Health and webhooks

Health

GET /api/health

Returns runtime health derived from database and queue checks. A healthy HTTP response is not proof that every optional integration is configured.

SMART JWKS

GET /.well-known/jwks.json

Publishes only public JWK material used for SMART signing-key discovery. If configuration is unavailable, the endpoint returns 503.

Paddle

POST /api/webhooks/paddle

The webhook accepts a raw JSON body, verifies the Paddle-Signature, and returns a duplicate indicator when a replayed event is recognized.

Do not send PHI through the billing webhook.