diff --git a/.env.example b/.env.example
index df8f639..ce9f60f 100644
--- a/.env.example
+++ b/.env.example
@@ -73,6 +73,9 @@ RATE_LIMIT_WINDOW_MS=900000
 # Maximum requests per client per window before a 429 is returned. [default: 100]
 RATE_LIMIT_MAX_REQUESTS=100
 
+## Prometheus metrics endpoint (disabled by default; admin JWT required)
+ENABLE_METRICS=false
+
 # Outbound webhook that receives dispute lifecycle notifications. Empty string
 # (the default) disables notifications. [default: "" — set to enable]
 # NOTE: declared in the schema but not yet read by any service; wire it up in
diff --git a/README.md b/README.md
index 21b13f5..5f92aef 100644
--- a/README.md
+++ b/README.md
@@ -376,3 +376,8 @@ linked PR 5,4,6
 ## 📄 License
 
 This project is licensed under the ISC License.
+
+
+## Prometheus metrics endpoint
+
+Operational metrics are available at `GET /metrics` and `GET /api/v1/metrics` when `ENABLE_METRICS=true`. The endpoint is disabled by default and requires a valid admin Bearer token when enabled. See [Prometheus metrics and operations guidance](docs/prometheus-metrics.md) for metric names, scrape setup, and alert recommendations.
diff --git a/docs/deployment.md b/docs/deployment.md
new file mode 100644
index 0000000..a29e943
--- /dev/null
+++ b/docs/deployment.md
@@ -0,0 +1,23 @@
+# Deployment notes
+
+## Prometheus metrics endpoint
+
+The operational metrics endpoint is disabled by default. To enable it in a deployment environment, set the validated variable in the service environment:
+
+    ENABLE_METRICS=true
+
+Restart the application after changing this setting. No database migration is required.
+
+When enabled, the protected endpoint is available at GET /metrics and GET /api/v1/metrics. Both require a valid Bearer JWT for a user with the admin role. Use HTTPS and restrict the endpoint to monitoring infrastructure through a private network, firewall, or trusted authentication proxy. Do not place long-lived admin credentials in source control or commit scrape tokens to a Prometheus configuration file.
+
+A Prometheus-compatible scraper must send an Authorization: Bearer header. Use a secret file or a trusted proxy that can securely rotate credentials. If your deployment cannot supply rotating Bearer tokens safely, keep ENABLE_METRICS=false until an appropriate authentication boundary is configured.
+
+For exported metric names, scrape configuration guidance, and suggested alerts, see [Prometheus metrics](prometheus-metrics.md).
+
+## Operational safety
+
+- Confirm the endpoint returns 404 while ENABLE_METRICS is false.
+- Confirm a request without a valid admin token receives an authentication error when metrics are enabled.
+- Confirm an authenticated non-admin receives 403.
+- Confirm a valid admin token receives Prometheus text exposition with a text/plain content type.
+- Monitor scrape latency: the indexer lag collector reads the persisted checkpoint and requests the current network ledger, so scrapes may be slower when the Stellar RPC service is degraded.
diff --git a/docs/prometheus-metrics.md b/docs/prometheus-metrics.md
new file mode 100644
index 0000000..7a96300
--- /dev/null
+++ b/docs/prometheus-metrics.md
@@ -0,0 +1,62 @@
+# Prometheus metrics
+
+SwiftChain Backend exposes a Prometheus text exposition endpoint for operational monitoring.
+
+## Enable and access
+
+Set this validated environment variable in .env:
+
+    ENABLE_METRICS=true
+
+The endpoint is disabled by default. When disabled, both paths return 404:
+
+- GET /metrics
+- GET /api/v1/metrics
+
+When enabled, both require a valid Bearer JWT for a user with the admin role. Keep the endpoint behind TLS and an operator-only network boundary; do not expose admin credentials in Prometheus scrape configuration. Use a dedicated monitoring identity and rotate its token according to your security policy.
+
+Example request:
+
+    curl -H "Authorization: Bearer $METRICS_ADMIN_TOKEN" http://localhost:3000/metrics
+
+The response uses text/plain; version=0.0.4; charset=utf-8 and can be scraped by Prometheus-compatible collectors.
