[minor] add unauthenticated heartbeat endpoint to API