# WHATPORT(9200)

## NAME

port 9200 — Elasticsearch / OpenSearch REST API — A search cluster's HTTP API — hit / and it hands you its name, version, and cluster.

Protocol: TCP  
IANA registry

## DESCRIPTION

Elasticsearch binds its REST API to the first free port in 9200-9300, which in practice is 9200 (node-to-node transport uses 9300); OpenSearch, the fork, keeps the same default. A plain GET of the root returns a JSON banner with the cluster name and version, and every index, document, and admin operation is available over the same interface. IANA's registration for the port is the long-obsolete WAP connectionless session service, which you will never actually meet.

## EXPOSURE

**Do not expose.** Exposed clusters with no authentication are a standing cause of mass data leaks and ransom-note indices — the API can read, rewrite, and delete every document. Enable security and put it behind a proxy or a private network.

## CHECK

```sh
curl -sS -m 5 http://TARGET:9200/
```

## SEE ALSO

- docs — [Elasticsearch — Networking (http.port defaults to 9200-9300)](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html) (elastic.co)
- source — [elastic/elasticsearch](https://github.com/elastic/elasticsearch) (github.com)
- iana — [IANA port registry — 9200 (wap-wsp)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9200) (iana.org)

---

HTML: <https://whatport.net/9200/> · JSON: <https://whatport.net/9200.json> · full dataset: <https://whatport.net/ports.json>