Q: How do I properly monitor a JSON API, not just whether the URL responds?

Q: How do I properly monitor a JSON API, not just whether the URL responds?

A: A 200 with a broken body is the trap here. Check content, not just status.

— Assert on the response body: a known JSON key or value must be present, not just HTTP 200.
— Check the content-type header is application/json. An HTML error page sneaking through is a classic.
— Add a response-time threshold and alert if it crosses your p95 baseline. Slow APIs cascade.
— Monitor a read endpoint AND a lightweight write/health endpoint. Reads can work while writes fail.
— Send the real auth header your clients use, so you test the actual code path.

Follow-up: rotate or use a long-lived test token, and alert before it expires. A monitor failing because its own token died is the most embarrassing false alarm.

Got a question? Drop it in the comments.