Run deployment self-checks (admin-only)

POST

/api/admin/diagnostics/run

curl --request POST \
  --url https://example.com/api/admin/diagnostics/run \
  --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'

Runs the deployment self-checks and returns what they found: whether the server can reach its own public URL, how the client IP is resolved through http.trusted_proxies, whether the edge weakens the security headers the app sets, and whether the edge adds dangerous CORS headers. The edge checks call the server’s own public_url back through whatever sits in front of it; the target is always public_url and cannot be supplied by the caller. Nothing is written.

Authorizations

• sessionCookie

Responses

200

What the checks found

Media typeapplication/json

object

checks

Checks are the individual results, in display order.

Array<object>

object

findings

Findings are the individual observations, already phrased for an operator. Empty when the check found nothing to report.

Array<string>

id

required

ID is a stable machine key for the check, e.g. “reachability”.

string

remediation

Remediation is the concrete fix. Empty when the status is “ok”.

string

status

required

Status is the worst finding’s severity: “ok”, “warn”, “critical”, or “skipped”.

string

summary

required

Summary is the one-line headline for the check.

string

title

required

Title is the human name of the check.

string

public_origin

PublicOrigin is the URL the edge checks probed, echoed so the operator can confirm the run tested what they expected. Empty when http.public_url is not set.

string

Example ^generated

{
  "checks": [
    {
      "findings": [
        "example"
      ],
      "id": "example",
      "remediation": "example",
      "status": "example",
      "summary": "example",
      "title": "example"
    }
  ],
  "public_origin": "example"
}

401

Not authenticated

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

403

Not authorized as admin

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

429

Too many runs

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}