Endpoints
Everything below is served by the same HTTP listener as the browser client, on
FANOUT_HTTP_ADDR (:7520 by default).
This page covers the operational endpoints and what they are for. For the complete surface — every route with the exact credential it requires, taken from the middleware that enforces it — see HTTP routes.
Health
Section titled “Health”| Path | Requires | Reports |
|---|---|---|
/healthz | nothing | Liveness — the process is up |
/readyz | nothing | Readiness — storage is attached, plus resolved runtime sizing |
Both are deliberately unauthenticated: a probe that needs a credential is a
probe that fails for the wrong reason during an outage. Use /healthz for
restart decisions and /readyz for traffic decisions — an instance can be alive
while its storage is still coming up.
Operations
Section titled “Operations”| Path | Requires |
|---|---|
/-/metrics | operations:read, or a service credential |
/debug/pprof/* | operations:read |
/-/metrics is Prometheus exposition. It accepts a service credential as well
as an admin session, which is how a scraper reaches it without a browser login —
set FANOUT_METRICS_TOKEN. FANOUT_METRICS_PUBLIC=true removes the requirement
entirely, and Fanout logs a warning at startup when you do, because metrics
describe your traffic shape to anyone who asks.
/debug/pprof/* is off unless FANOUT_PPROF_ENABLED=true, and is admin-only
even then. Profiling output can contain memory contents, which is why it sits
behind operations:read rather than telemetry:read.
Protocol
Section titled “Protocol”| Path | Purpose |
|---|---|
/mcp | The MCP endpoint external agents connect to |
/.well-known/* | OAuth discovery for MCP clients |
/oauth/register, /oauth/token | OAuth client registration and token issue |
Ingest
Section titled “Ingest”Telemetry does not arrive on this listener. OTLP has its own two:
FANOUT_OTLP_GRPC_ADDR (:4317) and FANOUT_OTLP_HTTP_ADDR (:4318), both
requiring the ingest token. See send your first
telemetry.
For OTLP/HTTP, exporters derive /v1/traces, /v1/metrics and /v1/logs from
the base endpoint themselves — give the exporter http://host:4318, not a
signal path.
What to alert on
Section titled “What to alert on”The endpoints tell you the instance is up; the metrics tell you whether it is coping. Watch repeated restarts, readiness failures, ingest authentication failures, telemetry drops, sustained query latency, and free disk space. Troubleshooting covers what each one usually means.