---
title: "Diagnose live CDN state for a public blob URL (v1.45)"
method: GET
path: "/storage/v1/blobs/diagnose"
tags: ["storage"]
---

# Diagnose live CDN state for a public blob URL (v1.45)

`GET /storage/v1/blobs/diagnose`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/storage/v1/blobs/diagnose`
- Auth: API key in header `apikey`

Probes a public blob URL via GET with Range: bytes=0-0, resolves the expected SHA-256, and returns a JSON envelope with cache state and any in-flight invalidations. Requires the apikey header to carry a project service_key or project_admin JWT. SSRF-guarded — only `*.run402.com` and the requesting project's active custom domains are accepted.

## Query parameters

- `url` string, required

## Response `200`

Diagnostic envelope.

- BlobDiagnoseResponse
  - `key` string
  - `vantage` string
  - `cache` object
    - `x_cache` string, nullable
    - `age_seconds` integer, nullable
    - `cache_kind` 'immutable' | 'mutable' | 'private' | 'null', nullable
  - `invalidation` object, nullable
  - `hint` string
  - `expected_sha256` string, nullable
  - `observed_sha256` string, nullable
  - `probe_may_have_warmed_cache` boolean
  - `probe_method` string
  - `project_id` string: Run402 project ID. Public IDs are not UUIDs.

## Other responses

- `400`: Non-allowed host (SSRF guard) or malformed URL.
- `403`: Requires service_role or project_admin key, or URL belongs to a different project.
- `404`: Blob does not exist.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)