> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Heartbeat (Check Password)

> Syteca ACB REST API endpoint — NEW in v1.4 — to verify a secret's password is still valid on the target endpoint without modifying it. Useful for detecting drift between Syteca and the target system.

<Note>
  **NEW in ACB v1.4.** Not available in v1.3 and earlier. Confirm your installed ACB version supports this endpoint before scripting against it.
</Note>

Triggers a **heartbeat check** — Syteca attempts to authenticate against the target endpoint using the stored password to verify the password is still valid. **Does not modify the password.** Use this to detect drift between Syteca and the target system (when a sysadmin changed a service-account password outside of Syteca, or when a target system reset the password during a security incident).

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The user owning the Access Token must have **Editor** or **Owner** role on the secret.

### Status values returned

The response includes a `check_password_status` field with one of four [PasswordCheckStatus](/docs/api/acb/data-models#passwordcheckstatus) values:

* `None` — No check has been performed yet.
* `Valid` — The password is valid on the target endpoint.
* `Invalid` — The password is **not** valid (drift detected — consider rotating).
* `Failed` — The check itself failed (target unreachable, network error, etc.).

<Tip>
  **Scheduled heartbeat checks** — rather than calling this endpoint manually, configure the secret with `check_password: { enabled: true, check_every: 1, check_period_type: "Hour" }` via [Add secret](/docs/api/acb/endpoints/add-secret) or [Update secret](/docs/api/acb/endpoints/update-secret). Syteca then runs heartbeat checks automatically on schedule, and you read the result from the `check_password_status` field on [`GET /api/secrets/{id}`](/docs/api/acb/endpoints/get-secret).

  Use the **manual** heartbeat endpoint for on-demand verification — after suspected drift, after a target-system maintenance window, or as part of an incident-response playbook.
</Tip>

### Errors

* **403 Forbidden** — user lacks Editor/Owner role.
* **404 Not Found** — secret doesn't exist.

See [Status codes](/docs/api/acb/api-reference#status-codes) for the full mapping.

## Related

<CardGroup cols={2}>
  <Card title="Get secret" icon="info" href="/docs/api/acb/endpoints/get-secret">Read scheduled heartbeat results via `check_password_status`.</Card>
  <Card title="Rotate password" icon="refresh-ccw" href="/docs/api/acb/endpoints/rotate-secret-password">If heartbeat returns Invalid, rotate to fix drift.</Card>
  <Card title="Data models — CheckPassword" icon="braces" href="/docs/api/acb/data-models#checkpassword">Schedule heartbeat checks per secret.</Card>
  <Card title="Data models — status enum" icon="braces" href="/docs/api/acb/data-models#passwordcheckstatus">PasswordCheckStatus values.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/secrets/{id}/heartbeat
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/secrets/{id}/heartbeat:
    post:
      tags:
        - Secrets
      summary: Check secret password (Heartbeat)
      description: >-
        Initiates a heartbeat check to verify the secret's password is still
        valid
      operationId: checkSecretPassword
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the secret to check
          schema:
            type: integer
            format: int32
            minimum: 1
      responses:
        '200':
          description: Heartbeat check completed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckSecretPasswordResponseDto'
              example:
                check_password_status: Valid
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CheckSecretPasswordResponseDto:
      type: object
      properties:
        check_password_status:
          $ref: '#/components/schemas/PasswordCheckStatus'
      required:
        - check_password_status
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    PasswordCheckStatus:
      type: string
      enum:
        - None
        - Valid
        - Invalid
        - Failed
      description: Status of the last password check (heartbeat)
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````