---
title: "Health and public key endpoints"
description: "The unauthenticated collector health probe and the public signing-key documents for verifying signed envelopes and Agent Passports offline."
canonical_url: "https://noxtica.com/docs/api/reference/status/"
markdown_url: "https://noxtica.com/docs/api/reference/status/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "server-apis"
section_title: "Server APIs"
openapi_release: "v0.4.0"
openapi_spec_version: "1.3.0-2026-10-27"
site: "Noxtica"
language: "en"
source: markdown
---

# Health and public key endpoints

The unauthenticated collector health probe and the public signing-key documents for verifying signed envelopes and Agent Passports offline.

These endpoints need no credential. Base URL: `https://collect.noxtica.com` (production). For incident history and planned maintenance use the public status page rather than polling the health probe.

| Environment | Base URL |
| --- | --- |
| Production | `https://collect.noxtica.com` |

These operations take no credential.

## Collector health probe {#getHealth}

`GET /health`

Unauthenticated liveness and readiness probe of the collector. It performs no datastore
connectivity check: it answers whether the collector worker itself is alive.

`status` is `ok`, or `degraded` while a background dead-letter watch reports unprocessed
items (still HTTP `200`). HTTP `503` is returned only when the deployment refuses
readiness; the body then also has `status: degraded`. The body can carry additional
diagnostic members; ignore members you do not recognise. `version` is the deployed
collector version, or `unknown` when none is reported.

The response sets no CORS headers, so call it from a server or a monitor, never from a
browser. Excessive probing from one source address is rate limited (`429` with
`Retry-After`). For incident history see the public status page.

**Authentication:** none. This operation does not take a credential.

### Responses

| Status | Meaning | Error codes | Content |
| --- | --- | --- | --- |
| `200` | The collector is alive. |  | `application/json` HealthStatus |
| `429` | Rate limit exceeded. Wait `Retry-After` seconds (also `retryAfter` in the body) before retrying; the response carries no other rate-limit headers. | `Rate limit exceeded` | `application/json` |
| `503` | The deployment refuses readiness. `status` is `degraded`. |  | `application/json` HealthStatus |

**Response headers**

| Status | Header | Type | Description |
| --- | --- | --- | --- |
| `200` | `Cache-Control` | const |  |
| `429` | `Retry-After` | integer | Seconds until the bucket allows another request. |

**Response fields** (`200`, `application/json`)

| Field | Type | Always returned | Description |
| --- | --- | --- | --- |
| `status` | string | Yes | Allowed values: `ok`, `degraded`. |
| `version` | string | Yes | The deployed collector version |
| `timestamp` | string (date-time) | Yes | Server time of the response. |

**Response example** (`200`)

```json
{
  "status": "ok",
  "version": "1.0.0",
  "timestamp": "2026-10-27T10:00:00.000Z"
}
```

### Example request

**curl**

```bash
curl "https://collect.noxtica.com/health"
```

**Node.js** (global `fetch`, Node 18 or later)

```js
const response = await fetch('https://collect.noxtica.com/health', {
  method: 'GET',
});
console.log(response.status, await response.text());
```

**Python** (standard library)

```python
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/health",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())
```

## Public signing keys (JWKS) {#getCollectorJwks}

`GET /.well-known/noxtica/jwks.json`

The public keys Noxtica signs its envelopes with, as a standard JSON Web Key Set, so your
backend can verify a signed envelope offline, by `kid`, without calling Noxtica: the signed
policy and result envelopes of the browser integration and, unless a dedicated passport key
is published (see `GET /.well-known/noxtica/agent-passport-jwks.json`), Agent Passports.

The document is unauthenticated and public by design: only the public members `kty`,
`crv`, `x`, `y` and the descriptors `kid`, `use` and `alg` are ever served. During a key
rotation it holds both the current and the incoming key (current first), so a verifier can
resolve the new `kid` before the signer cuts over. The response is cacheable for 5 minutes.
The route answers `404` when signing is not configured for the deployment.

