Files
spring-boot-demo/docs/01-what-actuator-exposes.md
Ankur Mhatre 4b6cefa60a Spring Boot 4 Actuator in production: endpoints, security, custom health indicators
Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
2026-09-04 10:40:04 +05:30

2.4 KiB

← README · 01 · What Actuator actually exposes · 02 What changed in Spring Boot 4 →

01 — What Actuator actually exposes

Add the starter, configure nothing, and ask the application what it publishes.

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

The answer, from ../docs/output/01-default-exposure.txt:

{"_links":{"self":{...},"health":{...},"health-path":{...}}}

One endpoint. GET /actuator/env returns 404, not 403 — it was discovered, it exists as a JMX endpoint, and it is simply not mapped onto HTTP.

That distinction matters more than it looks:

  • Discovery — Actuator finds every @Endpoint bean on the classpath.
  • Access (management.endpoint.<id>.access) — whether the endpoint may be operated at all. Defaults to unrestricted for everything except heapdump and shutdown.
  • Exposure (management.endpoints.web.exposure.include) — whether it is mapped onto HTTP. Defaults to health only.

All three have to line up. A 404 from an Actuator path tells you nothing about whether the endpoint is enabled, and people read it as "it's off" when it is often "it's on, over JMX".

The default health body

{"groups":["liveness","readiness"],"status":"DOWN"}

Two things to notice.

The groups are there by default. In Spring Boot 3 the liveness and readiness probes only appeared when you asked for them or when Boot detected Kubernetes. In Boot 4 they are enabled out of the box — see chapter 02.

show-details defaults to never, so even an authenticated caller sees a bare status. That is a sensible default and almost everyone overrides it to always without thinking about who can reach the endpoint. Chapter 04 covers the middle option.

The status is DOWN because this repository registers a Kafka indicator and there is no broker. One custom indicator that touches a third party is all it takes to turn the default /actuator/health red — and that URL is what most Kubernetes manifests point their readiness and liveness probes at. Chapter 07 is about not doing that.


← README · 01 · 02 What changed in Spring Boot 4 →