# Operate the node

## Monitoring

| Endpoint (internal interface) | Use it for |
|---|---|
| `/health` | Health checks by Docker or Kubernetes. Returns `200 OK` when the node is healthy. |
| `/status/diagnostics` | Details about the node's state, for administrators |
| `/metrics` | Metrics in Prometheus format |

See [monitoring](https://nuts-node.readthedocs.io/en/latest/pages/deployment/monitoring.html) in the Nuts node documentation.

## Backups

Back up both, and test that you can restore them:

- the SQL database (`storage.sql.connection`);
- the private keys (`crypto.storage`, e.g. HashiCorp Vault or Azure Key Vault).

Without the private keys, the node can't use its DIDs anymore, and every care organization needs a new subject, new credentials and a new registration.

## Upgrades

- Read the [release notes](https://nuts-node.readthedocs.io/en/latest/pages/release_notes.html) before you upgrade.
- Upgrade test and acceptance first, then production.
- Keep a fixed version in your deployment (see "Deploy the Nuts node").

## Troubleshooting

| Problem | Likely cause | What to do |
|---|---|---|
| The node doesn't start | A Discovery Service definition can't be read | The log says which file. Use the files from the use case's IG, unchanged. |
| A DID doesn't resolve from the internet | Reverse proxy, TLS or DNS | See "Endpoints and TLS certificates" and check 2 in "Test your setup step by step" |
| Discovery registration returns `412` | Missing or expired credentials, or the Discovery Server can't be reached | The response says which. Fix it and call the registration `POST` again: the node doesn't retry by itself. |
| Registration status is `error` | A refresh failed | `error` in the status says why. Fix it; the node retries at the next refresh. |
| You can't find a care organization that just registered | Your node updates its copy of the Discovery Service every 10 minutes by default | Wait, or check `discovery.client.refreshinterval` |
| Token request returns `412` | Your wallet doesn't have the credentials the other party's policy requires | Check the wallet and the use case's policy definition |
| Token request returns `503` | The other party's authorization server can't be reached | Check the `authServerURL` and your outbound network |
| The other party returns `401` for a token that hasn't expired | Their authorization server may have lost the token, e.g. after a restart | Request a new token with the header `Cache-Control: no-cache`, which skips your node's token cache. Don't do this by default: it adds load on both sides. |
| DPoP validation fails for incoming requests | The URL your API sees differs from the URL the requester used, e.g. after a reverse proxy rewrote it | Validate with the URL as the requester called it (see "Validate the access token") |

Still stuck? Set `verbosity` to `debug` for more detail in the log, and ask on the [Nuts Slack](https://nuts-foundation.slack.com).