Health and readiness payloads

Included from Basic tier

The two probe payloads: GET /healthz (liveness) and GET /readyz (readiness). Both are open (unauthenticated) at their root paths for load balancers and orchestrators, and also mounted admin-gated at GET /api/admin/healthz and GET /api/admin/readyz so the GUI's single /api proxy rule reaches them. There is no /livez — /healthz is the liveness probe.

The OpenAPI documents do not declare a schema for this resource; this page is the hand-written half of the dictionary.

GET /healthz — liveness

Pure liveness: the process is serving. Deliberately no store or blobstore dependency, so a database failover never makes orchestrators restart every replica. Always 200 with:

Field	Type	Meaning
status	string	Always ok.
version	string	Build version; dev when unset.
commit	string	Build commit; dev when unset.
replica_id	string	The scheduler replica identity of the process answering.

GET /readyz — readiness

Readiness: store reachable, this replica's scheduler heartbeat fresh, blobstore writable (cached probe), and not shutting down. 200 when ready, 503 when not. Shutdown flips it to 503 before anything stops, giving the load balancer its drain window.

Field	Type	Meaning
status	string	ready or not ready.
version	string	Build version; dev when unset.
replica_id	string	This replica's scheduler identity.
checks	object	The itemised checks (below) — for operators and the admin status surface.
scheduler	object	replica_id (again), leader (whether this replica is the cron leader), held_shards (dispatch shards this replica currently owns). Informational; does not gate readiness.

checks fields — what makes each degrade

Field	Type	Degrades when	Effect on readiness
store	string	ok, or the error text of a failed store read (a limit-1 list of runs).	Any non-ok value → 503.
scheduler	string	ok, or exactly heartbeat stale when this replica's own scheduler heartbeat is zero or older than 15 s (heartbeatFreshFor, matching the scheduler's membership staleness window so the LB and peers agree on liveness).	Stale → 503.
blobstore	string	ok, or the error text of the write probe (create + remove a marker file under the blob root, cached for 10 s).	Any non-ok value → 503.
draining	bool	true once shutdown has begun on this replica.	true → 503.
system_quiesce	string	Present only while the estate-wide system-quiesce posture is in force; carries the posture's phase.	Informational only, as coded — its presence does not by itself flip readiness, so a quiesced estate's replicas stay in the load balancer and keep serving reads.

system_quiesce phase vocabulary

Verbatim (runnerrpc.SystemPhase*): draining (posture active, running attempts finishing) and quiesced (posture active and fully quiesced). The third constant, active, names a posture that has been resumed and never appears here — the check is only populated from an active posture.

Related pages

• opschain docs platform-halt — the system quiesce and halt postures the system_quiesce check reflects.
• opschain docs dispatch — the scheduler heartbeat and shard membership behind the scheduler fields.