This page lists every endpoint on the operator HTTP listener, from internal/opsapi and internal/opsview.
| Property |
Value |
| Protocol |
Plain HTTP over TCP, separate from the libp2p protocols |
| Default bind |
127.0.0.1:9090 (ops.bind, ops.port) |
| Enabled |
ops.enabled, default true; a bind failure fails startup |
| Started |
After the P2P stack and services, so /readyz answers only once the server can serve |
| Methods |
GET and HEAD only; any other method gets 405 with Allow: GET, HEAD |
| Authentication |
None; the /ops/* views name peer IDs, so keep the listener on loopback or behind an authenticating proxy |
| Server timeouts |
Read header 5 s, write 2 min, idle 60 s |
| Path |
Mounted when |
Content type |
Purpose |
/ |
Always |
text/plain |
Index: ricochet operator surface, then every mounted path, one per line |
/healthz |
Always |
JSON |
Liveness; touches no dependency |
/readyz |
Always |
JSON |
Readiness; pings PostgreSQL, unready while draining |
/metrics |
features.enable_metrics |
Prometheus text |
Metrics from the server’s own registry |
/debug/pprof/ |
ops.enable_pprof |
Go pprof |
Profiles; also serves /debug/pprof/cmdline, /profile, /symbol, /trace |
/ops/mailboxes/top |
Storage initialised |
JSON |
Fullest mailboxes across every owner |
/ops/mailboxes |
Storage initialised |
JSON |
One owner’s mailboxes |
/ops/storage |
Storage initialised |
JSON |
Per-owner totals and the sampled server-wide figures |
/ops/limits |
Storage initialised |
JSON |
Effective admission, rate-limit and storage limits |
Always 200.
| Field |
Type |
Meaning |
status |
string |
ok |
uptimeSeconds |
float |
Seconds since the listener was built |
200 when ready, 503 when a check fails or the server is draining. Checks are bounded by ops.readiness_timeout (default 2 s).
| Field |
Type |
Meaning |
ready |
bool |
The verdict |
draining |
bool, optional |
Present and true once shutdown has begun |
checks |
object |
{"postgres": {"ok": <bool>, "error": <string, optional>}} |
details |
object |
Diagnostics that do not affect the verdict (below) |
details key |
Content |
uptimeSeconds |
Seconds since the server started |
admission |
enabled, maxInFlight, maxPerPeer, inFlight, admittedTotal, shedTotal, waitedTotal, acquireTimeout; only {"enabled": false} when admission control is off |
mailboxCache |
size, capacity |
postgresPool |
totalConns, idleConns, acquiredConns, maxConns, emptyAcquireCount, canceledAcquire |
| Query parameter |
Default |
Meaning |
n |
20 |
Page size; at most 500 |
limit |
none |
Same as n; wins when both are given |
offset |
0 |
Rows to skip |
sort |
fill |
fill (closest to its cap first) or count (most messages first) |
Response: sort, limit, offset, count, mailboxes. Each mailbox: id, owner, folderPath, messageCount, maxMessages, fillRatio, full, messageBytes, lastMessageAt (optional).
| Query parameter |
Default |
Meaning |
owner |
required |
Peer ID; a missing or malformed one gets 400 |
limit |
20 |
Page size; at most 500 |
offset |
0 |
Rows to skip |
Response: as /ops/mailboxes/top, plus owner, sorted by fill.
| Query parameter |
Default |
Meaning |
limit |
20 |
Owners per page; at most 500 |
offset |
0 |
Owners to skip |
| Field |
Content |
server |
null until the first capacity sample, then sampledAt, ageSeconds, mailboxes, messages, messageBytes, databaseBytes, maxStorageBytes, availableBytes, mailboxesNearCapacity, nearCapacityRatio, depth ([{label, min, max, mailboxes}]) |
note |
Present when server is null, saying why |
limit, offset |
The page |
owners |
[{owner, mailboxes, messages, messageBytes}], live |
No parameters. Every value is the effective one after defaults and derivations.
| Field |
Content |
admission |
enabled, maxInFlight, maxInFlightDerivedFromPoolSize, databasePoolSize, maxInFlightPerPeer, acquireTimeout |
rateLimits |
window, enabledProtocols, protocols: for each of msa, msa_batch, maa, mma, sda, sfa, sca, mta, the buckets requests, read, write, each {rate, burst, enabled, per} |
storage |
maxStorageBytes, maxMessagesPerMailbox, maxMailboxes, retentionPolicy |
| Status |
When |
Body |
400 |
Bad query parameter (not an integer, negative, bad sort, bad owner) |
{"error": <string>} |
404 |
Unknown path |
Plain text |
405 |
Method other than GET or HEAD |
Plain text |
500 |
Query failed; detail in the server log |
{"error": "<query> failed; see server log"} |
504 |
Query exceeded ops.query_timeout (default 10 s) |
{"error": "<query> timed out"} |
See Health & readiness and Metrics & the ops view.
