Dashboard Web UI

The MassTransit dashboard provides a web UI for inspecting bus topology and runtime state.

Early Access

The dashboard is an early-access preview in MassTransit v9.2.0 and remains under active development.

This preview is intended to help customers evaluate the experience and provide feedback before the dashboard reaches a more complete release state.

The dashboard is transport-aware and only shows features supported by the selected bus and transport:

• Bus overview, endpoint details, and start/stop controls for Receive endpoints
• Topics/Exchanges, Subscriptions/Bindings, and Queue topology views
• Health status for configured buses and endpoints
• State machine graph visualization
• Jobs and job types when a job metadata explorer is registered
• Metrics and flow visualizations when explicitly enabled

Introduction VideoA video introducing the dashboard preview

Transport support

Some capabilities depend on transport metadata support. For example, topology and message operations may vary between transports.

The following matrix reflects the current dashboard capability flags used by the MassTransit dashboard implementation.

View	RabbitMQ	Azure SB	SQS/SNS	SQL
Dashboard	Yes	Yes	Yes	Yes
Health	Yes	Yes	Yes	Yes
Overview	Yes	Yes	Yes	Yes
Queues	Yes	Yes	Yes	Yes
Sources	Yes	Yes	Yes	Yes
Subscriptions	Yes	Yes	Yes	Yes
Topology graph	Yes	Yes	Yes	Yes
Messages	Yes	Yes	No	Yes
Fault inbox	Yes	Yes	No	Yes
Bulk fault requeue	Yes	Yes	No	Yes
Message archive	No	No	No	Yes

Operator actions support

The page matrix above describes page visibility and major feature areas. The following matrix calls out the current operator actions exposed by the dashboard backend APIs.

Action	RabbitMQ	Azure SB	SQS/SNS	SQL
Requeue fault group	Yes	Yes	No	Yes
Purge fault group	No	No	No	Yes
Requeue single message	Yes	Yes	No	Yes
Bulk requeue	Yes	Yes	No	Yes
Purge queue	Yes	No	Yes	Yes
Purge error queue	Yes	No	Yes	Yes
Purge dead-letter queue	Yes	No	Yes	Yes
Purge archive queue	No	No	No	Yes

Note

In the current preview, some UI actions may appear more broadly than the backend supports. The matrix above reflects the backend behavior used by the dashboard APIs.

Access requirements

The dashboard queries broker metadata from the application hosting the dashboard, using the bus’s transport configuration and credentials.

Even though saga state machine and consumer details may be available, that does not mean that the overview, queues, topics, exchanges, bindings, subscriptions, and message views are functional if the transport-specific configuration requirements are not met.

RabbitMQ

RabbitMQ topology, queue counts, and message inspection use the rabbitmq_management HTTP API, not the AMQP connection. Enable the plugin (rabbitmq-plugins enable rabbitmq_management) and allow outbound access from the dashboard application to its API listener. The usual HTTP port is 15672 (separate from AMQP 5672); RabbitMQ’s usual HTTPS management port, if configured, is 15671. Opening the AMQP port alone is not enough, be sure to check the management listener and port on your broker or proxy.

The dashboard uses the bus’s RabbitMQ settings to connect to the management API. See RabbitMQ transport options for the management address, scheme, and credentials it uses. If the broker-specific views fail to load, test the management API URL from the dashboard application’s network, and check listener availability, firewall rules, TLS/port alignment, and HTTP authentication/authorization separately from AMQP connectivity. See RabbitMQ management plugin for listener and user-tag setup.

When the AMQP and management API listeners use different hostnames or protocols, set ManagementHost to the management API’s HTTP(S) origin. For example, to connect to AMQP on port 5672 and the management API on a separate HTTPS host:

builder.Services.AddMassTransit(x =>
{
    x.AddOptions<RabbitMqTransportOptions>().Configure(options =>
    {
        options.Host = "amqp.example.com";
        options.Port = 5672;
        options.ManagementHost = "http://admin.example.com";
    });

    x.UsingRabbitMq((context, cfg) => cfg.ConfigureEndpoints(context));
});

A bare ManagementHost such as admin.example.com follows the bus SSL setting for HTTP or HTTPS and uses ManagementPort (15672 for HTTP, or 15671 when UseSsl is enabled). If the URL omits a port, an explicitly configured ManagementPort is used; if it includes a port, that port takes precedence. The management URL does not change the AMQP connection.

RabbitMQ dashboard permissions

The broker user needs a management user tag or a tag that includes its privileges, plus permissions on the bus’s virtual host. A user with no management-capable tag can connect over AMQP but cannot use the management API. The management tag allows viewing queues, exchanges, and bindings in virtual hosts to which the user has access; monitoring or administrator also work but grant broader visibility.

For message inspection (POST /api/queues/{vhost}/{queue}/get), grant read permission on the relevant queues. Queue purging needs read permission on those queues; requeue operations use AMQP and require the normal read/write (and any topology configuration) permissions of the bus user. Scope permissions to the main, error, and dead-letter queues that operators will inspect or act on. A monitoring-only user with empty resource permissions can see metadata but cannot inspect or purge messages.

The guest account is normally restricted to localhost and is unsuitable for a remote dashboard host.

Azure Service Bus

The dashboard uses the bus’s Service Bus namespace and credentials to query queues, topics, subscriptions, and message counts through the Service Bus administration client. Manage access is required by MassTransit, and the same applies to the dashboard.