+
+## Exported metrics
+
+| Metric | Type | Meaning |
+| --- | --- | --- |
+| swiftchain_http_requests_total | Counter | Completed HTTP requests, labelled by method, Express route template, and status code |
+| swiftchain_http_request_duration_seconds | Histogram | Request duration buckets, sum, and count |
+| swiftchain_process_uptime_seconds | Gauge | Process uptime |
+| swiftchain_process_resident_memory_bytes | Gauge | Resident memory |
+| swiftchain_process_heap_used_bytes / swiftchain_process_heap_total_bytes | Gauge | Node.js heap usage |
+| swiftchain_mongodb_connection_ready | Gauge | Whether Mongoose is connected |
+| swiftchain_mongodb_pool_stats_available | Gauge | Whether the installed MongoDB driver exposes pool statistics |
+| swiftchain_mongodb_pool_connections | Gauge | Total, available, and in-use MongoDB pool connections |
+| swiftchain_redis_healthy | Gauge | Result of a Redis PING check |
+| swiftchain_circuit_breaker_open | Gauge | Circuit-breaker state by registered breaker |
+| swiftchain_indexer_lag_available | Gauge | Whether a lag snapshot could be read |
+| swiftchain_indexer_lag_ledgers | Gauge | Gap between persisted processed ledger and the live network ledger |
+| swiftchain_socket_* | Gauge / counter | Current connection and latency snapshots are gauges; cumulative connection, disconnection, and message totals are counters |
+
+HTTP route labels use Express route templates rather than raw request URLs, preventing user IDs, arbitrary paths, and query values from creating high-cardinality labels. The indexer metric reads the current checkpoint and live ledger without persisting alerts or sending webhooks during a scrape.
+
+MongoDB pool metrics depend on runtime pool fields exposed by the installed MongoDB driver. Check swiftchain_mongodb_pool_stats_available before relying on pool connection values.
+
+## Suggested scrape configuration
+
+Configure your Prometheus-compatible scraper to use the application URL, HTTPS in production, and an authorization mechanism that securely supplies a short-lived admin token. Do not commit tokens or other credentials to prometheus.yml. If your scraper cannot safely rotate a Bearer token, place a trusted authentication proxy in front of the endpoint and restrict direct network access.
+
+## Initial alert guidance
+
+Treat these as starting points and tune them to the service's normal traffic:
+
+- HTTP 5xx ratio remains above 5% for 5 minutes.
+- Request p95 latency exceeds the service's agreed SLO for 5 minutes.
+- swiftchain_mongodb_connection_ready is 0.
+- swiftchain_redis_healthy is 0.
+- Any swiftchain_circuit_breaker_open sample is 1.
+- swiftchain_indexer_lag_ledgers remains above INDEXER_LAG_ALERT_THRESHOLD.
+- MongoDB pool in-use connections remain close to total connections while request latency rises.
+
+All in-memory request counters and socket totals are process-local and reset when that instance restarts. Scrape each instance separately and aggregate in the monitoring backend; do not treat one instance's values as a fleet-wide total. This endpoint exports metrics; it does not configure Prometheus, Grafana, Datadog, alert delivery, or retention automatically.
diff --git a/src/app.ts b/src/app.ts
index e1c8a53..ea969b3 100644
--- a/src/app.ts
+++ b/src/app.ts
@@ -8,6 +8,8 @@ import rateLimit from 'express-rate-limit';
 import swaggerUi from 'swagger-ui-express';
 
 import routes from './routes';
+import metricsRoutes from './routes/metricsRoutes';
+import prometheusMetricsMiddleware from './middleware/prometheusMetricsMiddleware';
 import logger from './config/logger';
 import { sendError } from './utils/responseWrapper';
 import { connectDatabase } from './config/database';
@@ -37,6 +39,7 @@ app.use(compression());
 // Track in-flight requests and reject new ones during graceful shutdown.
 app.use(requestTracker);
 app.use(requestLogger);
+app.use(prometheusMetricsMiddleware);
 
 // Swagger UI needs inline <script>/<style>, which the default Helmet CSP
 // blocks, so it gets its own relaxed CSP scoped to /api-docs only — the
@@ -92,6 +95,9 @@ app.get('/health', (_req, res): void => {
   });
 });
 
+// Prometheus scrape path follows the conventional /metrics URL; the same
+// protected endpoint is also available at /api/v1/metrics.
