How Does Jupiter Respond To Prometheus Request

You've got Prometheus humming along, scraping targets left and right. Then someone asks: "Hey, can we pull metrics from Jupiter too?"

And you pause. Because "Jupiter" could mean three different things in this space, and the answer changes completely depending on which one you're actually running.

Let's sort that out first — then walk through what the handshake actually looks like on the wire.

What Is Jupiter in This Context

Before we talk about requests and responses, we need to agree on which Jupiter showed up to the party.

JupiterOne (the asset graph platform)

This is the one most infra teams run into. It has a metrics endpoint. On top of that, jupiterOne is a cybersecurity asset management platform — think CMDB on steroids, built around a graph database that maps every asset, user, policy, and relationship across your cloud accounts, SaaS tools, code repos, and more. Which means it has an API. It can talk to Prometheus.

Jupyter / JupyterHub (the notebook stack)

Totally different beast. If your data science team runs JupyterHub on Kubernetes, you might want Prometheus scraping the hub's built-in metrics endpoint (/hub/metrics or /metrics depending on version). That's a Python process exposing prometheus_client counters and gauges — notebook sessions, spawn failures, proxy latency, that sort of thing.

Jupiter (the Solana RPC framework)

Less common in enterprise monitoring, but real. If you're running a validator or RPC node that uses Jupiter's SDK, you might expose custom metrics for swap volume, route latency, or quote success rates. In real terms, jupiter Aggregator is a swap routing engine on Solana. Prometheus can scrape those if you've wired them up.

The rest of this article assumes JupiterOne — that's where the "how does it respond to a Prometheus request" question comes up most often in practice. But I'll flag the other two where the mechanics differ.

Why This Integration Exists At All

You already have Prometheus. Think about it: you already have JupiterOne. Why bridge them?

Simple: JupiterOne knows things Prometheus never will.

Prometheus excels at infrastructure* metrics — CPU, memory, request latency, error rates, queue depths. JupiterOne knows context*: which AWS account owns this EC2 instance, whether the security group allows SSH from the internet, whether the IAM role attached to that instance has AdministratorAccess, when the last vulnerability scan ran on the container image running inside it.

When you bring those worlds together, you can alert on meaningful* conditions: "Alert me when CPU spikes on instances that have critical vulnerabilities and public IPs*." That's a query you can't write in Prometheus alone. You need the graph context from JupiterOne.

So the integration isn't about duplicating metrics. It's about enriching them.

How the Request Actually Works

Here's the short version: Prometheus doesn't "request" JupiterOne in the traditional sense. JupiterOne doesn't run a /metrics endpoint that Prometheus scrapes directly. The architecture is pull → transform → push or pull → remote write, not pull → pull.

Let me break down the two patterns you'll actually see in production.

Pattern 1: JupiterOne Exporter (Community / Custom)

Someone — maybe your team, maybe a community contributor — writes a small Go or Python service that:

1. Authenticates to JupiterOne's GraphQL API (API token, scoped to read-only)
2. Runs a set of predefined J1QL queries on a schedule (every 30s, 60s, whatever)
3. Transforms the query results into Prometheus exposition format
4. Exposes /metrics on :9090/metrics (or whatever port)
5. Prometheus scrapes that exporter*, not JupiterOne directly

What the exporter's /metrics response looks like:

# HELP jupiterone_asset_count Total assets by class
# TYPE jupiterone_asset_count gauge
jupiterone_asset_count{class="aws_instance",account="prod-123"} 847
jupiterone_asset_count{class="aws_s3_bucket",account="prod-123"} 234
jupiterone_asset_count{class="github_repo",account="eng"} 156

# HELP jupiterone_finding_count Open findings by severity
# TYPE jupiterone_finding_count gauge
jupiterone_finding_count{severity="critical",source="aws_inspector"} 12
jupiterone_finding_count{severity="high",source="snyk"} 47

# HELP jupiterone_query_duration_seconds Time spent querying J1 API
# TYPE jupiterone_query_duration_seconds histogram
jupiterone_query_duration_seconds_bucket{le="1.0"} 42
jupiterone_query_duration_seconds_bucket{le="2.0"} 58
jupiterone_query_duration_seconds_bucket{le="5.0"} 65
jupiterone_query_duration_seconds_bucket{le="+Inf"} 65
jupiterone_query_duration_seconds_sum 89.4
jupiterone_query_duration_seconds_count 65

That's it. Standard Prometheus text format. The exporter is the target. JupiterOne just sits behind it, answering GraphQL queries.

Key detail: The exporter handles rate limiting, pagination, token refresh, and query timeouts. Prometheus doesn't know any of that exists. It just sees a healthy target returning 200 OK with metrics text.

Pattern 2: JupiterOne Managed Integration (Remote Write)

JupiterOne's newer managed integration flips the model. Instead of you running an exporter, JupiterOne pushes metrics to your Prometheus (or Prometheus-compatible) remote write endpoint.

