometimes I have solved this by adding a specific `GET http://example.com/alive` or `GET http://example.com/hello` handler in order to enable our devops to monitor the API and to make it easier for myself to quickly check if it is running. It would be nice if there was a more... official way. (:

**Tags:** deployment, monitoring

> **Comments:**
> **username_1**: I'd paste the xkcd strip that talked about multiple standards for the same thing, but...   With several of my clients, we've gone with a _health_ endpoint. e.g., the ASP.NET default is `healthz`.  "healthz" stems from some Google practices.  Basically, it's an endpoint that does nothing, but may return a result with more detailed data.  If you can get to it (200) the API is "healthy". using it in Docker: `HEALTHCHECK CMD curl --fail http://localhost:5000/healthz || exit`  

---

## 2 answers

### Answer by username_2 on 2024-06-06. Score: 1

In my case the API requires HMAC authentication and is served by IIS. I use an external HTTP and PING monitoring service (initials SC, excellent service, if I am allowed to say). Dynamic HMAC tokens are not an option on the service.

What worked for me was to use an HTTP test on the API base URL and check the response. I am getting a `403 Access Denied` response when the API is alive, and a `503 Service Unavailable` response when the application is stopped.

> **Comments:**
> **username_1**: If it works, it works :). is the 403 due to the lack of a HMAC hash in the request? One way to get something less fragile is to have an endpoint that does nothing and doesn't require HMAC. If you get 200 from that, it's "healthy", otherwise it's "not healthy." I realize that infrastructure- and infosec-wise that's not necessarily something you can "just" do.  

---

### Answer by username_3 on 2017-08-07. Score: 1

`It would be nice if there was a more... official way. (:` If this is not an official way how to check it? One could also say that if there are only POST's then why not using a POST?

Some services only have POST and these are checked by doing an automated POST every X minutes and check the output. If the POST fails then the monitor system will notify the team.


---