+app.use('/metrics', metricsRoutes);
 app.use('/api', routes);
 
 app.use((req, res): void => {
diff --git a/src/config/env.ts b/src/config/env.ts
index 6f1616e..3b48b57 100644
--- a/src/config/env.ts
+++ b/src/config/env.ts
@@ -18,6 +18,7 @@ interface EnvConfig {
   CORS_ORIGIN: string;
   RATE_LIMIT_WINDOW_MS: number;
   RATE_LIMIT_MAX_REQUESTS: number;
+  ENABLE_METRICS: boolean;
   DISPUTE_NOTIFICATION_WEBHOOK_URL: string;
   UPLOAD_STORAGE_DRIVER: string;
   UPLOAD_LOCAL_DIR: string;
@@ -269,6 +270,12 @@ const envSchema = z.object({
   CORS_ORIGIN: z.string().default('*'),
   RATE_LIMIT_WINDOW_MS: numeric(z.coerce.number().int().min(1000).default(900000)),
   RATE_LIMIT_MAX_REQUESTS: numeric(z.coerce.number().int().min(1).default(100)),
+  ENABLE_METRICS: z.preprocess(
+    blankToUndefined,
+    z.enum(['true', 'false'])
+      .default('false')
+      .transform((value) => value === 'true'),
+  ),
   DISPUTE_NOTIFICATION_WEBHOOK_URL: z.string().default(''),
 
   // ── Uploads / storage ──────────────────────────────────────────────────────
@@ -297,8 +304,13 @@ const envSchema = z.object({
   PROFILE_PICTURE_QUALITY: z.string().optional(),
 
   // ── Indexer lag monitoring ─────────────────────────────────────────────────
-  INDEXER_LAG_ALERT_THRESHOLD: numeric(z.coerce.number().int().min(1).default(100)),
-  INDEXER_LAG_CHECK_INTERVAL_MS: numeric(z.coerce.number().int().min(1000).default(60000)),
+  // ── Indexer lag monitoring ─────────────────────────────────────────────────
+  INDEXER_LAG_ALERT_THRESHOLD: numeric(
+    z.coerce.number().int().min(1).default(100),
+  ),
+  INDEXER_LAG_CHECK_INTERVAL_MS: numeric(
+    z.coerce.number().int().min(1000).default(60000),
+  ),
   INDEXER_LAG_WEBHOOK_URL: z.string().trim().default(''),
 
   // ── Soroban RPC retry config ────────────────────────────────────────────────
diff --git a/src/controllers/metricsController.ts b/src/controllers/metricsController.ts
new file mode 100644
index 0000000..cad0d22
--- /dev/null
+++ b/src/controllers/metricsController.ts
@@ -0,0 +1,23 @@
+import { Request, Response, NextFunction } from 'express';
+import { StatusCodes } from 'http-status-codes';
+import prometheusMetricsService from '../services/prometheusMetricsService';
+
+/**
+ * Exposes operational metrics in Prometheus text exposition format.
+ * Authentication and feature gating are enforced by metricsRoutes.
+ */
+export const getPrometheusMetrics = async (
+  _req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> => {
+  try {
+    const output = await prometheusMetricsService.render();
+    res
+      .status(StatusCodes.OK)
+      .setHeader('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+    res.send(output);
+  } catch (error) {
+    next(error);
+  }
+};
diff --git a/src/middleware/prometheusMetricsMiddleware.ts b/src/middleware/prometheusMetricsMiddleware.ts
new file mode 100644
index 0000000..261d119
--- /dev/null
+++ b/src/middleware/prometheusMetricsMiddleware.ts
@@ -0,0 +1,33 @@
+import { Request, Response, NextFunction } from 'express';
+import prometheusMetricsService from '../services/prometheusMetricsService';
+
+/**
+ * Records completed HTTP requests using route templates to avoid unbounded
+ * cardinality from identifiers and query parameters.
+ */
+const prometheusMetricsMiddleware = (req: Request, res: Response, next: NextFunction): void => {
+  const path = req.path;
+  if (
+    path === '/metrics' ||
+    path === '/metrics/' ||
+    path === '/api/v1/metrics' ||
+    path === '/api/v1/metrics/'
+  ) {
+    next();
+    return;
+  }
+
+  const startedAt = process.hrtime.bigint();
+  res.once('finish', () => {
+    const durationMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+    const routePath =
+      req.route && typeof req.route.path === 'string'
+        ? req.baseUrl + req.route.path || req.route.path
+        : 'unmatched';
+    prometheusMetricsService.recordRequest(req.method, routePath, res.statusCode, durationMs);
+  });
+
+  next();
+};
+
+export default prometheusMetricsMiddleware;
diff --git a/src/routes/index.ts b/src/routes/index.ts
index dc7d482..6319788 100644
--- a/src/routes/index.ts
+++ b/src/routes/index.ts
@@ -12,6 +12,7 @@ import fleetRoutes from './fleetRoutes';
 import disputeRoutes from './disputeRoutes';
 import eventLogRoutes from './eventLogRoutes';
 import monitorRoutes from './monitorRoutes';
+import metricsRoutes from './metricsRoutes';
 import profileRoutes from './profileRoutes';
 import notificationRoutes from './notificationRoutes';
 import healthRoutes from './healthRoutes';
@@ -52,6 +53,7 @@ router.use('/v1/fleets', fleetRoutes);
 router.use('/v1/disputes', disputeRoutes);
 router.use('/v1/eventlog', eventLogRoutes);
 router.use('/v1/monitor', monitorRoutes);
+router.use('/v1/metrics', metricsRoutes);
 router.use('/v1/profile', profileRoutes);
 router.use('/v1/notifications', notificationRoutes);
 router.use('/v1/health', healthRoutes);
diff --git a/src/routes/metricsRoutes.ts b/src/routes/metricsRoutes.ts
new file mode 100644
index 0000000..6ee4056
--- /dev/null
+++ b/src/routes/metricsRoutes.ts
@@ -0,0 +1,46 @@
+import { Router, Response, NextFunction, Request } from 'express';
+import authenticate from '../middleware/authenticate';
+import requireRole from '../middleware/requireRole';
+import { UserRole } from '../interfaces/IUser';
+import env from '../config/env';
+import { getPrometheusMetrics } from '../controllers/metricsController';
+
+const router = Router();
+
+/**
+ * @openapi
+ * /v1/metrics:
+ *   get:
+ *     tags: [Monitoring]
+ *     summary: Export operational metrics in Prometheus format
+ *     description: Admin-only endpoint. Disabled unless ENABLE_METRICS=true.
