The admin API is a small HTTP server for inspecting a running Arion; it is off unless the bootstrap configures it.
Enabling the admin listener
Add admin to envoy_bootstrap with a socket address. Only address is accepted — admin access logs, profile_path, socket_options and allow_paths are not supported.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
address.socket_address.address | string | yes | — | IP to bind; keep it on loopback or a management network. |
address.socket_address.port_value | uint16 | yes | — | Port to bind (9901 by convention). |
envoy_bootstrap:
admin:
address:
socket_address:
address: 127.0.0.1
port_value: 9901The admin server has no authentication or TLS. Do not expose it beyond localhost or a trusted management network.
Endpoints
| Endpoint | Method | Returns | Notes |
|---|---|---|---|
/ | GET | HTML | Console page linking every enabled endpoint. |
/help | GET | text | Plain-text list of the enabled endpoints. |
/ready | GET | text | 200 with body LIVE once the proxy is serving; 503 before that. Use it as a readiness probe. |
/server_info | GET | JSON | version (arion/<semver>), state, uptime_current_epoch, uptime_all_epochs, command_line_options.concurrency, node.id, node.cluster. |
/listeners | GET | text | One name::address line per active listener (internal listeners print an empty address). |
/clusters | GET | text | Envoy-style cluster::key::value lines: per-priority circuit-breaker thresholds (max_connections, max_pending_requests, max_requests, max_retries), added_via_api::false, then per-endpoint lines (cx_*, rq_*, hostname, health_flags, weight, priority, success_rate::-1). Connection and request counters are tracked per cluster, so every endpoint of a cluster repeats the cluster-wide totals; hostname is filled only for STRICT_DNS clusters. |
/certs | GET | JSON | certificates array with the certificate chains and CA bundles referenced by name from listeners and clusters; each certificate reports path, serial_number, subject_alt_names, valid_from, expiration_time and days_until_expiration. |
/memory | GET | JSON | physical, heap_size and allocated bytes. Heap and allocated need the jemalloc build feature; otherwise they fall back to the physical size. |
/config_dump | GET | JSON | The loaded bootstrap plus the live listeners, routes, clusters, endpoints and secrets. Private keys are replaced with [redacted]. Requires the config-dump build feature. |
/stats | GET | text | The built-in metric families in Envoy-canonical form, family.<labels>.name: value; histograms print _sum and _count. Requires the metrics build feature. |
/stats/prometheus | GET | text | The same metrics in Prometheus text format 0.0.4 — the scrape target for Prometheus. Requires the prometheus build feature. See the metrics list. |
/reset_counters | POST | text | Resets all metric counters to zero and answers OK. Requires the metrics build feature. |
Build features
Some endpoints exist only when Arion is compiled with the matching Cargo feature; the / and /help listings show only what the build includes.
| Feature | Adds | Notes |
|---|---|---|
config-dump | /config_dump | Off by default. |
metrics | /stats, /reset_counters | Off by default; also enables metric collection itself. |
prometheus | /stats/prometheus | Off by default; implies metrics. |
Verify
curl -s http://127.0.0.1:9901/readyLIVE