Vault's HTTP API and UI — the door to a secrets store.
Vault's TCP listener documentation gives 127.0.0.1:8200 as the default address, so a stock single-node Vault is loopback-only and a 8200 visible on the network means someone bound it wider on purpose. The same port serves the REST API, the CLI (VAULT_ADDR), and the browser UI; cluster replication traffic uses 8201 next door. IANA has 8200 registered as trivnet1, which you will not meet in practice. The /v1/sys/health endpoint answers unauthenticated and reveals seal and initialization state.
Do not expose
Everything valuable in an organisation is behind this API; require TLS, keep it on a private network, and audit who can reach it.
$ curl -s --max-time 5 http://TARGET:8200/v1/sys/healthSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.