+ *     security:
+ *       - bearerAuth: []
+ *     responses:
+ *       200:
+ *         description: Prometheus text exposition
+ *         content:
+ *           text/plain:
+ *             schema:
+ *               type: string
+ *       401:
+ *         description: Authentication required
+ *       403:
+ *         description: Admin role required
+ *       404:
+ *         description: Metrics endpoint is disabled
+ */
+const requireMetricsEnabled = (_req: Request, res: Response, next: NextFunction): void => {
+  if (!env.ENABLE_METRICS) {
+    res.status(404).end();
+    return;
+  }
+  next();
+};
+
+router.use(requireMetricsEnabled);
+router.use(authenticate);
+router.use(requireRole(UserRole.ADMIN));
+router.get('/', getPrometheusMetrics);
+
+export default router;
diff --git a/src/services/monitorService.ts b/src/services/monitorService.ts
index 5418c0c..84d87af 100644
--- a/src/services/monitorService.ts
+++ b/src/services/monitorService.ts
@@ -161,6 +161,38 @@ export const checkIndexerLag = async (): Promise<IndexerLagCheckResult> => {
   return result;
 };
 
+/**
+ * Read-only indexer lag snapshot for scrape-based monitoring.
+ *
+ * Unlike checkIndexerLag(), this helper does not create checkpoints, persist
+ * alerts, or send webhooks, so frequent metrics scrapes have no write side effects.
+ */
+export interface IndexerLagSnapshot {
+  network: string;
+  processedLedger: number;
+  networkLedger: number;
+  lagLedgers: number;
+}
+
+export const getIndexerLagSnapshot = async (): Promise<IndexerLagSnapshot | null> => {
+  const status = await IndexerStatus.findOne({ network: stellarConfig.network });
+  if (!status) {
+    return null;
+  }
+
+  const rawNetworkLedger = await sorobanService.getLatestLedger();
+  if (typeof rawNetworkLedger !== 'number') {
+    return null;
+  }
+
+  return {
+    network: status.network,
+    processedLedger: status.lastProcessedLedger,
+    networkLedger: rawNetworkLedger,
+    lagLedgers: Math.max(0, rawNetworkLedger - status.lastProcessedLedger),
+  };
+};
+
 // ─── Alert history ─────────────────────────────────────────────────────────────
 
 /**
diff --git a/src/services/prometheusMetricsService.ts b/src/services/prometheusMetricsService.ts
new file mode 100644
index 0000000..c927c29
--- /dev/null
+++ b/src/services/prometheusMetricsService.ts
@@ -0,0 +1,323 @@
+import mongoose from 'mongoose';
+import { redisClient } from '../config/redis';
+import { getAllCircuitBreakerStatuses } from '../utils/circuitBreaker';
+import socketMetricsService from './socketMetricsService';
+import { getIndexerLagSnapshot } from './monitorService';
+
+const LATENCY_BUCKETS_SECONDS = [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10];
+
+interface HistogramSnapshot {
+  count: number;
+  sumSeconds: number;
+  bucketCounts: number[];
+}
+
+interface MongoPoolSnapshot {
+  total: number;
+  available: number;
+  introspectionAvailable: boolean;
+}
+
+const escapeLabel = (value: string): string =>
+  value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n');
+
+const labelsToString = (labels: Record<string, string | number>): string =>
+  '{' +
+  Object.entries(labels)
+    .map(([key, value]) => key + '="' + escapeLabel(String(value)) + '"')
+    .join(',') +
+  '}';
+
+const safeMetricLabel = (value: string): string =>
+  value.replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 100) || 'unknown';
+
+const readMongoPoolSnapshot = (): MongoPoolSnapshot => {
+  try {
+    const connection = mongoose.connection;
+    const topology = (connection.getClient() as unknown as {
+      topology?: {
+        s?: {
+          servers?: Map<
+            string,
+            {
+              s?: {
+                pool?: {
+                  totalConnectionCount?: number;
+                  availableConnectionCount?: number;
+                };
+              };
+            }
+          >;
+        };
+      };
+    }).topology;
+
+    const servers = topology?.s?.servers;
+    if (!servers || typeof servers.values !== 'function') {
+      return { total: 0, available: 0, introspectionAvailable: false };
+    }
+
+    let total = 0;
+    let available = 0;
+    let poolsFound = 0;
+    for (const server of servers.values()) {
+      const pool = server.s?.pool;
+      if (!pool) continue;
+      poolsFound += 1;
+      total += pool.totalConnectionCount ?? 0;
+      available += pool.availableConnectionCount ?? 0;
+    }
+
+    return { total, available, introspectionAvailable: poolsFound > 0 };
+  } catch {
+    return { total: 0, available: 0, introspectionAvailable: false };
+  }
+};
+
+/**
+ * Collects process-local HTTP metrics and snapshots of existing operational
+ * dependencies. Request labels use Express route templates rather than raw
+ * URLs so identifiers and arbitrary query strings never become metric labels.
