Inside /ping: The One Route That Doesn't Need You Logged In

An API that's authenticated almost everywhere

Every monitor, every check, every incident sits behind an authenticated session — there's no public way to read someone else's monitoring data, on purpose. Given that, an unauthenticated route stands out, and it's worth explaining why one exists at all.

What it's for

Uptime monitoring for other people's sites is only useful if the monitoring service itself is up. A lightweight, unauthenticated endpoint gives load balancers, uptime checks pointed at StatusLoom, and basic health checks something to hit without needing an account or a token — exactly the kind of check you'd want to run against any service before trusting it with your own sites.

Why it stays minimal on purpose

It doesn't touch the database, doesn't check anything monitor-related, doesn't return anything that would be useful to anyone but a health checker. That's deliberate — the fewer moving parts an unauthenticated route touches, the fewer ways it can become a problem in its own right, and the more honestly it answers the one question it exists to answer: is the service that watches your sites itself reachable right now.

The rest of the API stays closed

Every other route, without exception, requires an authenticated session scoped to the account that owns the data being requested. /ping is the one deliberate exception, and understanding why it's there is really an explanation of how narrow that exception is.