---
title: "Admin API"
url: "/reference/observability/admin-api/"
kind: "reference"
summary: "The admin listener's endpoints: readiness, server info, listeners, clusters, certificates, memory, config dump, stats and counter reset."
---

> Arion site index: [/llms.txt](/llms.txt)

# Admin API

The admin listener's endpoints: readiness, server info, listeners, clusters, certificates, memory, config dump, stats and counter reset.

The admin API is a small HTTP server for inspecting a running Arion; it is off unless the bootstrap configures it.

## Enabling the admin listener

Add `admin` to `envoy_bootstrap` with a socket address. Only `address` is accepted — admin access logs, `profile_path`, `socket_options` and `allow_paths` are not supported.

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `address.socket_address.address` | string | yes | — | IP to bind; keep it on loopback or a management network. |
| `address.socket_address.port_value` | uint16 | yes | — | Port to bind (9901 by convention). |

```yaml,arion=fragment
envoy_bootstrap:
  admin:
    address:
      socket_address:
        address: 127.0.0.1
        port_value: 9901
```

> [!WARNING]
> The admin server has no authentication or TLS. Do not expose it beyond localhost or a trusted management network.

## Endpoints

| Endpoint | Method | Returns | Notes |
|---|---|---|---|
| `/` | GET | HTML | Console page linking every enabled endpoint. |
| `/help` | GET | text | Plain-text list of the enabled endpoints. |
| `/ready` | GET | text | `200` with body `LIVE` once the proxy is serving; `503` before that. Use it as a readiness probe. |
| `/server_info` | GET | JSON | `version` (`arion/<semver>`), `state`, `uptime_current_epoch`, `uptime_all_epochs`, `command_line_options.concurrency`, `node.id`, `node.cluster`. |
| `/listeners` | GET | text | One `name::address` line per active listener (internal listeners print an empty address). |
| `/clusters` | GET | text | Envoy-style `cluster::key::value` lines: per-priority circuit-breaker thresholds (`max_connections`, `max_pending_requests`, `max_requests`, `max_retries`), `added_via_api::false`, then per-endpoint lines (`cx_*`, `rq_*`, `hostname`, `health_flags`, `weight`, `priority`, `success_rate::-1`). Connection and request counters are tracked per cluster, so every endpoint of a cluster repeats the cluster-wide totals; `hostname` is filled only for `STRICT_DNS` clusters. |
| `/certs` | GET | JSON | `certificates` array with the certificate chains and CA bundles referenced by name from listeners and clusters; each certificate reports `path`, `serial_number`, `subject_alt_names`, `valid_from`, `expiration_time` and `days_until_expiration`. |
| `/memory` | GET | JSON | `physical`, `heap_size` and `allocated` bytes. Heap and allocated need the `jemalloc` build feature; otherwise they fall back to the physical size. |
| `/config_dump` | GET | JSON | The loaded bootstrap plus the live listeners, routes, clusters, endpoints and secrets. Private keys are replaced with `[redacted]`. Requires the `config-dump` build feature. |
| `/stats` | GET | text | The built-in metric families in Envoy-canonical form, `family.<labels>.name: value`; histograms print `_sum` and `_count`. Requires the `metrics` build feature. |
| `/stats/prometheus` | GET | text | The same metrics in Prometheus text format 0.0.4 — the scrape target for Prometheus. Requires the `prometheus` build feature. See the [metrics list](@/reference/observability/metrics-list.md). |
| `/reset_counters` | POST | text | Resets all metric counters to zero and answers `OK`. Requires the `metrics` build feature. |

## Build features

Some endpoints exist only when Arion is compiled with the matching Cargo feature; the `/` and `/help` listings show only what the build includes.

| Feature | Adds | Notes |
|---|---|---|
| `config-dump` | `/config_dump` | Off by default. |
| `metrics` | `/stats`, `/reset_counters` | Off by default; also enables metric collection itself. |
| `prometheus` | `/stats/prometheus` | Off by default; implies `metrics`. |

## Verify

```bash
curl -s http://127.0.0.1:9901/ready
```

```text
LIVE
```