A 200 response is only the start.
What it checks
Check for required or forbidden words and validate supported JSON assertions. An API endpoint can answer successfully while returning an unusable payload; assertions make that distinction visible.
Set it up thoughtfully
Use a read-only health endpoint. Avoid side effects and keep secrets out of URL queries. Configure expected content precisely enough to detect a failure without tying checks to incidental page copy.
Know the boundary
Credential storage and evidence redaction must be verified before enabling customer-supplied credentials. Public self-service stays gated while those controls are reviewed.