+ */
+class PrometheusMetricsService {
+  private readonly requestCounters = new Map<string, number>();
+  private readonly requestHistograms = new Map<string, HistogramSnapshot>();
+
+  public recordRequest(
+    method: string,
+    route: string,
+    statusCode: number,
+    durationMs: number,
+  ): void {
+    const normalizedMethod = method.toUpperCase();
+    const normalizedRoute = route || 'unmatched';
+    const counterKey = JSON.stringify([normalizedMethod, normalizedRoute, statusCode]);
+    this.requestCounters.set(counterKey, (this.requestCounters.get(counterKey) ?? 0) + 1);
+
+    const histogramKey = JSON.stringify([normalizedMethod, normalizedRoute]);
+    let histogram = this.requestHistograms.get(histogramKey);
+    if (!histogram) {
+      histogram = {
+        count: 0,
+        sumSeconds: 0,
+        bucketCounts: LATENCY_BUCKETS_SECONDS.map(() => 0),
+      };
+      this.requestHistograms.set(histogramKey, histogram);
+    }
+
+    const durationSeconds = Math.max(0, durationMs) / 1000;
+    histogram.count += 1;
+    histogram.sumSeconds += durationSeconds;
+    LATENCY_BUCKETS_SECONDS.forEach((boundary, index) => {
+      if (durationSeconds <= boundary) histogram!.bucketCounts[index] += 1;
+    });
+  }
+
+  public async render(): Promise<string> {
+    const lines: string[] = [];
+    const gauge = (name: string, help: string, value: number): void => {
+      lines.push(
+        '# HELP ' + name + ' ' + help,
+        '# TYPE ' + name + ' gauge',
+        name + ' ' + (Number.isFinite(value) ? value : 0),
+      );
+    };
+    const counter = (name: string, help: string, value: number): void => {
+      lines.push(
+        '# HELP ' + name + ' ' + help,
+        '# TYPE ' + name + ' counter',
+        name + ' ' + (Number.isFinite(value) ? value : 0),
+      );
+    };
+
+    lines.push(
+      '# HELP swiftchain_http_requests_total Total HTTP requests served by route.',
+      '# TYPE swiftchain_http_requests_total counter',
+    );
+    for (const [key, value] of this.requestCounters) {
+      const [method, route, statusCode] = JSON.parse(key) as [string, string, number];
+      lines.push(
+        'swiftchain_http_requests_total' +
+          labelsToString({ method, route, status_code: statusCode }) +
+          ' ' +
+          value,
+      );
+    }
+
+    lines.push(
+      '# HELP swiftchain_http_request_duration_seconds HTTP request duration in seconds.',
+      '# TYPE swiftchain_http_request_duration_seconds histogram',
+    );
+    for (const [key, histogram] of this.requestHistograms) {
+      const [method, route] = JSON.parse(key) as [string, string];
+      LATENCY_BUCKETS_SECONDS.forEach((boundary, index) => {
+        lines.push(
+          'swiftchain_http_request_duration_seconds_bucket' +
+            labelsToString({ method, route, le: boundary }) +
+            ' ' +
+            histogram.bucketCounts[index],
+        );
+      });
+      lines.push(
+        'swiftchain_http_request_duration_seconds_bucket' +
+          labelsToString({ method, route, le: '+Inf' }) +
+          ' ' +
+          histogram.count,
+        'swiftchain_http_request_duration_seconds_sum' +
+          labelsToString({ method, route }) +
+          ' ' +
+          histogram.sumSeconds,
+        'swiftchain_http_request_duration_seconds_count' +
+          labelsToString({ method, route }) +
+          ' ' +
+          histogram.count,
+      );
+    }
+
+    gauge(
+      'swiftchain_process_uptime_seconds',
+      'Process uptime in seconds.',
+      process.uptime(),
+    );
+    const memory = process.memoryUsage();
+    gauge(
+      'swiftchain_process_resident_memory_bytes',
+      'Resident process memory in bytes.',
+      memory.rss,
+    );
+    gauge(
+      'swiftchain_process_heap_used_bytes',
+      'Node.js heap memory used in bytes.',
+      memory.heapUsed,
+    );
+    gauge(
+      'swiftchain_process_heap_total_bytes',
+      'Node.js heap memory allocated in bytes.',
+      memory.heapTotal,
+    );
+
+    const mongoPool = readMongoPoolSnapshot();
