GET /health
Returns the runtime health status. No authentication required.Response schema
| Field | Type | Description |
|---|---|---|
status | string | "ok" when the runtime is healthy |
runtimeVersion | string | Semver version of the running server |
runtimeHash | string | Content hash of the server binary — matches the runtimeHash in attestations |
verification | string | "ok" when the signing key and verifier are configured correctly |
audit_db | boolean | true when Postgres is connected and schema is initialized |
signing_mode | "env" | "disk" | How the signing key was loaded |
capabilities | string[] | Active capabilities — subset of ["execute", "verify", "audit"] |
supportedSchemaVersions | string[] | Policy schema versions this runtime accepts |
Interpreting the response
| Condition | Meaning |
|---|---|
status !== "ok" | Runtime is not healthy — do not send execution requests |
audit_db: false | Postgres is not connected — audit records will not be persisted |
verification !== "ok" | Signing or verification is misconfigured — executions will fail with 503 |
| Non-200 response | Server is unreachable |
Docker Compose health check
Add a Compose-level health check to theserver service to enable dependent service health gating:
Kubernetes liveness and readiness probes
Uptime monitoring
Poll/health every 30–60 seconds from your uptime monitor. Alert on:
- Non-200 HTTP status
status !== "ok"audit_db: false(sustained for more than one check interval)
Runtime manifest endpoint
For deeper version verification, use the runtime manifest:runtimeHash in this response matches the runtimeHash embedded in every attestation produced by this runtime. Use it to confirm attestations were produced by the expected runtime version.
Troubleshooting
/health returns connection refused
The server is not running or not bound to the expected port:
/health returns "status": "ok" but "audit_db": false
Postgres is not connected. The server can still execute decisions, but audit records will not be stored:
/health returns "verification": "error"
The signing key or verifier is misconfigured. The server will respond to health checks but POST /execute will fail with 503. Check PARMANA_SIGNING_PROVIDER and the corresponding key path or value in .env.
Health check passes but executions return 503
Check capabilities in the health response. If "execute" is not in the list, the execution runtime is not configured. This typically means the signing key loaded but the verifier did not.