fix: add a devops secret header

api/routes/main.py

@@ -1,4 +1,7 @@
-from fastapi import APIRouter
+import secrets
+from typing import Annotated
+
+from fastapi import APIRouter, Header, HTTPException, status
 from loguru import logger
 from pydantic import BaseModel
 
@@ -131,8 +134,35 @@ class ActiveCallsResponse(BaseModel):
     active_calls: int
 
 
+DOGRAH_DEVOPS_SECRET_HEADER = "X-Dograh-Devops-Secret"
+
+
+def _verify_devops_secret(
+    configured_secret: str | None,
+    provided_secret: str | None,
+) -> None:
+    if not configured_secret:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Devops secret is not configured",
+        )
+    if not provided_secret or not secrets.compare_digest(
+        provided_secret,
+        configured_secret,
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Forbidden",
+        )
+
+
 @router.get("/health/active-calls", response_model=ActiveCallsResponse)
-async def active_calls() -> ActiveCallsResponse:
+async def active_calls(
+    x_dograh_devops_secret: Annotated[
+        str | None,
+        Header(alias=DOGRAH_DEVOPS_SECRET_HEADER),
+    ] = None,
+) -> ActiveCallsResponse:
     """In-flight call count for THIS worker — the drain signal for deploys.
 
     A deploy orchestrator polls this per worker and waits for zero before
@@ -141,6 +171,8 @@ async def active_calls() -> ActiveCallsResponse:
     count is per-process: one uvicorn per VM port (scripts/rolling_update.sh)
     or per Kubernetes pod (preStop hook). See api/services/pipecat/active_calls.py.
     """
+    from api.constants import DOGRAH_DEVOPS_SECRET
     from api.services.pipecat.active_calls import active_call_count
 
+    _verify_devops_secret(DOGRAH_DEVOPS_SECRET, x_dograh_devops_secret)
     return ActiveCallsResponse(active_calls=active_call_count())