# Health

Verifies an API key and reports the mode it resolves to. It runs no payment engine, so
use it as a connectivity and credential check. It is what the WooCommerce plugin's
**Test Connection** button calls.

```
GET    https://api.worthypayments.com/v1/ping
```

Authentication: any valid API key. **No scope required**; a valid key is enough.

---

## Request

```bash
curl https://api.worthypayments.com/v1/ping -H "x-api-key: sk_live_xxx"
```

## Response

```json
{
  "object": "ping",
  "mode": "live",
  "key_type": "secret",
  "merchant_account_id": "cmt3yfavu00013iokngc9rjtw",
  "api_version": "2026-01-01",
  "scopes": ["payments:charge", "payments:read"],
  "unrestricted": false
}
```

| Field | Notes |
|-------|-------|
| `object` | Always `"ping"`. |
| `mode` | `"test"` or `"live"`, the mode encoded in your key's prefix. |
| `key_type` | `"publishable"`, `"secret"`, or `"restricted"`. |
| `merchant_account_id` | The account the key resolves to. |
| `api_version` | The version this request was served under. See [Versioning](./20-versioning.md). |
| `scopes` | `resource:action` strings this key can actually reach. A `pk_` always reports exactly `["payments:charge"]`. |
| `unrestricted` | `true` only for a legacy secret key with no permission map, which retains full access. |

> **There is no `ok` field.** An earlier revision of this page documented one; it is not
> returned. Branch on the HTTP status instead. A `200` means the key is valid, and a
> `401` carries `api_key_invalid` or `api_key_required`. `if (response.ok)` against the
> **JSON body** silently evaluated `undefined` and never ran, which is why this is called
> out rather than quietly corrected. (`response.ok` on a `fetch` *Response* is a different
> thing and is fine.)

`scopes` and `unrestricted` are returned, and are the quickest way to explain a
`403 permission_denied`. They are derived from the same rules the scope guard enforces,
so the listing cannot disagree with the gate.

A publishable key returns the same shape with `"key_type": "publishable"`.

## Errors

If the key is missing or invalid you get a `401` with the standard envelope:

```json
{ "error": { "type": "invalid_request_error", "code": "api_key_invalid", "message": "Invalid, expired, or revoked API key." } }
```

See [Errors](./10-errors.md).

---

## From the SDK

The SDK exposes the same check:

```js
const info = await wp.ping();
// → { object: 'ping', mode: 'live', key_type: 'publishable',
//     merchant_account_id: 'cmt3yfavu00013iokngc9rjtw', api_version: '2026-01-01',
//     scopes: ['payments:charge'], unrestricted: false }
```

Use it on startup to confirm you've wired the correct key and mode before taking a real
payment.