With the Spring Boot Actuator, all endpoints are enabled by default, except the shutdown endpoint. In order to enable or disable a particular endpoint, a relevant property should be added in the application.properties file. The following is the format for enabling the endpoint:
management.endpoint.<id>.enabled=true
As an example, the following property can be added to enable the shutdown endpoint:
management.endpoint.shutdown.enabled=true
The following log entries can be seen when we bootstrap an application with the default Actuator endpoints enabled:
2018-03-24 17:51:36.687 INFO 8516 --- [ main] s.b.a.e.w.s.WebMvcEndpointHandlerMapping : Mapped "{[/actuator/health],methods=[GET],produces=[application/vnd.spring-boot.actuator.v2+json || application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.web.servlet.AbstractWebMvcEndpointHandlerMapping$OperationHandler.handle(javax.servlet.http.HttpServletRequest,java.util.Map<java.lang.String, java.lang.String>)
2018-03-24 17:51:36.696 INFO 8516 --- [ main] s.b.a.e.w.s.WebMvcEndpointHandlerMapping : Mapped "{[/actuator/info],methods=[GET],produces=[application/vnd.spring-boot.actuator.v2+json || application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.web.servlet.AbstractWebMvcEndpointHandlerMapping$OperationHandler.handle(javax.servlet.http.HttpServletRequest,java.util.Map<java.lang.String, java.lang.String>)
2018-03-24 17:51:36.697 INFO 8516 --- [ main] s.b.a.e.w.s.WebMvcEndpointHandlerMapping : Mapped "{[/actuator],methods=[GET],produces=[application/vnd.spring-boot.actuator.v2+json || application/json]}" onto protected java.util.Map<java.lang.String, java.util.Map<java.lang.String, org.springframework.boot.actuate.endpoint.web.Link>> org.springframework.boot.actuate.endpoint.web.servlet.WebMvcEndpointHandlerMapping.links(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)
Looking at the log entries closely, we find that the following endpoints or URLs are exposed:
- /actuator
- /actuator/health
- /actuator/info
Why does the application have three endpoints exposed out of so many listed earlier? To answer this question, the Spring Boot Actuator exposes only three endpoints over HTTP. The rest of the endpoints, listed previously, are exposed over the JMX connection. The following is a list of endpoints and information about whether they are exposed over HTTP or JMX:
| ID | Exposed over JMX | Exposed over HTTP |
| auditevents | Yes | No |
| beans | Yes | No |
| conditions | Yes | No |
| configprops | Yes | No |
| env | Yes | No |
| flyway | Yes | No |
| health | Yes | Yes |
| heapdump | N/A | No |
| httptrace | Yes | No |
| info | Yes | Yes |
| jolokia | N/A | No |
| logfile | N/A | No |
| loggers | Yes | No |
| liquibase | Yes | No |
| metrics | Yes | No |
| mappings | Yes | No |
| prometheus | N/A | No |
| scheduledtasks | Yes | No |
| sessions | Yes | No |
| shutdown | Yes | No |
| threaddump | Yes | No |
Why does Spring Boot not expose all the endpoints over HTTP by default? The reason is that the endpoints may expose sensitive information. So, a careful consideration should be done in exposing them.
The following properties can be used to change or override the default exposure behavior of the endpoints:
- management.endpoints.jmx.exposure.exclude: The endpoint IDs specified in a comma-separated list are excluded from default exposure over the JMX connection. By default, none of the default endpoints are excluded.
- management.endpoints.jmx.exposure.include: The endpoint IDs specified in a comma-separated list are included along with the default exposure over the JMX connection. The property can be used to expose those endpoints that are not included in the default list of endpoints. The default value for the property is *, which indicates that all of the endpoints are exposed.
- management.endpoints.web.exposure.exclude: The endpoint IDs specified by a comma-separated list are excluded from being exposed over HTTP. Though no default value exists, only info and health endpoints are exposed. The rest of the endpoints are implicitly excluded for HTTP.
- management.endpoints.web.exposure.include: The endpoint IDs specified in a comma-separated list are included along with the default exposure over HTTP. The property can be used to expose those endpoints that are not included in the default list of endpoints. The default value for the property is info, health.