developers / api

The WhatPortIs API

Every record on this site, over HTTP, as JSON. Look up a port number, filter 993 services by transport, risk or encryption, and read the same write-ups the pages show. Read-only, open to anyone, no key.

https://whatportis.com/api/v1openapi 3.1 spec →start here

endpoints: 8
ports available: 993
categories: 16
authentication: none
rate limit: none

00 / first request

Quickstart

no key required

One request answers the common question. Pass a port number and you get every service registered on it; pass a slug or a service name and you get that record. data is always an array, so nothing about the shape depends on what you typed.

curl

# what is running on port 443?
curl -s "https://whatportis.com/api/v1/ports/443" | jq '.data[0] | {number, name, encrypted, risk}'

# {
#   "number": 443,
#   "name": "HTTPS",
#   "encrypted": true,
#   "risk": { "score": 4, "level": "caution" }
# }

01 / live

Try It

runs from your browser

These requests go to this deployment, from your browser, with no key — which is the whole point. Edit the path and run it.

presets

02 / how it behaves

Conventions

true of every endpoint

one envelope

Every success puts the payload in data. Collections add meta (totals and paging) and links (self, next, prev). Errors replace data with error. Nothing else appears at the top level.

shape

{
  "data": [ … ],
  "meta": { "total": 993, "count": 25, "limit": 25,
            "offset": 0, "hasMore": true, "sort": "-views" },
  "links": { "self": "…", "next": "…?offset=25", "prev": null }
}

limit / offset paging

limit defaults to 25 and caps at 100; offset skips. Follow links.next and stop when it's null — it carries your filters for you. Ties break on record id, so nothing repeats or slips between pages.

filters compose

Filters intersect; a comma-separated list inside one filter unions. ?protocol=tcp,udp&encrypted=false&range=well-known means “speaks TCP **or** UDP, **and** is cleartext, **and** is well-known”.

sorting

sort takes a field; a leading - reverses it. -views (the default) is most looked-up first, number is numeric order, -risk is riskiest first.

no key, no preflight

There is nothing to sign up for. Access-Control-Allow-Origin: * on every response, so browser code can call it directly — no proxy, no key to leak in a bundle.

versioning

The path carries the version. Inside /api/v1 changes are additive only: new fields and new endpoints may appear, existing ones won't change type or disappear. Anything breaking would land on /api/v2.

response headersaccess-control-allow-origin: *x-api-version: 1cache-control: public, s-maxage=600, stale-while-revalidate=86400

03 / reference

Endpoints

8 · all GET

Every example below was executed against this deployment when the page was rendered — the responses are real, only trimmed where a write-up runs to paragraphs.

get/api/v1

API index

A machine-readable directory of the API: each endpoint, what it does, and where the OpenAPI document lives. Start here if you're writing a client and want to confirm the surface hasn't moved.

returnsAn object listing the API version, endpoints and documentation links.

request — the index

curl -s "https://whatportis.com/api/v1"

response 200

{
  "data": {
    "name": "WhatPortIs API",
    "version": "1",
    "description": "A free, read-only API for the WhatPortIs network port registry. No authentication required.",
    "documentation": "https://whatportis.com/api",
    "openapi": "https://whatportis.com/api/v1/openapi.json",
    "authentication": "none",
    "pagination": {
      "style": "limit/offset",
      "defaultLimit": 25,
      "maxLimit": 100
    },
    "endpoints": [
      {
        "path": "/api/v1",
        "url": "https://whatportis.com/api/v1",
        "summary": "Discover every endpoint from one request.",
        "documentation": "https://whatportis.com/api#index"
      },
      {
        "path": "/api/v1/ports",
        "url": "https://whatportis.com/api/v1/ports",
        "summary": "Filter, sort and page the whole registry.",
        "documentation": "https://whatportis.com/api#list-ports"
      },
      {
        "path": "/api/v1/ports/{port}",
        "url": "https://whatportis.com/api/v1/ports/{port}",
        "summary": "Full detail for a port number or a service slug.",
        "documentation": "https://whatportis.com/api#lookup-port"
      },
      {
        "path": "/api/v1/search",
        "url": "https://whatportis.com/api/v1/search",
        "summary": "One string in, best matches first.",
        "documentation": "https://whatportis.com/api#search"
      },
      {
        "path": "/api/v1/categories",
        "url": "https://whatportis.com/api/v1/categories",
        "summary": "Every category, with how many ports it holds.",
        "documentation": "https://whatportis.com/api#list-categories"
      },
      {
        "path": "/api/v1/categories/{slug}",
        "url": "https://whatportis.com/api/v1/categories/{slug}",
        "summary": "One category and the ports filed under it.",
        "documentation": "https://whatportis.com/api#get-category"
      },
      {
        "path": "/api/v1/stats",
        "url": "https://whatportis.com/api/v1/stats",
        "summary": "What the database is made of, counted live.",
        "documentation": "https://whatportis.com/api#stats"
      },
      {
        "path": "/api/v1/openapi.json",
        "url": "https://whatportis.com/api/v1/openapi.json",
        "summary": "The whole surface as OpenAPI 3.1.",
        "documentation": "https://whatportis.com/api#openapi"
      }
    ]
  }
}

