As a developer, I have been involved in producing a number of assorted web-APIs, both for internal and public use.

Is there a standard (or de facto) way of checking if a web API is up and running?

(And possibly report back e.g. deployment info and other metadata.)

Web APIs usually don't have a handler for a GET to the root-URL, and often require authentication for the other URLs. Sometimes I have solved this by adding a specific GET http://example.com/alive or GET http://example.com/hello handler in order to enable our devops to monitor the API and to make it easier for myself to quickly check if it is running. It would be nice if there was a more... official way. (:

  • I'd paste the xkcd strip that talked about multiple standards for the same thing, but... With several of my clients, we've gone with a health endpoint. e.g., the ASP.NET default is healthz. "healthz" stems from some Google practices. Basically, it's an endpoint that does nothing, but may return a result with more detailed data. If you can get to it (200) the API is "healthy". using it in Docker: HEALTHCHECK CMD curl --fail http://localhost:5000/healthz || exit Commented Jun 7 at 13:06

2 Answers 2


It would be nice if there was a more... official way. (: If this is not an official way how to check it? One could also say that if there are only POST's then why not using a POST?

Some services only have POST and these are checked by doing an automated POST every X minutes and check the output. If the POST fails then the monitor system will notify the team.


In my case the API requires HMAC authentication and is served by IIS. I use an external HTTP and PING monitoring service (initials SC, excellent service, if I am allowed to say). Dynamic HMAC tokens are not an option on the service.

What worked for me was to use an HTTP test on the API base URL and check the response. I am getting a 403 Access Denied response when the API is alive, and a 503 Service Unavailable response when the application is stopped.

  • If it works, it works :). is the 403 due to the lack of a HMAC hash in the request? One way to get something less fragile is to have an endpoint that does nothing and doesn't require HMAC. If you get 200 from that, it's "healthy", otherwise it's "not healthy." I realize that infrastructure- and infosec-wise that's not necessarily something you can "just" do. Commented Jun 7 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.