+    gauge(
+      'swiftchain_mongodb_connection_ready',
+      'Whether the Mongoose connection is connected.',
+      mongoose.connection.readyState === 1 ? 1 : 0,
+    );
+    gauge(
+      'swiftchain_mongodb_pool_stats_available',
+      'Whether MongoDB driver pool statistics could be read from the active topology.',
+      mongoPool.introspectionAvailable ? 1 : 0,
+    );
+    lines.push(
+      '# HELP swiftchain_mongodb_pool_connections MongoDB pool connections by state.',
+      '# TYPE swiftchain_mongodb_pool_connections gauge',
+      'swiftchain_mongodb_pool_connections' +
+        labelsToString({ state: 'total' }) +
+        ' ' +
+        mongoPool.total,
+      'swiftchain_mongodb_pool_connections' +
+        labelsToString({ state: 'available' }) +
+        ' ' +
+        mongoPool.available,
+      'swiftchain_mongodb_pool_connections' +
+        labelsToString({ state: 'in_use' }) +
+        ' ' +
+        Math.max(0, mongoPool.total - mongoPool.available),
+    );
+
+    let redisHealthy = 0;
+    if (redisClient.status === 'ready') {
+      let timeout: ReturnType<typeof setTimeout> | undefined;
+      try {
+        const ping = redisClient.ping().then((response) => response === 'PONG');
+        const timedOut = new Promise<boolean>((resolve) => {
+          timeout = setTimeout(() => resolve(false), 1000);
+          timeout.unref?.();
+        });
+        redisHealthy = (await Promise.race([ping, timedOut])) ? 1 : 0;
+      } catch {
+        redisHealthy = 0;
+      } finally {
+        if (timeout) clearTimeout(timeout);
+      }
+    }
+    gauge('swiftchain_redis_healthy', 'Whether Redis responds to a PING command.', redisHealthy);
+
+    const breakers = getAllCircuitBreakerStatuses();
+    lines.push(
+      '# HELP swiftchain_circuit_breaker_open Whether a named circuit breaker is open or half-open.',
+      '# TYPE swiftchain_circuit_breaker_open gauge',
+    );
+    for (const breaker of breakers) {
+      lines.push(
+        'swiftchain_circuit_breaker_open' +
+          labelsToString({ name: safeMetricLabel(breaker.name), state: breaker.state }) +
+          ' ' +
+          (breaker.state === 'closed' ? 0 : 1),
+      );
+    }
+
+    try {
+      const lag = await getIndexerLagSnapshot();
+      gauge(
+        'swiftchain_indexer_lag_available',
+        'Whether indexer lag could be measured.',
+        lag ? 1 : 0,
+      );
+      if (lag) {
+        gauge(
+          'swiftchain_indexer_lag_ledgers',
+          'Number of ledgers the indexer trails the network by.',
+          lag.lagLedgers,
+        );
+      }
+    } catch {
+      gauge(
+        'swiftchain_indexer_lag_available',
+        'Whether indexer lag could be measured.',
+        0,
+      );
+    }
+
+    const socketMetrics = socketMetricsService.getMetrics();
+    gauge(
+      'swiftchain_socket_connected_sockets',
+      'Currently connected Socket.IO clients.',
+      socketMetrics.connectedSockets,
+    );
+    counter(
+      'swiftchain_socket_connections_total',
+      'Total Socket.IO connections since process start.',
+      socketMetrics.totalConnections,
+    );
+    counter(
+      'swiftchain_socket_disconnections_total',
+      'Total Socket.IO disconnections since process start.',
+      socketMetrics.totalDisconnections,
+    );
+    counter(
+      'swiftchain_socket_messages_processed_total',
+      'Total Socket.IO messages processed since process start.',
+      socketMetrics.messagesProcessed,
+    );
+    gauge(
+      'swiftchain_socket_message_latency_p50_ms',
+      'Socket.IO message latency p50 in milliseconds.',
+      socketMetrics.messageLatencyMs.p50,
+    );
+    gauge(
+      'swiftchain_socket_message_latency_p95_ms',
+      'Socket.IO message latency p95 in milliseconds.',
+      socketMetrics.messageLatencyMs.p95,
+    );
+    gauge(
+      'swiftchain_socket_message_latency_p99_ms',
+      'Socket.IO message latency p99 in milliseconds.',
+      socketMetrics.messageLatencyMs.p99,
+    );
+
+    return lines.join('\n') + '\n';
+  }
+}
+
