Skip to main content
Two complementary endpoints sit outside the authenticated, scope-restricted, rate-limited surface of the API. Use them whichever is more appropriate for your use case:
  • GET /health — no auth required, no rate limit. Used by uptime monitors and load balancers to verify the API is alive and the database responds.
  • GET /me — bearer required (any scope, including the empty set). Used by Make / Zapier connectors as the “Test connection” step to surface the org name and the bearer’s permissions to end users.

​
GET /health

Public liveness + readiness probe. No Authorization header needed, no scope, no rate limit. Verifies the Next.js process is alive and that the database pool can round-trip a SELECT 1. Designed for Uptime Kuma, Pingdom, Better Stack, AWS ELB target groups, and similar external monitoring. Intentionally minimal: no version info, no environment leak, nothing an attacker could fingerprint.

​
Request

curl https://panel.flowestate.app/api/v1/health

​
Response 200

{
  "ok": true,
  "ts": "2026-04-29T18:04:15.000Z"
}

​
Response 503

Returned when the database is unreachable from the API tier. 
{ "ok": false }

​
Monitoring tips

  • Use a keyword check on "ok":true rather than just status 200. That way a misconfigured edge cache that serves a stale {"ok":false} body doesn’t accidentally show as healthy.
  • Don’t poll faster than every 60 seconds. It’s a DB ping; don’t turn it into a load test.
  • It’s not authenticated. Don’t include any sensitive headers when probing it.

​
GET /me

Confirms a bearer is valid and returns the organization it is bound to. No scope required — useful as the “Test connection” step in Make / Zapier connectors.

​
Request

curl https://panel.flowestate.app/api/v1/me \
  -H "Authorization: Bearer fe_k_your_key_here"

​
Response 200

{
  "organization": {
    "id": "org_...",
    "name": "Acme Realty",
    "slug": "acme-realty"
  },
  "auth": {
    "type": "api_key",
    "scopes": ["leads:read", "leads:write"],
    "clientId": null,
    "userId": null
  }
}

​
Fields

FieldDescription
organization.idInternal organization identifier.
organization.nameDisplay name.
organization.slugURL-safe slug (may be null for older orgs).
auth.typeapi_key or oauth.
auth.scopesArray of scopes attached to this bearer.
auth.clientIdOAuth client ID. Present only for auth.type: "oauth".
auth.userIdThe authenticating user. Present only for auth.type: "oauth".

​
Errors

The standard auth errors apply (401, 403). See Authentication.