Monitor an instance

The authorization server exposes health checks and Prometheus metrics over HTTP and writes its logs to standard output. Use this page to wire them into your monitoring. To send traces, metrics and logs to your own OpenTelemetry collector instead, see Telemetry export.

Set one value. Run the blocks below in order in one shell. Each one checks the answer it gets.

export POLICYARC_URL="https://your-environment.example"

Health

for path in /actuator/health /actuator/health/liveness /actuator/health/readiness; do
  curl -fsS "$POLICYARC_URL$path" | jq -e '.status == "UP"' >/dev/null || { echo "Expected UP from $path" >&2; false; }
done

Path	Use it for
/actuator/health/liveness	A liveness probe. The Helm chart uses it.
/actuator/health/readiness	A readiness probe. The Helm chart uses it.
/actuator/health	The overall status. It includes the database check. A caller without credentials sees the status only, not the details.

These paths answer without a key. See Harden an instance.

Metrics

/actuator/prometheus serves metrics in the Prometheus text format. It answers without a key, so scrape it from inside your network and block it at your proxy.

Every series carries two labels, application and instance. instance is the value of INSTANCE_NAME, local by default. The Helm chart sets it.

This block registers a client, which makes the server ask the policy engine for a decision, and then reads two series.

curl -fsS -o /dev/null -X POST "$POLICYARC_URL/register" -H 'Content-Type: application/json' \
  -d '{"client_name": "metrics-check", "redirect_uris": ["https://metrics-check.example/cb"]}'
metrics=$(curl -fsS "$POLICYARC_URL/actuator/prometheus")
grep -q '^http_server_requests_seconds_count{' <<<"$metrics" || { echo 'Expected http_server_requests_seconds_count' >&2; false; }
grep '^opa_evaluation_seconds_count{' <<<"$metrics" | grep -q 'path="/v1/data/oauth/register"' ||
  { echo 'Expected an opa_evaluation_seconds series for the register policy' >&2; false; }

Series	Labels	What to watch
http_server_requests_seconds	uri, method, status, outcome	Latency and error rate per route. A rise in status="500" on /token can mean the audit log cannot be written. See Audit log. A rise in status="429" means clients hit the rate limit.
opa_evaluation_seconds	path, outcome	Time each call to the policy engine takes. outcome="error" counts calls that failed, such as an unreachable policy engine.
hikaricp_connections_active, hikaricp_connections_pending	pool	Database connections in use and requests waiting for one

The server also serves the standard JVM, Tomcat and process series.

Logs

With any Spring profile except dev, the server writes one JSON object per line to standard output. Collect it with your platform's log collector. This line is from a refused token request.

{"@timestamp":"2026-10-13T19:13:20.235140511Z","@version":"1","message":"Token decision: error","logger_name":"com.identos.pbac.oauth.service.TokenService","thread_name":"http-nio-8080-exec-9","level":"WARN","level_value":30000,"lokiUrl":"http://localhost:3100","instanceName":"local","appName":"pbac-authorization-server","request_id":"61923f07-da51-4f1f-ac15-a4f547d12fc2","client_id":"nobody","event":"token_decision","outcome":"error","client_id":"nobody","grant_type":"client_credentials","reason":"invalid_client: Unknown client_id — client has not been registered or was deleted"}

Each line also carries lokiUrl, instanceName and appName from the logging configuration. A line written while a request runs carries its request_id. It matches the requestId of the audit log row that request wrote. Decision lines carry event, and most carry outcome and reason.

event	Written when
token_decision	/token allows, denies or fails a request
authorize_decision	/authorize allows, denies or fails a request
introspect_decision	/introspect answers
register_decision	/register allows or denies a client
evaluation_decision	An AuthZEN evaluation answers
callback_result	An identity provider returns a user
auth_failure	A call fails the admin key check on /admin/**, the bundle key check on /bundles/** or the credential check on /access/**. The filter field says which.
admin_mutation	An administrator changes something

To alert on refused admin calls, count auth_failure lines whose filter is admin_api_key. To alert on a policy engine outage, watch opa_evaluation_seconds_count{outcome="error"}.

On a hosted environment

PolicyArc runs the server. Use Telemetry export to send telemetry to your collector, and the audit log to see each decision.