+export const prometheusMetricsService = new PrometheusMetricsService();
+export default prometheusMetricsService;
diff --git a/tests/unit/prometheusMetricsMiddleware.test.ts b/tests/unit/prometheusMetricsMiddleware.test.ts
new file mode 100644
index 0000000..30905bb
--- /dev/null
+++ b/tests/unit/prometheusMetricsMiddleware.test.ts
@@ -0,0 +1,58 @@
+import { EventEmitter } from 'events';
+import type { Request, Response } from 'express';
+import prometheusMetricsService from '../../src/services/prometheusMetricsService';
+import prometheusMetricsMiddleware from '../../src/middleware/prometheusMetricsMiddleware';
+
+jest.mock('../../src/services/prometheusMetricsService', () => ({
+  __esModule: true,
+  default: {
+    recordRequest: jest.fn(),
+  },
+}));
+
+describe('prometheusMetricsMiddleware', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('records route templates instead of concrete request URLs', () => {
+    const req = {
+      path: '/api/v1/drivers/driver-123',
+      method: 'GET',
+      baseUrl: '/api/v1/drivers',
+      route: { path: '/:driverId' },
+    } as unknown as Request;
+    const res = new EventEmitter() as unknown as Response;
+    Object.defineProperty(res, 'statusCode', { value: 200, writable: true });
+    const next = jest.fn();
+
+    prometheusMetricsMiddleware(req, res, next);
+    res.emit('finish');
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(prometheusMetricsService.recordRequest).toHaveBeenCalledWith(
+      'GET',
+      '/api/v1/drivers/:driverId',
+      200,
+      expect.any(Number),
+    );
+  });
+
+  it('does not record metrics scrapes as ordinary HTTP traffic', () => {
+    const req = {
+      path: '/metrics',
+      method: 'GET',
+      baseUrl: '',
+      route: { path: '/' },
+    } as unknown as Request;
+    const res = new EventEmitter() as unknown as Response;
+    Object.defineProperty(res, 'statusCode', { value: 200, writable: true });
+    const next = jest.fn();
+
+    prometheusMetricsMiddleware(req, res, next);
+    res.emit('finish');
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(prometheusMetricsService.recordRequest).not.toHaveBeenCalled();
+  });
+});
diff --git a/tests/unit/prometheusMetricsService.test.ts b/tests/unit/prometheusMetricsService.test.ts
new file mode 100644
index 0000000..fc6217d
--- /dev/null
+++ b/tests/unit/prometheusMetricsService.test.ts
@@ -0,0 +1,153 @@
+jest.mock('mongoose', () => ({
+  connection: {
+    readyState: 1,
+    getClient: jest.fn(() => ({ topology: { s: { servers: new Map() } } })),
+  },
+}));
+
+jest.mock('../../src/config/redis', () => ({
+  redisClient: {
+    status: 'ready',
+    ping: jest.fn().mockResolvedValue('PONG'),
+  },
+}));
+
+jest.mock('../../src/utils/circuitBreaker', () => ({
+  getAllCircuitBreakerStatuses: jest.fn(() => [
+    { name: 'soroban-rpc', state: 'open', stats: {} },
+    { name: 'database', state: 'closed', stats: {} },
+  ]),
+}));
+
+jest.mock('../../src/services/socketMetricsService', () => ({
+  __esModule: true,
+  default: {
+    getMetrics: jest.fn(() => ({
+      connectedSockets: 3,
+      totalConnections: 12,
+      totalDisconnections: 9,
+      messagesProcessed: 44,
+      messageLatencyMs: { p50: 5, p95: 15, p99: 20 },
+      memoryUsageBytes: { heapUsedMB: 10, heapTotalMB: 20, rssMB: 30, externalMB: 1 },
+      timestamp: '2026-01-01T00:00:00.000Z',
+    })),
+  },
+}));
+
+jest.mock('../../src/services/monitorService', () => ({
+  getIndexerLagSnapshot: jest.fn().mockResolvedValue({
+    network: 'testnet',
+    processedLedger: 100,
+    networkLedger: 125,
+    lagLedgers: 25,
+  }),
+}));
+
+import prometheusMetricsService from '../../src/services/prometheusMetricsService';
+import mongoose from 'mongoose';
+import { redisClient } from '../../src/config/redis';
+import { getIndexerLagSnapshot } from '../../src/services/monitorService';
+
+const mongoConnection = (mongoose as unknown as { connection: { getClient: jest.Mock } }).connection;
+const redis = redisClient as unknown as { status: string; ping: jest.Mock };
+const indexerLagSnapshot = getIndexerLagSnapshot as jest.Mock;
