---
owner_slack: "#govuk-2ndline"
title: Signon app healthcheck not ok
parent: "/manual.html"
layout: manual_layout
section: Icinga alerts
last_reviewed_on: 2018-08-31
review_in: 6 months
---

[signon]: https://signon.publishing.service.gov.uk/api_users
[signon-healthcheck]: https://signon.publishing.service.gov.uk/healthcheck
[deploy-puppet]: https://deploy.publishing.service.gov.uk/job/Deploy_Puppet/
[restart-app]: /manual/restart-application
[govuk-secrets]: https://github.com/alphagov/govuk-secrets
[gds-api-adapters]: https://github.com/alphagov/gds-api-adapters/blob/master/lib/gds_api.rb

Signon has a standard [/healthcheck][signon-healthcheck] endpoint, which is queried periodically by Icinga and is comprised of several checks. In addition to the standard database checks, there are also custom checks for this application.

  * `api_tokens`: looks at tokens for API Users to see if any are about to expire. You should rotate expiring tokens to ensure the associated application keeps working.

## Rotating API Tokens

As a working example, let's say we have an alert like *Content Publisher token for Publishing API expires in X days*. In this example, the API User is *Content Publisher* and the application is *Publishing API*.

   * First login to [Signon], go to API Users and click on the API User.

> Check the *Last synced at* time to see if the API User is still using the application. If you are confident the token is unused, there's no point rotating it and you can click the *Revoke* button to remove it.

   * Click *Add application token* and select the application for the alert.
   * Copy the new token and prepare to replace it in [govuk-secrets].

> How to do the last step depends on the application, but it should be something like `rake eyaml:edit[integration,apps]`, depending on the environment you're working on.

   * Find a line like `govuk::apps::content_publisher::publishing_api_bearer_token...`
   * Replace the long string within `GPG[xxxxxx]` with the new token.
   * Save the file, make a PR with your change and deploy the change with Puppet.

> Changes to govuk-secrets do not automatically trigger a Puppet deploy. One way to work around this is to [rebuild the last release][deploy-puppet]. You then need to wait for Puppet to run on each of the affected machines.

   * Once the new token has been deployed, [restart the app][restart-app] to stop using the old token.
   * Check the app can still access the remote application APIs with the new token.
   * Once you're happy the new token works, you can *Revoke* the old one in Signon.

> How to check the new token works depends on the application. One way to check the token works is to manually open a console for the application and call one of the remote APIs using [gds-api-adapters].

Add alert manual about rotating tokens in signon
Add alert manual about rotating tokens in signon
