Every refusal is a 404
A wrong token, a disabled endpoint and a path that does not exist all answer 404. Nothing advertises that there is a secret here worth guessing.That means a monitoring check reporting 404 has four possible causes, and the gateway will not tell
you which: wrong token, admin token unset, admin token equal to the read token, or genuinely wrong
path. Check the tokens on both sides before concluding the gateway is down.
What is not on this port
/openapi.json, /swagger-ui and /ping live on the messaging port. Pointing a tool at the wrong
one produces 404s that look like an outage.
/ops/health
The payload carries, at the top level: the running version, configuration sources per domain, router
queue depth, awaiting-receipt count, CDR counters, the broker queue depth when one is configured, and
a balance section when credit enforcement is on.
Per worker it carries accepting, paused, suspended_manually, suspended_automatically, bound,
bound_transmittable, queue_depth, retry_queue_depth, tps_limit, tps_measured, submitted,
last_error with its timestamp, last_submit_error with submit_rejected, a sample of sessions
capped at 20, and sessions_total.
See Live health for how to read it, and
The operational endpoint for the tokens.