Health Checks
Health checks are embedded in a dependency definition. A dependency can carry one healthCheck object, and that object determines what the scheduler probes, which secret-backed fields it must resolve, and how the result is classified.
For the wider loop, see Canary, Notifications, Canary MCP Reference, and Domain Model.
For the exact minimum scope or IAM action for each secret-backed connector, see Health Check Connector Permissions.
Scheduling
Checks run every 5 minutes. A fresh dependency with an enabled check is also queued immediately after registration so the first result does not wait for the next sweep.
Supported health-check types
| Type | Fields |
|---|---|
http | method, url, expectedStatus, timeoutMs |
http-bearer | method, url, expectedStatus, timeoutMs, token |
github | token |
aws | region, accessKeyId, secretAccessKey |
openai | apiKey |
anthropic | apiKey |
notion | token |
gitlab | token |
bitbucket | token |
clerk | secretKey |
linear | apiKey |
slack | token |
atlassian | host, email, token |
aws-kms | region, accessKeyId, secretAccessKey, keyId (optional) |
aws-bedrock | region, accessKeyId, secretAccessKey |
aws-cloudwatch-logs | region, accessKeyId, secretAccessKey |
aws-secrets-manager | region, accessKeyId, secretAccessKey |
See Health Check Connector Permissions for the exact OAuth and PAT scopes and AWS IAM actions.
Secret-backed fields
Fields like token or apiKey are resolved from the project’s Secrets page in the web app, not typed into the dependency definition itself. Values are written directly to Cloudflare Secrets Store and are never stored in the database or returned by the page.
