Actuator Endpoints — A Window Into the Running App
library-service is live, and the hosting platform asks a simple question every ten seconds: "Are you alive?" Later, an engineer wants to know which beans loaded, which URLs are mapped, and how much memory is in use, without attaching a debugger to production. Spring Boot Actuator answers all of these through ready-made endpoints.
The rule
Actuator builds many endpoints, but over HTTP it shows only health until you choose more.
Add one starter:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>Endpoints appear under the /actuator base path. Two separate ideas control them:
- Enabled means the endpoint exists in the app at all. Most are enabled by default.
shutdownis the exception, and it stays off unless you deliberately turn it on. - Exposed means it can be reached over a given channel. Over HTTP, only
healthis exposed by default.
You choose what to expose over the web with one property:
management.endpoints.web.exposure.include=health,info,metricsA few endpoints worth knowing:
| Endpoint | Shows |
|---|---|
/actuator/health |
Whether the app and its dependencies are up |
/actuator/info |
Build and app information you choose to publish |
/actuator/metrics |
Measurements such as memory, request timings, pool usage |
/actuator/beans |
Every bean in the application context |
/actuator/mappings |
Every URL mapped to a controller method |
/actuator/env |
Configuration properties and where each came from |
/actuator/loggers |
Log levels, which you can change while running |
/actuator/conditions |
The auto-configuration condition report |
You can also move all of them to a separate port, management.server.port=8081, so the public load balancer only ever sees the API port.
The shortcut
For any endpoint, ask two questions in order: "Is it enabled?" then "Is it exposed on this channel?" It answers only when both are yes. If you get a 404 from /actuator/metrics, the second question is almost always the reason.
Is the starter there?
Yes:
/actuator/healthanswers with{"status":"UP"}.
The dangerous shortcut is exposure.include=*. It publishes env, beans, heapdump and more to anyone who can reach the port. The next lessons show how to expose what you need and protect it.
Drills
Answer fast — trust the rule.
With the actuator starter and no extra settings, which endpoint is reachable over HTTP?
Which property exposes info and metrics over HTTP as well as health?
Which endpoint lists every URL mapped to a controller method?
Which endpoint is disabled by default, not just unexposed?
Remember
- Actuator builds many endpoints, but over HTTP it shows only health until you choose more.
- Ask "enabled?" then "exposed on this channel?" — both must be yes.
- Trap:
exposure.include=*publishes sensitive endpoints to anyone who can reach them.