---
title: "Cron Credential Health Sweep"
method: POST
path: "/v2/credentials/cron/health-sweep"
tags: ["Credentials v2"]
---

# Cron Credential Health Sweep

`POST /v2/credentials/cron/health-sweep`

## Request

- Base URL: `https://api.jubjubapp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.jubjubapp.com/v2/credentials/cron/health-sweep`
- Auth: HTTP bearer

Probe every active credential and mark the ones the platform says are dead.

Same auth as every other scheduled job in this service: Cloud Scheduler
OIDC, verified by require_cron_oidc against CRON_OIDC_AUDIENCE and the
CRON_SERVICE_ACCOUNTS allowlist (cron_auth.py:145-156). Nothing else can
call it.

NIGHTLY, not hourly. These tokens die on a scale of months — the oldest
dead one here expired in April — so an hourly sweep is 26 API calls an hour
to learn nothing, against third-party rate limits, to shorten a detection
window nobody is watching by 23 hours. Nightly also means a marked
credential is excluded from the NEXT import cron run rather than the
current one.

`dry_run=true` classifies and reports without writing, so the first sweep
can be read before it marks anything.

Marks ONLY on a definite platform answer. A timeout, a 429 or a 5xx is
recorded as undetermined and changes nothing — see
credential_health_policy for why that distinction is the point of this job.

## Query parameters

- `dry_run` boolean

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/jubjubapp/apis/jubjub-api.md) - [All operations](https://skmtc.dev/jubjubapp/apis/jubjub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jubjubapp/apis/jubjub-api/revisions/353157b296f2?raw)