Spring Boot Actuator: which endpoints are exposed and how to lock them

By default Spring Boot exposes only the health Actuator endpoint over HTTP and JMX. Problems start when someone sets exposure to everything. Keep the include list short, restrict access per endpoint, and put anything sensitive behind authentication, ideally with a firewall in front as well.

Exposure and access are two different controls

The Spring Boot reference (the page I read was for 4.1.1) separates them. Exposure decides which endpoints are reachable over a technology. Access decides what an endpoint may do.

Exposure properties:

management.endpoints.web.exposure.include=health,info
management.endpoints.web.exposure.exclude=env,beans

The docs say exclude takes precedence over include, and that * selects all endpoints, which must be quoted in YAML. The matching JMX properties use jmx in place of web.

Access properties let you set each endpoint to unrestricted, read-only or none. The docs describe an opt-in model:

management.endpoints.access.default=none
management.endpoint.loggers.access=read-only

There is also management.endpoints.access.max-permitted, an application wide ceiling. Per the docs, inaccessible endpoints are removed from the application context entirely.

Before you widen exposure

The docs list three checks: confirm the endpoints do not leak sensitive data, that they sit behind a firewall, or that they are secured, for example with Spring Security.

The risky ones

• env and configprops. Values are sanitized by default. The show-values property accepts never, always or when-authorized, and roles limits who counts as authorized. Prefer when-authorized with a narrow role over always.
• heapdump. It returns a heap dump, which can contain secrets and personal data. The docs say it is restricted by default and should be exposed only deliberately, behind authentication.
• shutdown. Disabled by default. Enabling it takes explicit access configuration, and the docs say to protect it with Spring Security or internal network limits.

Spring Security

If Spring Security is on the classpath and you define no other SecurityFilterChain, Boot secures all actuator endpoints except /health. The catch: defining your own chain turns that default off, so you must add a chain covering actuator paths yourself, for example matching with EndpointRequest and requiring a role. CSRF protection is on by default, so POST, PUT and DELETE to endpoints return 403 for clients without a token. The docs say to disable CSRF only for services used by non-browser clients.

A separate management port

management.server.port puts Actuator on its own port, which makes network rules easier. The docs say the Kubernetes probes should not run only there, since a probe can pass while the main app fails.

Checklist

1. Search config for exposure.include=*.
2. Remove heapdump, env, beans unless you truly need them.
3. Set default access to none and opt in.
4. Confirm a security chain covers actuator paths after any custom config.

Quick check

Sources

• Spring Boot Actuator endpoints

Last reviewed: 19 October 2026.