get/api/v1/ports

List ports

The workhorse. Every filter below composes — ask for the cleartext UDP services in the well-known range scoring 6 or above and you get exactly that set, with a total so you know how much you're looking at. Records come back in summary form; fetch one by number or slug for the long-form write-ups.

query parameters

name	type	default	description
q	string	—	Free text. Matches a service name, a slug, or the start of a port number — `q=44` finds 44, 443 and 4433.
number	integer	—	Exact port number, 0–65535.
min	integer	—	Lowest port number to include, inclusive.
max	integer	—	Highest port number to include, inclusive.
range	string[]	—	IANA allocation band: well-known (0–1023), registered (1024–49151) or dynamic (49152–65535).well-knownregistereddynamic
protocol	string[]	—	Transport the service speaks. A port matches if it speaks any listed transport.tcpudpsctp
category	string[]	—	Category slugs. A port matches if it sits in any of them. An unknown slug is an error, not an empty page.
encrypted	boolean	—	Whether the service is encrypted by default.
official	boolean	—	Whether the assignment is registered with IANA.
risk	string[]	—	Risk band: safe (0–2), caution (3–5), risk (6–8), critical (9–10).safecautionriskcritical
riskMin	integer	—	Lowest risk score to include, 0–10, inclusive.
riskMax	integer	—	Highest risk score to include, 0–10, inclusive.
sort	string	-views	Field to order by. A leading `-` reverses it: `number` is ascending, `-number` descending. `views` is how often a port is looked up on the site.views-viewsnumber-numberrisk-riskname-nameupdated-updated
limit	integer	25	How many records to return, 1–100.
offset	integer	0	How many records to skip. Combine with `limit` to page; `links.next` does the arithmetic for you.

returnsAn array of port summary objects.

meta.total counts the whole filtered set, not the page — use it to size a progress bar before you start paging.
Paging is stable: ties are broken by record id, so a record never appears on two pages or falls between them.

request — most looked-up ports

curl -s "https://whatportis.com/api/v1/ports?limit=5"

