Spring Boot - Actuator

Spring Boot Actuator adds production-ready operational endpoints to your application with zero code. You get HTTP endpoints for health checks, metrics, environment info, thread dumps, and more: invaluable when running in cloud or container environments.

Share

Contents

Adding Actuator
XML
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

Key built-in endpoints

Exposing endpoints

By default only /health is exposed over HTTP. Enable additional endpoints in application.properties.

Properties
# Expose selected endpoints
management.endpoints.web.exposure.include=health,info,metrics,loggers,env

# Show full health detail
management.endpoint.health.show-details=always

# Isolate actuator to an internal port
management.server.port=9090

# Populate /actuator/info
info.app.name=My Spring App
info.app.version=1.0.0

Custom health indicator

Implement HealthIndicator to add component-level health checks, for example, verifying an external API is reachable.

Java
import org.springframework.boot.actuate.health.Health;
import org.springframework.boot.actuate.health.HealthIndicator;
import org.springframework.stereotype.Component;

@Component("externalApi")
public class ExternalApiHealthIndicator implements HealthIndicator {

    private final ExternalApiClient apiClient;

    public ExternalApiHealthIndicator(ExternalApiClient apiClient) {
        this.apiClient = apiClient;
    }

    @Override
    public Health health() {
        try {
            boolean ok = apiClient.ping();
            return ok
                ? Health.up().withDetail("url", apiClient.getBaseUrl()).build()
                : Health.down().withDetail("reason", "Ping failed").build();
        } catch (Exception e) {
            return Health.down(e).build();
        }
    }
}

This appears under /actuator/health as a component named externalApi.

Securing Actuator endpoints

In production, restrict sensitive endpoints. Combine management.server.port with firewall rules, or use Spring Security to require authentication.

Java
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
        http
          .securityMatcher(EndpointRequest.toAnyEndpoint())
          .authorizeHttpRequests(auth -> auth
              .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
              .anyRequest().hasRole("ADMIN")
          )
          .httpBasic(h -> {});
        return http.build();
    }
}