[← README](../README.md) · **01 · What Actuator actually exposes** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)

# 01 — What Actuator actually exposes

Add the starter, configure nothing, and ask the application what it publishes.

```xml
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
```

The answer, from [`../docs/output/01-default-exposure.txt`](output/01-default-exposure.txt):

```json
{"_links":{"self":{...},"health":{...},"health-path":{...}}}
```

One endpoint. `GET /actuator/env` returns **404**, not 403 — it was discovered, it exists as a
JMX endpoint, and it is simply not mapped onto HTTP.

That distinction matters more than it looks:

- **Discovery** — Actuator finds every `@Endpoint` bean on the classpath.
- **Access** (`management.endpoint.<id>.access`) — whether the endpoint may be operated at all.
  Defaults to `unrestricted` for everything except `heapdump` and `shutdown`.
- **Exposure** (`management.endpoints.web.exposure.include`) — whether it is mapped onto HTTP.
  Defaults to `health` only.

All three have to line up. A 404 from an Actuator path tells you nothing about whether the
endpoint is enabled, and people read it as "it's off" when it is often "it's on, over JMX".

## The default health body

```json
{"groups":["liveness","readiness"],"status":"DOWN"}
```

Two things to notice.

**The groups are there by default.** In Spring Boot 3 the liveness and readiness probes only
appeared when you asked for them or when Boot detected Kubernetes. In Boot 4 they are enabled
out of the box — see [chapter 02](02-boot-4-changes.md).

**`show-details` defaults to `never`**, so even an authenticated caller sees a bare status. That
is a sensible default and almost everyone overrides it to `always` without thinking about who
can reach the endpoint. [Chapter 04](04-securing-actuator.md) covers the middle option.

**The status is `DOWN`** because this repository registers a Kafka indicator and there is no
broker. One custom indicator that touches a third party is all it takes to turn the default
`/actuator/health` red — and that URL is what most Kubernetes manifests point their readiness
*and* liveness probes at. [Chapter 07](07-groups-and-probes.md) is about not doing that.

---

[← README](../README.md) · **01** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)