Health check endpoint includes database connectivity test
Why it matters
A health check that returns { ok: true } without testing database connectivity provides false assurance. When the database is unreachable, load balancers and deployment platforms interpret the 200 response as healthy and keep routing traffic to an application that cannot serve requests. ISO 25010 availability requires that the system's operational status is accurately observable; a health endpoint that does not reflect the actual state of its dependencies does not meet this requirement. Deployments that wait for a health check to pass before routing traffic also rely on this — a DB-unaware health check will green-light a deployment on a broken database.
Severity rationale
Medium because a DB-unaware health endpoint causes deployment platforms to route traffic to broken instances and prevents automated recovery from detecting database failures.
Remediation
Add a /api/health route that runs SELECT 1 against the database and returns 503 on failure. Wire this URL into your deployment platform's health check configuration.
// app/api/health/route.ts
import { prisma } from '@/lib/prisma'
export const dynamic = 'force-dynamic'
export async function GET() {
const checks: Record<string, 'ok' | 'fail'> = {}
try {
await prisma.$queryRaw`SELECT 1`
checks['database'] = 'ok'
} catch {
checks['database'] = 'fail'
}
const healthy = Object.values(checks).every(v => v === 'ok')
return Response.json(
{ status: healthy ? 'ok' : 'degraded', checks, ts: new Date().toISOString() },
{ status: healthy ? 200 : 503 }
)
}
Register the health check URL in your deployment platform (Railway, Render, ECS, Kubernetes readiness probe) so traffic is only routed to instances where the database is reachable.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Database Design & Operations Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.availability — Availability
- soc2:2017 · A1.2 — Environmental protections, backup, and recovery infrastructure
Taxons
History
- 2026-04-18·v1.0.0·Initial import from database-design-operations·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (A1.2) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2