> ## Documentation Index > Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt > Use this file to discover all available pages before exploring further. # Ports and interfaces > Default ports and HTTP interfaces for every service in the AlgoVoi on-prem suite. Every port is overridable and no two defaults collide. The on-prem suite runs as a set of self-hosted services. This is the operator reference for every service's default port and HTTP interface. All ports are overridable (an environment variable, or a Docker `-p host:container` mapping), and no two defaults collide. ## Port map | Port | Service | Licence | Role | | ------- | ------------------------- | ------- | ---------------------------------------------------- | | 8094 | substrate2 control plane | none | web control panel, policy bridge, issuer-trust hub | | 8200 | Compliance Command Center | OEM | evidence console / hub | | 8000 | Records Vault | OEM | write-once document vault | | 8077 | Recovery Vault | OEM | Shamir key and secret recovery | | 8083 | Doc Archive | OEM | write-once archive engine | | 8086 | Compliance Gate | OEM | policy-bound decision engine | | 8087 | Audit Log | OEM | write-once hash-chained audit events | | 8088 | Sanctions Monitor | OEM | sanctions and screening evidence | | 8090 | Payment Gateway | add-on | multi-chain settlement detection and signed receipts | | library | Travel Rule | OEM | embedded library, no standalone service | The [Payment Gateway](/payment-rails-sqlite) is a separately-licensed add-on, not part of the on-prem bundle. It runs as one process on 8090 regardless of how many chain add-ons you license; a request names its `network` and the engine routes it to the matching chain. Ports 8092, 8093, and 8095 are reserved for the substrate-2 services the control plane can bridge (federation validator, ZK receipt, ATB credential verifier) when you run them. ## HTTP interfaces ### substrate2 control plane (8094) Bind with `S2CP_BIND`; admin writes need `Authorization: Bearer `. Reads are open. * `GET /` web control panel: live posture, issuer trust set, policy bridge, audit depth * `GET /health` · `GET /docs` (OpenAPI) * `GET /v1/posture` poll every bridged service and the policy bridge * `GET /v1/issuers` · `POST /v1/issuers` · `DELETE /v1/issuers/{did}` (admin) * `GET /v1/issuer-pks` · `GET /.well-known/atb-keys.json` · `GET /issuers/{did}/atb-keys.json` * `GET /v1/services` · `POST /v1/services` (addon self-register) * **Policy bridge:** `GET /v1/policy` · `POST /v1/policy` (set the active policy, returns its content-addressed `policy_ref`) · `POST /v1/policy/bind` (`subject_ref` to `policy_bound_ref`) * `GET /v1/audit` (admin, HMAC-chained) ### Compliance Command Center (8200) Console login plus a service token for self-registration. * `GET /` dashboard · `GET /health` · `GET /login` · `POST /login` · `GET /logout` * `GET /v1/services` · `POST /v1/services` · `DELETE /v1/services/{name}` * `GET /api/services` · `GET /api/posture` · `GET /export` (consolidated auditor pack) · `GET /validation/pack` · `GET /audit` ### Records Vault (8000) and Doc Archive (8083) Records Vault serves the Doc Archive API over the vault's archive. Bearer token (`RV_ARCHIVE_TOKEN`). * `POST /v1/archive/notarize` · `POST /v1/archive/verify` · `GET /v1/archive/verify-chain` * `GET /v1/archive/retrieve/{doc_hash}` · `GET /v1/archive/entry/{seq}` * `GET /archive/verify` (offline verify portal) · `GET /.well-known/pqc-keys.json` · `GET /health` ### Sanctions Monitor (8088) `MONITOR_PORT`, Bearer token `MONITOR_API_TOKEN`. * `POST /v1/watch` · `DELETE /v1/watch/{subject_ref}` · `POST /v1/sweep` (re-screen, signed deltas) * `GET /v1/watchlist` · `GET /v1/deltas` · `GET /v1/pubkey` · `GET /healthz` ### Compliance Gate (8086) * `POST /v1/compliance/screen` (screen, certify a no-PII verdict) · `POST /v1/compliance/verify` · `GET /compliance/verify` (portal) * `GET /.well-known/pqc-keys.json` · `GET /health` ### Audit Log (8087) * `POST /v1/audit-log/append` · `POST /v1/audit-log/verify` · `GET /v1/audit-log/verify-chain` * `GET /v1/audit-log/entry/{seq}` · `GET /audit-log/verify` (portal) · `GET /.well-known/pqc-keys.json` · `GET /health` ### Recovery Vault (8077) * Keys: `POST /v1/keys` · `POST /v1/keys/{name}/split` · `POST /v1/keys/{name}/recover` · `GET /v1/keys/{name}/secret` * Archives: `POST /v1/archives` · `POST /v1/archives/{name}/split` · `POST /v1/archives/{name}/recover` · `POST /v1/archives/{name}/resplit` · `GET /v1/archives/{name}/envelope` · `GET /v1/archives/{name}/secret` * `POST /v1/access` · `GET /v1/status` · `GET /healthz` ### Travel Rule Embedded library, no standalone service: `TravelRule(...).certify(...)` produces a signed, no-PII receipt; `seal_ivms101` and `open_ivms101` handle the post-quantum IVMS101 exchange; `verify_travel_rule_receipt(...)` verifies offline. ### Payment Gateway (8090) Separately-licensed add-on. One process for every licensed chain; route by `network`. * `GET /health` · `GET /v1/chains` (the chain add-ons installed and discovered) * `POST /v1/intents` (create a payment intent) · `POST /v1/intents/{id}/check` (resolve against the chain) * `GET /v1/settlements/export` (the signed, no-PII settlement pack for the Command Center) Chain RPC and indexer endpoints are supplied per add-on by environment (bring your own node). ## Live health into the Command Center Point any app at the Command Center on 8200 so it self-registers and appears in the console and the control panel posture: ``` CCC_HUB_URL=http://command-center:8200 CCC_HUB_TOKEN= CCC_HUB_NAME= CCC_HUB_SELF_URL=http://: ``` ## Licence One OEM bundle licence both decrypts the bundle and runs every app (each app also accepts a per-package OEM licence). Provide it via `ALGOVOI_LICENSE_KEY` or `ALGOVOI_LICENSE_FILE`. Without a licence the evidence apps fail closed; the control plane does not.