+
+describe('PrometheusMetricsService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mongoConnection.getClient.mockImplementation(() => ({
+      topology: { s: { servers: new Map() } },
+    }));
+    redis.status = 'ready';
+    redis.ping.mockResolvedValue('PONG');
+    indexerLagSnapshot.mockResolvedValue({
+      network: 'testnet',
+      processedLedger: 100,
+      networkLedger: 125,
+      lagLedgers: 25,
+    });
+  });
+
+  it('renders valid Prometheus declarations and request histogram samples', async () => {
+    prometheusMetricsService.recordRequest('get', '/api/v1/drivers/:driverId', 200, 30);
+
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('# TYPE swiftchain_http_requests_total counter');
+    expect(output).toContain('# TYPE swiftchain_http_request_duration_seconds histogram');
+    expect(output).toContain(
+      'swiftchain_http_requests_total{method="GET",route="/api/v1/drivers/:driverId",status_code="200"} 1',
+    );
+    expect(output).toContain(
+      'swiftchain_http_request_duration_seconds_bucket' +
+        '{method="GET",route="/api/v1/drivers/:driverId",le="0.05"} 1',
+    );
+    expect(output).toContain(
+      'swiftchain_http_request_duration_seconds_count{method="GET",route="/api/v1/drivers/:driverId"} 1',
+    );
+  });
+
+  it('includes operational dependency and existing Socket.IO metrics', async () => {
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('swiftchain_mongodb_connection_ready 1');
+    expect(output).toContain('swiftchain_redis_healthy 1');
+    expect(output).toContain('swiftchain_circuit_breaker_open{name="soroban-rpc",state="open"} 1');
+    expect(output).toContain('swiftchain_indexer_lag_ledgers 25');
+    expect(output).toContain('swiftchain_socket_connected_sockets 3');
+    expect(output).toContain('# TYPE swiftchain_socket_connections_total counter');
+  });
+
+  it('exports MongoDB pool utilization when driver pool statistics are available', async () => {
+    mongoConnection.getClient.mockReturnValue({
+      topology: {
+        s: {
+          servers: new Map([
+            ['primary', { s: { pool: { totalConnectionCount: 10, availableConnectionCount: 4 } } }],
+          ]),
+        },
+      },
+    });
+
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('swiftchain_mongodb_pool_stats_available 1');
+    expect(output).toContain('swiftchain_mongodb_pool_connections{state="total"} 10');
+    expect(output).toContain('swiftchain_mongodb_pool_connections{state="available"} 4');
+    expect(output).toContain('swiftchain_mongodb_pool_connections{state="in_use"} 6');
+  });
+
+  it('reports unavailable dependencies without failing the metrics scrape', async () => {
+    mongoConnection.getClient.mockImplementation(() => {
+      throw new Error('MongoDB is disconnected');
+    });
+    redis.status = 'wait';
+    indexerLagSnapshot.mockResolvedValueOnce(null);
+
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('swiftchain_mongodb_pool_stats_available 0');
+    expect(output).toContain('swiftchain_redis_healthy 0');
+    expect(output).toContain('swiftchain_indexer_lag_available 0');
+    expect(output.split('\n').some((line) => line.startsWith('swiftchain_indexer_lag_ledgers '))).toBe(false);
+  });
+
+  it('handles Redis and indexer probe errors without breaking exposition output', async () => {
+    redis.ping.mockRejectedValueOnce(new Error('Redis unavailable'));
+    indexerLagSnapshot.mockRejectedValueOnce(new Error('RPC unavailable'));
+
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('swiftchain_redis_healthy 0');
+    expect(output).toContain('swiftchain_indexer_lag_available 0');
+    expect(output).toContain('# TYPE swiftchain_http_requests_total counter');
+  });
+
+  it('escapes label values before rendering', async () => {
+    prometheusMetricsService.recordRequest('GET', '/api/v1/items/"special"', 500, 10);
+
+    const output = await prometheusMetricsService.render();
+
+    expect(output).toContain('route="/api/v1/items/' + '\\' + '"special' + '\\' + '""');
+  });
+});