Skip to main content
The on-prem suite runs as a set of self-hosted services. This is the operator reference for every service’s default port and HTTP interface. All ports are overridable (an environment variable, or a Docker -p host:container mapping), and no two defaults collide.

​
Port map

The Payment Gateway is a separately-licensed add-on, not part of the on-prem bundle. It runs as one process on 8090 regardless of how many chain add-ons you license; a request names its network and the engine routes it to the matching chain. Ports 8092, 8093, and 8095 are reserved for the substrate-2 services the control plane can bridge (federation validator, ZK receipt, ATB credential verifier) when you run them.

​
HTTP interfaces

​
substrate2 control plane (8094)

Bind with S2CP_BIND; admin writes need Authorization: Bearer <S2CP_ADMIN_TOKEN>. Reads are open.
  • GET / web control panel: live posture, issuer trust set, policy bridge, audit depth
  • GET /health · GET /docs (OpenAPI)
  • GET /v1/posture poll every bridged service and the policy bridge
  • GET /v1/issuers · POST /v1/issuers · DELETE /v1/issuers/{did} (admin)
  • GET /v1/issuer-pks · GET /.well-known/atb-keys.json · GET /issuers/{did}/atb-keys.json
  • GET /v1/services · POST /v1/services (addon self-register)
  • Policy bridge: GET /v1/policy · POST /v1/policy (set the active policy, returns its content-addressed policy_ref) · POST /v1/policy/bind (subject_ref to policy_bound_ref)
  • GET /v1/audit (admin, HMAC-chained)

​
Compliance Command Center (8200)

Console login plus a service token for self-registration.
  • GET / dashboard · GET /health · GET /login · POST /login · GET /logout
  • GET /v1/services · POST /v1/services · DELETE /v1/services/{name}
  • GET /api/services · GET /api/posture · GET /export (consolidated auditor pack) · GET /validation/pack · GET /audit

​
Records Vault (8000) and Doc Archive (8083)

Records Vault serves the Doc Archive API over the vault’s archive. Bearer token (RV_ARCHIVE_TOKEN).
  • POST /v1/archive/notarize · POST /v1/archive/verify · GET /v1/archive/verify-chain
  • GET /v1/archive/retrieve/{doc_hash} · GET /v1/archive/entry/{seq}
  • GET /archive/verify (offline verify portal) · GET /.well-known/pqc-keys.json · GET /health

​
Sanctions Monitor (8088)

MONITOR_PORT, Bearer token MONITOR_API_TOKEN.
  • POST /v1/watch · DELETE /v1/watch/{subject_ref} · POST /v1/sweep (re-screen, signed deltas)
  • GET /v1/watchlist · GET /v1/deltas · GET /v1/pubkey · GET /healthz

​
Compliance Gate (8086)

  • POST /v1/compliance/screen (screen, certify a no-PII verdict) · POST /v1/compliance/verify · GET /compliance/verify (portal)
  • GET /.well-known/pqc-keys.json · GET /health

​
Audit Log (8087)

  • POST /v1/audit-log/append · POST /v1/audit-log/verify · GET /v1/audit-log/verify-chain
  • GET /v1/audit-log/entry/{seq} · GET /audit-log/verify (portal) · GET /.well-known/pqc-keys.json · GET /health

​
Recovery Vault (8077)

  • Keys: POST /v1/keys · POST /v1/keys/{name}/split · POST /v1/keys/{name}/recover · GET /v1/keys/{name}/secret
  • Archives: POST /v1/archives · POST /v1/archives/{name}/split · POST /v1/archives/{name}/recover · POST /v1/archives/{name}/resplit · GET /v1/archives/{name}/envelope · GET /v1/archives/{name}/secret
  • POST /v1/access · GET /v1/status · GET /healthz

​
Travel Rule

Embedded library, no standalone service: TravelRule(...).certify(...) produces a signed, no-PII receipt; seal_ivms101 and open_ivms101 handle the post-quantum IVMS101 exchange; verify_travel_rule_receipt(...) verifies offline.

​
Payment Gateway (8090)

Separately-licensed add-on. One process for every licensed chain; route by network.
  • GET /health · GET /v1/chains (the chain add-ons installed and discovered)
  • POST /v1/intents (create a payment intent) · POST /v1/intents/{id}/check (resolve against the chain)
  • GET /v1/settlements/export (the signed, no-PII settlement pack for the Command Center)
Chain RPC and indexer endpoints are supplied per add-on by environment (bring your own node).

​
Live health into the Command Center

Point any app at the Command Center on 8200 so it self-registers and appears in the console and the control panel posture:

​
Licence

One OEM bundle licence both decrypts the bundle and runs every app (each app also accepts a per-package OEM licence). Provide it via ALGOVOI_LICENSE_KEY or ALGOVOI_LICENSE_FILE. Without a licence the evidence apps fail closed; the control plane does not.