Health check
Public and served before first-run setup. Everyone gets ok and setupRequired and version; a loopback client (the TCP peer, never a forwarded header) or a Bearer session whose account may configure the instance (instance.configure) also gets db and cache and storage and schemeMismatch. 503 carries the same body with ok false.
Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.
Public and served before first-run setup. Everyone gets ok and setupRequired and version; a loopback client (the TCP peer, never a forwarded header) or a Bearer session whose account may configure the instance (instance.configure) also gets db and cache and storage and schemeMismatch. 503 carries the same body with ok false.
Every dependency answers
application/json- response
ok*booleanTrue when the database, the cache and storage all answer.
setupRequired*booleanTrue until first-run setup has created the super admin.
version*stringRunning version (SHOTSTASH_VERSION in the image, else package.json).
db?booleanDetailed body only: the database answers.
cache?booleanDetailed body only: Dragonfly answers.
storage?booleanDetailed body only: the storage backend is reachable.
schemeMismatch?booleanDetailed body only: the request scheme differs from APP_URL (a proxy without TRUST_PROXY=true).
curl -X GET "https://example.com/api/health"{ "ok": true, "setupRequired": true, "version": "string", "db": true, "cache": true, "storage": true, "schemeMismatch": true}Run a GraphQL operation POST
The GraphQL endpoint for queries and mutations; subscriptions use graphql-ws on the same path. The schema and every operation are documented in schema.graphql at the repository root. Send the session as a Bearer token; each root field declares its own auth (public or session). The media cookie is never read here.
Ping GET
Liveness answer with the server time; touches no dependency.