Flow:

1. You configure a remote write URL in JupiterOne's UI (something like https://prometheus.example.com/api/v1/write)
2. You provide auth — usually a Bearer token or basic auth
3. JupiterOne runs its internal metric collection jobs (same J1QL queries, but managed by them)
4. On a schedule, JupiterOne batches the metrics into Prometheus remote write protobuf format (Snappy-compressed)
5. POSTs to your endpoint
6. Your Prometheus (or Thanos, Cortex, Mimir, VictoriaMetrics) ingests and stores

What the request from JupiterOne looks like:*

Want to learn more? We recommend a graph of a quadratic function is shown below and how do you calculate theoretical yield for further reading.

POST /api/v1/write HTTP/1.1
Host: prometheus.example.com
Authorization: Bearer 
Content-Type: application/x-protobuf
Content-Encoding: snappy
X-Prometheus-Remote-Write-Version: 0.1.0

Your Prometheus responds 204 No Content on success. Now, 401 if auth fails. 400 if the payload is malformed. Now, 429 if you're rate limiting. Standard remote write contract.

Why this matters: You don't manage an exporter. No extra deployment. No scraping config. But you do need a remote write endpoint that can handle the volume —

When choosing between the two integration styles, the primary considerations are operational overhead, data freshness, and the existing infrastructure that already handles metric ingestion.

Operational overhead – Deploying an exporter means provisioning a runtime environment, managing its lifecycle, and ensuring it has the necessary permissions to query JupiterOne’s APIs. The remote‑write path sidesteps this by having JupiterOne push data directly, which reduces the number of moving parts you must monitor. Still, the remote‑write endpoint must be capable of ingesting high‑volume, compressed protobuf batches without dropping samples.

Data freshness and latency – The exporter pulls metrics on demand, so the interval between a change in JupiterOne’s state and the appearance of a new Prometheus series is dictated by the scrape interval you configure. With remote‑write, metrics are emitted on a fixed schedule defined inside JupiterOne, which can be tuned to match your desired update cadence. In practice, both approaches can achieve sub‑minute latency if the underlying schedules are set appropriately.

Security surface – An exporter exposes an HTTP endpoint that must be reachable from the Prometheus server. Hardening that endpoint — using TLS, IP allow‑lists, and authentication tokens — adds a layer of protection. The remote‑write integration also requires authentication, typically via a bearer token or basic credentials, but the token never leaves JupiterOne’s environment, limiting exposure.

Payload size and throttling – Remote‑write batches can become large, especially when many repositories, findings, or time‑series are involved. The exporter, by contrast, sends a modest amount of text per scrape, making it easier for firewalls and proxies to forward. If you opt for remote‑write, ensure your ingestion layer is configured with appropriate rate limits and can handle the maximum batch size advertised by JupiterOne.

Observability of the collector – Because the exporter is a separate process, you can instrument it with its own metrics (e.g., success counts, error rates, latency histograms) and expose them alongside the JupiterOne data. In the remote‑write model, you rely on the health checks of the JupiterOne service itself; any failure to produce a successful write will surface as a Prometheus scrape error on the target you expose for JupiterOne’s own metrics.

Typical deployment patterns

• Self‑hosted exporter*: run as a sidecar container or a dedicated pod, mount the required credentials via a secret, and expose port 9100 (or another custom port) for Prometheus to scrape. Configure the scrape job with a reasonable interval and enable relabel_configs to strip unnecessary labels if you need a flatter series layout.

• Managed remote‑write*: enable the integration from the JupiterOne UI, paste the remote‑write URL of your Prometheus (or a compatible gateway such as Cortex or Mimir), and supply the authentication token. No additional pods or network rules are required beyond allowing outbound HTTPS from the JupiterOne host(s).

Common pitfalls

• Forgetting to rotate API tokens used by the exporter, which leads to intermittent authentication failures.
• Setting an overly aggressive scrape interval on the exporter, causing unnecessary load on JupiterOne’s API and potential rate‑limit responses.
• Misconfiguring the remote‑write endpoint’s buffer size, resulting in dropped batches when JupiterOne spikes its metric volume.
• Neglecting to monitor the exporter’s own health, so silent failures go unnoticed until the underlying metrics become stale.

Best‑practice checklist

1. Verify that the exporter or remote‑write URL uses TLS and is not publicly reachable.
2. Allocate sufficient resources (CPU, memory) to the exporter if you expect high cardinality or frequent queries.
3. Enable Prometheus alerts on exporter scrape errors, remote‑write HTTP status codes other than 204, and high query duration histograms.
4. Periodically review the cardinality of label combinations to avoid runaway series growth.
5. Document the authentication method and rotation schedule for both approaches.

Conclusion

Both the self‑hosted exporter and the managed remote‑write integration provide a reliable conduit for exposing JupiterOne’s operational data to a Prometheus‑compatible monitoring stack. The exporter gives you granular control and easier debugging, while the remote‑write path reduces operational burden and centralises metric ingestion. Selecting the appropriate pattern hinges on your team’s capacity to maintain an additional service versus your desire for a streamlined, push‑based pipeline. Whichever route you adopt, disciplined monitoring of the collector’s health and thoughtful capacity planning will check that metric visibility remains consistent and actionable.