**Authentication:** none. This operation does not take a credential.

### Responses

| Status | Meaning | Error codes | Content |
| --- | --- | --- | --- |
| `200` | The public key set. |  | `application/json` Jwks |
| `404` | Signing is not configured for this deployment. The body is `{"error":"Not found"}`. | `Not found` | `application/json` NotFoundError |

**Response headers**

| Status | Header | Type | Description |
| --- | --- | --- | --- |
| `200` | `Cache-Control` | const |  |

**Response fields** (`200`, `application/json`)

| Field | Type | Always returned | Description |
| --- | --- | --- | --- |
| `keys` | array of object | Yes |  |
| `keys[]` | object | No |  |
| `keys[].kty` | string | Yes | Allowed values: `EC`. |
| `keys[].crv` | string | Yes | Allowed values: `P-256`. |
| `keys[].x` | string | Yes | base64url X coordinate. |
| `keys[].y` | string | Yes | base64url Y coordinate. |
| `keys[].kid` | string | Yes | Key id; matches the `kid` of the envelopes signed with it. |
| `keys[].use` | string | Yes | Allowed values: `sig`. |
| `keys[].alg` | string | Yes | Allowed values: `ES256`. |

**Response example** (`200`)

```json
{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "nox-2026-01",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}
```

### Example request

**curl**

```bash
curl "https://collect.noxtica.com/.well-known/noxtica/jwks.json"
```

**Node.js** (global `fetch`, Node 18 or later)

```js
const response = await fetch('https://collect.noxtica.com/.well-known/noxtica/jwks.json', {
  method: 'GET',
});
console.log(response.status, await response.text());
```

**Python** (standard library)

```python
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/.well-known/noxtica/jwks.json",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())
```

## Public Agent Passport signing keys (JWKS) {#getAgentPassportJwks}

`GET /.well-known/noxtica/agent-passport-jwks.json`

The public key of the dedicated Agent Passport signing key, when one is provisioned, as a
standard JSON Web Key Set. It is deliberately a separate document from
`GET /.well-known/noxtica/jwks.json` so a result verifier that fetches only the main
document can never accept a passport. Use this document, and only for Agent Passports.

The route answers `404` when no dedicated passport key exists; passports are then signed
under a key published on the main JWKS. During a rotation both the current and the
incoming key are published (current first). The document is unauthenticated, public by
design and cacheable for 5 minutes.

**Authentication:** none. This operation does not take a credential.

### Responses

| Status | Meaning | Error codes | Content |
| --- | --- | --- | --- |
| `200` | The public key set of the dedicated passport signing key. |  | `application/json` Jwks |
| `404` | No dedicated passport key is configured. The body is `{"error":"Not found"}`. | `Not found` | `application/json` NotFoundError |

**Response headers**

| Status | Header | Type | Description |
| --- | --- | --- | --- |
| `200` | `Cache-Control` | const |  |

**Response fields** (`200`, `application/json`)

| Field | Type | Always returned | Description |
| --- | --- | --- | --- |
| `keys` | array of object | Yes |  |
| `keys[]` | object | No |  |
| `keys[].kty` | string | Yes | Allowed values: `EC`. |
| `keys[].crv` | string | Yes | Allowed values: `P-256`. |
| `keys[].x` | string | Yes | base64url X coordinate. |
| `keys[].y` | string | Yes | base64url Y coordinate. |
| `keys[].kid` | string | Yes | Key id; matches the `kid` of the envelopes signed with it. |
| `keys[].use` | string | Yes | Allowed values: `sig`. |
| `keys[].alg` | string | Yes | Allowed values: `ES256`. |

**Response example** (`200`)

```json
{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "nox-passport-2026-01",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}
```

### Example request

**curl**

```bash
curl "https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json"
```

**Node.js** (global `fetch`, Node 18 or later)

```js
const response = await fetch('https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json', {
  method: 'GET',
});
console.log(response.status, await response.text());
```

**Python** (standard library)

```python
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())
```

_This page is generated from the Noxtica OpenAPI specification release `v0.4.0`: `v1.yaml` version `1.3.0-2026-10-27` (SHA-256 `3fd15257a022`). Do not edit it by hand._