Endpoints
Everything below is served by the same HTTP listener as the browser client, on
FANOUT_ADDR (127.0.0.1:7520 by default; the image sets :7520).
HTTP routes lists every route and the credential it requires.
Health
Section titled “Health”| Path | Requires | Reports |
|---|---|---|
/healthz | nothing | Liveness — the process is up |
/readyz | nothing | Readiness — storage is attached, plus resolved runtime sizing |
Use /healthz for restart decisions and /readyz for traffic decisions.
Operations
Section titled “Operations”| Path | Requires |
|---|---|
/metrics | operations:read, or a service credential |
/debug/pprof/* | operations:read |
/metrics is Prometheus exposition. It accepts a service credential as well
as an admin session, which is how a scraper reaches it without a browser login;
set FANOUT_METRICS_TOKEN. FANOUT_METRICS_PUBLIC=true permits unauthenticated
scrapes and emits a startup warning.
Metrics reveal traffic volumes, query activity and resource use. Keep /metrics
private or authenticate scrapes with FANOUT_METRICS_TOKEN.
/debug/pprof/* is off unless FANOUT_PPROF_ENABLED=true, and is admin-only
even then. Profiling output can contain memory contents, which is why it sits
behind operations:read rather than telemetry:read.
Protocol
Section titled “Protocol”| Path | Purpose |
|---|---|
/mcp | The MCP endpoint external agents connect to |
/.well-known/* | OAuth discovery for MCP clients |
/oauth/register, /oauth/token | OAuth client registration and token issue |
Ingest
Section titled “Ingest”Both OTLP transports share FANOUT_ADDR with the application and require
Authorization: Bearer <ingest-token>. Browser sessions and MCP OAuth tokens
cannot authorize ingest, and an ingest token cannot authorize browser API calls.
| Transport | Endpoint |
|---|---|
| OTLP/gRPC | Same host and port, using HTTP/2 |
| OTLP/HTTP | POST /v1/traces, POST /v1/metrics, POST /v1/logs |
For OTLP/HTTP, give a general exporter endpoint the base URL
http://host:7520. Signal-specific endpoint settings include the full signal
path. Unknown /v1/* paths return 404 and unsupported methods return 405,
without falling through to the browser application. The HTTP handler accepts
protobuf and gzip, with a 64 MiB decompressed body limit.
See send your first telemetry.
What to alert on
Section titled “What to alert on”The endpoints tell you the instance is up; the metrics tell you whether it is coping. Watch repeated restarts, readiness failures, ingest authentication failures, telemetry drops, sustained query latency, and free disk space. Troubleshooting covers what each one usually means.