> ## Documentation Index > Fetch the complete documentation index at: https://docs.qanapi.com/llms.txt > Use this file to discover all available pages before exploring further. # Readiness probe > Requires a working database pool. FIPS state and audit queue depth are reported but do not by themselves fail the probe: a deep queue spills to the write-ahead log rather than losing records, and removing the node from rotation would only push load onto its peers. The detailed body is returned only when `EXPOSE_HEALTH_DETAIL` is on, which it is not outside local environments, because this endpoint answers before authentication. Otherwise only `status` is present. ## OpenAPI ````yaml /openapi/stand-alone/v3.yaml get /health/ready openapi: 3.1.0 info: title: Qanapi Standalone API version: 3.0.0 summary: Single-tenant encryption, key management, classification and audit service. description: > A standalone cryptographic service. Callers hand it data and it returns ciphertext, or hand it ciphertext and it returns data, with every operation authorised by policy and recorded on a tamper-evident audit trail. ## Authentication Two credentials reach the same principal: - **API key** in `X-Qanapi-Authorization`, for machine callers. A key reaches only the configurations it is linked to. - **User bearer token** in `Authorization`, from `POST /api/v3/auth/login`, for a person working through a console. An API key outranks a bearer token when a request carries both, because a key names a narrower credential than the user that owns it. ## Status codes The credential failures are worth stating plainly, because they are not what a reader would guess and clients branch on them: | Situation | Status | |---|---| | No credential presented at all | `400` | | A credential that does not verify | `401` | | A revoked API key | `403` | | Authenticated but not permitted | `403` | | Request body or parameter is invalid | `422` | All of these match the Laravel v3 API this service replaces. Every error body carries `message` and `error`; validation failures additionally carry a field-keyed `errors` object. ## Rate limiting Every response carries `X-RateLimit-Limit` and `X-RateLimit-Remaining`. The window is per node and keyed on the client address, so a cluster of n nodes admits n times the configured figure. license: name: Proprietary identifier: LicenseRef-Qanapi-Commercial servers: - url: https://{host} description: A deployed instance, behind the reverse proxy that terminates TLS. variables: host: default: qanapi.example.com - url: http://localhost:8000 description: The local Compose cluster, through its load balancer. security: - ApiKeyAuth: [] - BearerAuth: [] tags: - name: STAND description: | Every operation this service serves. Carried on all of them so the standalone surface can be selected as a whole, which matters where this description is rendered or merged alongside another Qanapi API. It is a marker rather than a grouping: each operation keeps the tag that says what it does, and that one is listed first. - name: Health description: | Liveness and readiness probes. Registered outside the authentication, audit and transport layers, so a load balancer polling them without credentials still gets an answer. - name: Authentication description: Logging in, and creating the first administrator. - name: Users description: User accounts and their roles. - name: API keys description: > Machine credentials. A key is scoped to a set of configurations and reaches nothing until it is linked to at least one. - name: Configurations description: > Encryption configurations, called configurations on the wire for compatibility with the v3 API this service replaces. A configuration owns a master key and is the unit of cryptographic isolation. - name: Classifications description: | Sensitivity labels and the clearance that reaches them. - name: Policies description: Allow and deny rules binding a principal to actions on resources. - name: Encryption description: > The data plane. Field-level or whole-body encryption under a configuration, optionally forwarded onward to a destination of the caller's choosing. - name: KMS description: Customer-managed key lifecycle, import and export. - name: Audit description: The tamper-evident record of everything the service did. - name: Transport description: The service's own key pair, for end-to-end encrypted request bodies. paths: /health/ready: get: tags: - Health - STAND summary: Readiness probe description: | Requires a working database pool. FIPS state and audit queue depth are reported but do not by themselves fail the probe: a deep queue spills to the write-ahead log rather than losing records, and removing the node from rotation would only push load onto its peers. The detailed body is returned only when `EXPOSE_HEALTH_DETAIL` is on, which it is not outside local environments, because this endpoint answers before authentication. Otherwise only `status` is present. operationId: healthReady responses: '200': description: Ready for traffic. content: application/json: schema: $ref: '#/components/schemas/Readiness' '503': description: Not ready; the database pool is unreachable. content: application/json: schema: $ref: '#/components/schemas/Readiness' security: [] components: schemas: Readiness: type: object required: - status properties: status: type: string enum: - ready - unavailable instance_id: type: string database: type: boolean fips: type: object properties: build: type: boolean description: Whether the binary was compiled with the validated module. active: type: boolean description: Whether that module is in FIPS mode at runtime. audit: type: object properties: queue_depth: type: integer metrics: type: object properties: enqueued: type: integer written: type: integer spilled: type: integer description: >- Records written to the disk write-ahead log under backpressure. replayed: type: integer dropped: type: integer rejected: type: integer crypto: type: object properties: heavy_permits_available: type: integer description: Free slots in the Argon2 and RSA concurrency budget. revocation_epoch: type: integer description: | Incremented by every security-sensitive mutation. Each node polls it and treats cached decisions stamped with an older epoch as a miss, which is what makes a revocation take effect cluster-wide at once. securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-Qanapi-Authorization description: > A machine credential, `qk_` followed by its secret. The first twelve characters are an indexed prefix; the rest is compared in constant time against a stored SHA-256 hash. A key reaches only the configurations it is linked to. It may also be sent as `Authorization: Bearer qk_...`, which is recognised by the prefix. BearerAuth: type: http scheme: bearer bearerFormat: JWT description: | A user token from `POST /api/v3/auth/login`. The token asserts a role, but the database decides it, so a role changed or a user deleted after the token was issued takes effect immediately. A token minted before a password change is refused. ````