Health

Root#

Endpoint: GET /

curl --cacert "${K7_API_CA:-./k7-ca.crt}" "$BASE/"

Example:

{ "message": "K7 Sandbox API", "version": "x.y.z" }

Health#

Endpoint: GET /health

curl --cacert "${K7_API_CA:-./k7-ca.crt}" "$BASE/health"

Example:

{  "status": "healthy",  "mode": "production",  "key_store": { "store": "secret", "synced_age_s": 2.1, "sync_error": null, "usage_flush_error": null },  "oidc_issuer": "https://login.example.com",  "tenant_status_error": null,  "metering": { "leader": true, "last_window_end": 1760745600, "error": null, "disk_unavailable": [] }}

• mode: production or development (also on every response as X-K7-Mode).
• key_store: when the k7-api-keys Secret snapshot was last refreshed; auth answers 503 rather than trust a snapshot older than 60 s.
• oidc_issuer: null when OIDC is off.
• tenant_status_error: last error of the leader’s Tenant.status.usage reconciler, or null.
• metering: storage-sampler state (leader or not, last emitted window, sizing errors, backends whose disk cannot be measured yet — k7d writable disks). k7-agent has its own /health with the node spool fill and egress_unavailable backends.