---
title: "Check API health, GET /health"
description: "Public liveness probe for the Panel API. Returns 200 and a small JSON body when the API is up. Requires no authentication."
---

# Check API health

`/health` is the liveness probe of the Panel API. It answers with a small, fixed JSON body whenever the front controller is up and able to route requests. External uptime monitors, load balancer health checks, and CI smoke tests all call it because it is the one endpoint that does not need an API key.

The endpoint is deliberately narrow. It does not read the database, it does not touch memcached, and it does not check the state of the panel behind it. All it proves is that PHP is responding and that the router is loaded. If you need to distinguish "API off" from "API disabled by a kill switch", `/health` will still answer `200 ok` when the kill switch is set (the kill switch only affects authenticated routes). A `503` from this endpoint means the front controller itself could not boot.

## Endpoint

`GET https://<your-panel-domain>/panel-api/v1/health`

## Authentication

None. Public endpoint. Do not send an `Authorization` header (it is ignored).

## Required scope

None. Public endpoint.

## Rate limit

Public endpoints have their own limit of 30 requests per minute, per license, per source IP. Well above what any reasonable monitor needs. When the limit is exceeded you get `429 rate_limited` with a `Retry-After: 60` header.

## Response

The body is always the same two fields.

| Field | Type | Description |
| ----- | ---- | ----------- |
| `status` | string | Fixed value `"ok"`. |
| `version` | string | API major version. Currently `"v1"`. |

```json
{
  "status": "ok",
  "version": "v1"
}
```

## Examples

### cURL

```bash
curl -X GET "https://<your-panel-domain>/panel-api/v1/health"
```

### PHP SDK

```php
require __DIR__ . '/api-panel-php-sdk-1.0.0/autoload.php';
use XtreamAI\PanelApi\PanelApiClient;

$client = new PanelApiClient(baseUrl: 'https://<your-panel-domain>', token: '<your-api-key>');
$response = $client->health();
echo $response['status'] . ' (' . $response['version'] . ")\n";
```

### Python SDK

```python
from xtream_ai_panel_api import PanelApiClient

client = PanelApiClient(base_url="https://<your-panel-domain>", token="<your-api-key>")
response = client.health()
print(f"{response['status']} ({response['version']})")
```

> [!TIP]
> The SDK constructors require a token even for `health()`, because the same client instance is normally reused for authenticated calls. If you only need the health probe and have no key yet, pass any non-empty string. The token is not sent to `/health`.

## Errors

| HTTP | Error slug | When it happens | How to fix |
| ---- | ---------- | --------------- | ---------- |
| 404 | `not_found` | The path is wrong. Typically a typo like `/health/` or a missing `/panel-api/v1` prefix. | Confirm the URL is exactly `/panel-api/v1/health`. |
| 405 | `method_not_allowed` | You sent `POST`, `PUT`, or anything other than `GET`. | Use `GET`. |
| 429 | `rate_limited` | You exceeded 30 requests per minute from the same IP against the same license. | Back off for 60 seconds (see the `Retry-After` header) and lower the poll frequency of your monitor. |

## See also

- [Panel API overview](/docs/?page=panel-api-overview)
- [Authentication](/docs/?page=panel-api-authentication)
- [Errors, retries and idempotency](/docs/?page=panel-api-errors)