This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-2-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-2-test by this push:
new e83f46855e7 [v3-2-test] Update health endpoint in security docs
(#66701) (#66739)
e83f46855e7 is described below
commit e83f46855e77d0716a7de942b3f29a827567758f
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue May 12 04:39:05 2026 +0200
[v3-2-test] Update health endpoint in security docs (#66701) (#66739)
Airflow 3 serves webserver health status at /api/v2/monitor/health, so
update the security model documentation to avoid pointing readers at the legacy
/health path.
Closes #49683
(cherry picked from commit ef695fa9217a48c30963a5502c051ba6341dc021)
Co-authored-by: Kyu Park <[email protected]>
Co-authored-by: Jarek Potiuk <[email protected]>
---
airflow-core/docs/security/security_model.rst | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/airflow-core/docs/security/security_model.rst
b/airflow-core/docs/security/security_model.rst
index 46bf7ab8b62..e7a95d44db7 100644
--- a/airflow-core/docs/security/security_model.rst
+++ b/airflow-core/docs/security/security_model.rst
@@ -92,9 +92,9 @@ Non-authenticated UI users
Airflow doesn't support unauthenticated users by default. If allowed,
potential vulnerabilities
must be assessed and addressed by the Deployment Manager. However, there are
exceptions to this.
-The ``/health`` endpoint responsible to get health check updates should be
publicly accessible.
-This is because other systems would want to retrieve that information. Another
exception is the
-``/login`` endpoint, as the users are expected to be unauthenticated to use it.
+The ``/api/v2/monitor/health`` endpoint responsible for health check updates
should be publicly
+accessible. This is because other systems would want to retrieve that
information. Another exception
+is the ``/login`` endpoint, as the users are expected to be unauthenticated to
use it.
Capabilities of authenticated UI users
--------------------------------------
