Health and public key endpoints

The unauthenticated collector health probe and the public signing-key documents for verifying signed envelopes and Agent Passports offline.

These endpoints need no credential. Base URL: https://collect.noxtica.com (production). For incident history and planned maintenance use the public status page rather than polling the health probe.

These operations take no credential.

Collector health probe

GET /health

Unauthenticated liveness and readiness probe of the collector. It performs no datastore connectivity check: it answers whether the collector worker itself is alive.

status is ok, or degraded while a background dead-letter watch reports unprocessed items (still HTTP 200). HTTP 503 is returned only when the deployment refuses readiness; the body then also has status: degraded. The body can carry additional diagnostic members; ignore members you do not recognise. version is the deployed collector version, or unknown when none is reported.

The response sets no CORS headers, so call it from a server or a monitor, never from a browser. Excessive probing from one source address is rate limited (429 with Retry-After). For incident history see the public status page.

Authentication: none. This operation does not take a credential.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "status": "ok",
  "version": "1.0.0",
  "timestamp": "2026-10-27T10:00:00.000Z"
}

Example request

curl

curl "https://collect.noxtica.com/health"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/health', {
  method: 'GET',
});
console.log(response.status, await response.text());

Python (standard library)

import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/health",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Public signing keys (JWKS)

GET /.well-known/noxtica/jwks.json

The public keys Noxtica signs its envelopes with, as a standard JSON Web Key Set, so your backend can verify a signed envelope offline, by kid, without calling Noxtica: the signed policy and result envelopes of the browser integration and, unless a dedicated passport key is published (see GET /.well-known/noxtica/agent-passport-jwks.json), Agent Passports.

The document is unauthenticated and public by design: only the public members kty, crv, x, y and the descriptors kid, use and alg are ever served. During a key rotation it holds both the current and the incoming key (current first), so a verifier can resolve the new kid before the signer cuts over. The response is cacheable for 5 minutes. The route answers 404 when signing is not configured for the deployment.

Authentication: none. This operation does not take a credential.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "nox-2026-01",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}

Example request

curl

curl "https://collect.noxtica.com/.well-known/noxtica/jwks.json"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/.well-known/noxtica/jwks.json', {
  method: 'GET',
});
console.log(response.status, await response.text());

Python (standard library)

import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/.well-known/noxtica/jwks.json",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Public Agent Passport signing keys (JWKS)

GET /.well-known/noxtica/agent-passport-jwks.json

The public key of the dedicated Agent Passport signing key, when one is provisioned, as a standard JSON Web Key Set. It is deliberately a separate document from GET /.well-known/noxtica/jwks.json so a result verifier that fetches only the main document can never accept a passport. Use this document, and only for Agent Passports.

The route answers 404 when no dedicated passport key exists; passports are then signed under a key published on the main JWKS. During a rotation both the current and the incoming key are published (current first). The document is unauthenticated, public by design and cacheable for 5 minutes.

Authentication: none. This operation does not take a credential.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "nox-passport-2026-01",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}

Example request

curl

curl "https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json', {
  method: 'GET',
});
console.log(response.status, await response.text());

Python (standard library)

import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/.well-known/noxtica/agent-passport-jwks.json",
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

This page is generated from the Noxtica OpenAPI specification release v0.4.0: v1.yaml version 1.3.0-2026-10-27 (SHA-256 3fd15257a022). Do not edit it by hand.