---
title: "Admin interface"
url: "/docs/observe/admin-interface/"
kind: "feature"
summary: "A local HTTP endpoint for operating Arion: readiness, server info, listeners, clusters, certificates, stats and config dump."
---

> Arion site index: [/llms.txt](/llms.txt)

# Admin interface

A local HTTP endpoint for operating Arion: readiness, server info, listeners, clusters, certificates, stats and config dump.

The admin interface is a small HTTP server inside the Arion process that answers questions about its live state — is it ready, what is it listening on, which upstreams are healthy, what configuration is active. Use it for health probes, Prometheus scraping and hands-on debugging.

## Enable it

Add the `admin` block to the bootstrap. The address is the only supported field:

```yaml,name=arion.yaml,arion=fragment
envoy_bootstrap:
  admin:
    address:
      socket_address: { address: 127.0.0.1, port_value: 9901 }
```

Without this block no admin server starts. It runs on the services runtime, separate from the proxy workers, so an admin query does not steal time from traffic.

> [!WARNING]
> The admin interface has no authentication and exposes configuration details; `/reset_counters` even mutates state. Bind it to `127.0.0.1` or a private management network and never expose the port publicly. Envoy's `allow_paths` restriction is not supported, so there is no built-in way to limit which endpoints are reachable.

## Endpoints

`GET` unless noted. Some endpoints exist only when the binary was built with the matching feature — `/help` always reflects what your build actually has.

| Path | Build feature | Description |
| --- | --- | --- |
| `/` | — | HTML console linking every command. |
| `/help` | — | Plain-text list of the endpoints compiled into this binary. |
| `/ready` | — | `200 LIVE` once the proxy runtimes are up; `503` before that. Use it as a readiness probe. |
| `/server_info` | — | JSON: version (`arion/x.y.z`), state, uptime, concurrency, node id and cluster. |
| `/listeners` | — | Active listeners, one `name::address` per line. |
| `/clusters` | — | Envoy-style cluster status: per-endpoint health and, in a metrics build, connection/request counters. |
| `/certs` | — | JSON summary of the certificates and CAs currently referenced by listeners and clusters. |
| `/memory` | — | JSON allocator numbers: `physical`, `heap_size`, `allocated`. |
| `/config_dump` | `config-dump` | JSON dump of the bootstrap plus the live listeners, routes and clusters. TLS private keys are redacted. |
| `/stats` | `metrics` | All statistics in a plain-text canonical form. |
| `/stats/prometheus` | `prometheus` | The same statistics in Prometheus exposition format — point your scraper here. |
| `/reset_counters` (POST) | `metrics` | Zeroes all counters and returns `OK`. Handy while measuring by hand. |

## Verify

```bash
curl -i http://127.0.0.1:9901/ready
```

Expected: `HTTP/1.1 200 OK` with body `LIVE`. Then `curl http://127.0.0.1:9901/help` to see which optional endpoints your build includes.

## Limits

- Only `admin.address` with a `socket_address` is supported; `access_log`, `profile_path`, `socket_options`, `ignore_global_conn_limit` and `allow_paths` from Envoy's admin config are rejected at load.
- There is no TLS and no authentication on the admin port — isolation is your responsibility.
- `/config_dump`, `/stats`, `/stats/prometheus` and `/reset_counters` return 404 on binaries built without their feature.
- Live config queries are answered by one proxy runtime with a five-second budget; on an extremely busy process a query can time out and return partial output.

The full request and response shapes are documented in the [admin API reference](@/reference/observability/admin-api.md).