Amazon SQS/SNS

The dashboard uses the configured bus’s AWS credentials and region to call the SQS and SNS APIs. In addition to the permissions in the Amazon SQS/SNS IAM policy example, grant the IAM principal these actions:

View or action	Required IAM actions
Queues, queue counts, overview	sqs:ListQueues
Subscriptions/bindings	sns:ListSubscriptions

Allow these list actions on * as required by AWS. The linked policy example covers the attribute and purge actions used by the other dashboard views and operator actions. SQS/SNS does not support individual message inspection or requeue through the dashboard.

SQL Transport (PostgreSQL and SQL Server)

No additional configuration is required for the SQL transport to use the dashboard.

Configure the dashboard

Security Warning

Do not expose the dashboard to the public Internet or deploy it on any host that is reachable without authentication.

Treat the dashboard as an operator surface. Restrict access to trusted users only, require authentication, and enforce authorization policy in any shared, staging, or production environment.

To use the dashboard, add the MassTransit.AspNetCore package and configure it in your ASP.NET Core application.

using MassTransit;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddMassTransit(x =>
{
    x.UsingRabbitMq((context, cfg) =>
    {
        cfg.ConfigureEndpoints(context);
    });
});

builder.Services.AddBusMetadataExplorer();

builder.Services.AddMassTransitDashboard(options =>
{
    options.Metrics.Enabled = true;
    options.Flow.Enabled = true;
});

var app = builder.Build();

app.UseMassTransitDashboard();

app.Run();

By default, the dashboard is available at /masstransit.

Configure dashboard options

Property	Default	Description
BasePath	“masstransit”	URL base path used to host the dashboard UI and API
RequireAuthorization	false	Requires authenticated users for dashboard access
AuthorizationPolicy	null	Optional ASP.NET Core authorization policy for dashboard API routes
Telemetry.ChannelCapacity	50000	In-memory channel capacity for dashboard telemetry events (for metrics and flow)
Metrics.Enabled	false	Enables metrics collection and metrics streaming endpoints
Metrics.WindowSeconds	300	Sliding window length used for metrics snapshots
Metrics.BucketSeconds	5	Bucket size used to aggregate metrics data
Metrics.StreamIntervalSeconds	5	Server-sent event (SSE) publish interval for metrics streams
Metrics.InactiveEvictionSeconds	900	Idle eviction timeout for metrics state
Metrics.MaxEndpointsPerBus	256	Maximum endpoints tracked for metrics per bus
Metrics.MaxComponentsPerBus	512	Maximum components tracked for metrics per bus
Metrics.MaxComponentEndpoints	16	Maximum endpoints linked to a single component
Flow.Enabled	false	Enables conversation flow graph snapshots and streaming
Flow.InactiveEvictionSeconds	900	Idle eviction timeout for flow state
Flow.MaxNodesPerBus	512	Maximum flow graph nodes tracked per bus
Flow.MaxEdgesPerBus	2048	Maximum flow graph edges tracked per bus
Flow.MaxConversationLinksPerBus	10000	Maximum conversation links tracked per bus
Flow.MaxEdgeMessageTypes	8	Maximum message types tracked per flow edge

Configure job saga metadata

If you are using the job service (see Job Consumer), the dashboard can display job metadata. The dashboard requires a job metadata explorer to query the job saga repository.

The following sections describe how to register a job metadata explorer for the supported job saga repository.

Entity Framework Core

For an EF Core job saga repository, use AddJobMetadataExplorer<TDbContext>() from the MassTransit.EntityFrameworkCore package:

builder.Services.AddBusMetadataExplorer();

builder.Services.AddJobSagaStateMachines()
    .EntityFrameworkRepository(r =>
    {
        r.ExistingDbContext<JobServiceSagaDbContext>();
        r.UsePostgres();
        r.IsolationLevel = IsolationLevel.ReadCommitted;
    });

builder.Services.AddJobMetadataExplorer<JobServiceSagaDbContext>();

Configure authorization

The dashboard must not be exposed on public or unauthenticated sites. Require authentication and enforce an authorization policy before enabling it anywhere outside local development.

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("DashboardOperators", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.RequireRole("Operations");
    });
});

builder.Services.AddBusMetadataExplorer();

builder.Services.AddMassTransitDashboard(options =>
{
    options.BasePath = "/ops/masstransit";
    options.RequireAuthorization = true;
    options.AuthorizationPolicy = "DashboardOperators";
    options.Metrics.Enabled = true;
    options.Flow.Enabled = true;
});

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
app.UseMassTransitDashboard();

When RequireAuthorization is enabled, unauthenticated requests to the dashboard base path return 401 Unauthorized.

If the host is reachable without authentication, do not enable the dashboard.

Configure from appsettings.json

Dashboard options can be bound using the ASP.NET Core options pattern.

{
  "MassTransit": {
    "Dashboard": {
      "BasePath": "/masstransit",
      "RequireAuthorization": true,
      "AuthorizationPolicy": "DashboardOperators",
      "Metrics": {
        "Enabled": true,
        "WindowSeconds": 300
      },
      "Flow": {
        "Enabled": true
      }
    }
  }
}

builder.Services.AddOptions<MassTransitDashboardOptions>()
    .BindConfiguration("MassTransit:Dashboard");

builder.Services.AddBusMetadataExplorer();

builder.Services.AddMassTransitDashboard();