Black-box uptime checks vs. white-box health endpoints — which tells the truth?

Black-box uptime checks vs. white-box health endpoints — which tells the truth?

Q: I have a /health endpoint. Should my monitor just hit that?

A: Be careful — it depends on what /health actually checks. A naive health endpoint returns 200 as long as the web process is alive, even when the database it depends on is unreachable. Pointed at that, your monitor reports healthy during a real outage.

Black-box checks hit your real public URL like a user would, so they catch the whole stack end to end. White-box health endpoints can be smarter — querying the DB, checking queue depth, verifying dependencies — but only if you build them to.

The best combo: a black-box check on a real user-facing page for ground truth, plus a deep white-box /health that genuinely tests dependencies for fast root-cause. Make /health return 503 when a critical dependency is down — a health check that always says 200 is just an uptime check for your web server, nothing more.

Got a question? Drop it in the comments.