{
  "port": 8200,
  "protocol": "tcp",
  "service": "HashiCorp Vault API",
  "oneLiner": "Vault's HTTP API and UI — the door to a secrets store.",
  "whatItIs": "Vault's TCP listener documentation gives 127.0.0.1:8200 as the default address, so a stock single-node Vault is loopback-only and a 8200 visible on the network means someone bound it wider on purpose. The same port serves the REST API, the CLI (VAULT_ADDR), and the browser UI; cluster replication traffic uses 8201 next door. IANA has 8200 registered as trivnet1, which you will not meet in practice. The /v1/sys/health endpoint answers unauthenticated and reveals seal and initialization state.",
  "exposure": {
    "verdict": "never",
    "note": "Everything valuable in an organisation is behind this API; require TLS, keep it on a private network, and audit who can reach it."
  },
  "checkCommand": "curl -s --max-time 5 http://TARGET:8200/v1/sys/health",
  "links": [
    {
      "title": "Vault — TCP listener (default address 127.0.0.1:8200)",
      "url": "https://developer.hashicorp.com/vault/docs/configuration/listener/tcp",
      "kind": "official-docs"
    },
    {
      "title": "hashicorp/vault on GitHub",
      "url": "https://github.com/hashicorp/vault",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 8200",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8200",
      "kind": "iana"
    }
  ],
  "ianaName": "trivnet1"
}