Report whether every stored credential can still be decrypted.

GET

/api/v1/credentials/health

curl --request GET \
  --url https://example.com/api/v1/credentials/health \
  --header 'Authorization: Bearer <token>'

This is the check a restore cannot skip. A database can come back whole — right row counts, healthy API — while the key-encryption key is a different one, in which case every credential is permanently unreadable and nothing says so until the next poll fails. scripts/yagra-restore-verify.sh asserts on this endpoint for exactly that reason, and it is worth looking at after any KEK rotation or restore.

It decrypts in memory and reports booleans; no secret value crosses this boundary.

Authorizations

• bearer

Responses

200

Per-credential decryptability. failures is empty on a healthy deployment

Media typeapplication/json

Whether the stored credentials can actually be decrypted with the KEK this process loaded.

object

decryptable

required

How many of them the current key opened successfully.

integer format: int32

failures

required

The ones that failed, if any. A non-empty list means polling with those credentials will fail until the correct key file is restored.

Array<object>

A credential the current KEK cannot open. Carries identity only — never a length, a key_id, or anything derived from the ciphertext.

object

id

required

string format: uuid

kind

required

string

name

required

string

total

required

How many credentials are stored.

integer format: int32

Example^generated

{
  "decryptable": 1,
  "failures": [
    {
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "kind": "example",
      "name": "example"
    }
  ],
  "total": 1
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks ManageCredentials

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Credential storage is unavailable (skeleton mode)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}