APIs fail differently from websites: they answer 200 with an error body, get slow before they get down, and depend on queues nobody watches. Here is how to monitor them.
Assert on the body
Pick a health endpoint that checks the database and cache, returns JSON, and monitor a field such as $.status equals ok.
Authenticate
Use a read-only token in an Authorization header. Rotate it like any other secret.
Watch latency
Set a threshold at roughly twice your normal p95. A slow API is usually a leading indicator of an outage.
Monitor the workers
Queue consumers and cron jobs need heartbeat monitors: the job pings a URL when it finishes.
Group it on a status page
Show API, webhooks and background jobs as separate components so customers see exactly what is affected.