response 200 — long prose fields abridged

{
  "data": [
    {
      "number": 8888,
      "slug": "8888-sun-answerbook-alt-http",
      "name": "Sun Answerbook & Alt HTTP",
      "brief": "Port 8888 historically hosted Sun Microsystems' AnswerBook DWhttpd server, a technical documentation platform. Nowadays, it is more frequently utilized as an unofficial alternative…",
      "commonUsage": "Alternate HTTP",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Web Services",
          "slug": "web-services"
        },
        {
          "name": "System",
          "slug": "system"
        }
      ],
      "views": 123947,
      "updatedAt": "2026-08-13T12:29:14.830Z",
      "url": "https://whatportis.com/ports/8888-sun-answerbook-alt-http"
    },
    {
      "number": 8000,
      "slug": "8000-intel-remote-desktop",
      "name": "Intel Remote Desktop / Alternate HTTP Port",
      "brief": "Port 8000 is officially allocated to Intel's Remote Desktop Management Interface (iRDMI), though in practice, it is rarely used for this purpose today. Instead, it commonly serves…",
      "commonUsage": "Alternate HTTP port",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 2,
        "level": "safe"
      },
      "categories": [
        {
          "name": "Web Services",
          "slug": "web-services"
        },
        {
          "name": "Remote Access",
          "slug": "remote-access"
        }
      ],
      "views": 84310,
      "updatedAt": "2026-08-13T12:29:15.044Z",
      "url": "https://whatportis.com/ports/8000-intel-remote-desktop"
    },
    {
      "number": 8888,
      "slug": "8888-d2gs-admin-console",
      "name": "D2GS Admin Console",
      "brief": "Port 8888 is commonly associated with the D2GS Admin Console, which provides Telnet-based administrative access to Diablo II Game Servers (D2GS). This console allows server operato…",
      "commonUsage": "Game server admin",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Remote Access",
          "slug": "remote-access"
        },
        {
          "name": "Gaming",
          "slug": "gaming"
        }
      ],
      "views": 83707,
      "updatedAt": "2026-08-13T12:29:15.185Z",
      "url": "https://whatportis.com/ports/8888-d2gs-admin-console"
    },
    {
      "number": 8888,
      "slug": "8888-newsedge",
      "name": "NewsEDGE",
      "brief": "NewsEDGE server is a secure, cloud-based content management system used primarily by news organizations. It facilitates collaboration among journalists, enabling content sharing, s…",
      "commonUsage": "Content Management",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Web Services",
          "slug": "web-services"
        },
        {
          "name": "Cloud",
          "slug": "cloud"
        }
      ],
      "views": 83307,
      "updatedAt": "2026-08-13T12:29:15.329Z",
      "url": "https://whatportis.com/ports/8888-newsedge"
    },
    {
      "number": 8888,
      "slug": "8888-http-alternative-port",
      "name": "HTTP Alternative Port",
      "brief": "**Port 8888** is commonly utilized as an alternative port for HTTP services, and at times HTTPS. While not officially designated for HTTP by the IANA, it is widely adopted by devel…",
      "commonUsage": "HTTP alternative",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Web Services",
          "slug": "web-services"
        }
      ],
      "views": 76451,
      "updatedAt": "2026-08-13T12:29:15.476Z",
      "url": "https://whatportis.com/ports/8888-http-alternative-port"
    }
  ],
  "meta": {
    "total": 993,
    "count": 5,
    "limit": 5,
    "offset": 0,
    "hasMore": true,
    "sort": "-views"
  },
  "links": {
    "self": "https://whatportis.com/api/v1/ports?limit=5",
    "next": "https://whatportis.com/api/v1/ports?limit=5&offset=5",
    "prev": null
  }
}

more examples — open any of these

get/api/v1/ports/{port}

Look up a port

The endpoint you want when you have one string from a firewall log or an nmap scan. Pass a number and you get every service registered on it — port 8888 carries six — or pass a slug or exact service name for that one record. Either way data is an array, so the response shape never depends on what you typed.

path parameters

name	type	default	description
portrequired	string	—	A port number (0–65535) or a service slug such as `https`. Exact service names work too, case-insensitively.

returnsAn array of port detail objects — summary fields plus the technical and security write-ups and external references.

Returns 404 when nothing is registered on that number or under that name — an unregistered port is a fact worth knowing, so it isn't an empty 200.
The two description fields are markdown, not HTML.

request — by slug

curl -s "https://whatportis.com/api/v1/ports/https"

response 200 — long prose fields abridged

{
  "data": [
    {
      "number": 443,
      "slug": "443-https",
      "name": "HTTPS",
      "brief": "HTTPS (Hypertext Transfer Protocol Secure) is the encrypted version of HTTP, which enables secure communication over computer networks. It uses SSL/TLS protocols to encrypt and dec…",
      "commonUsage": "Secure web traffic",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": true,
      "encrypted": true,
      "range": "well-known",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Web Services",
          "slug": "web-services"
        },
        {
          "name": "Security",
          "slug": "security"
        }
      ],
      "views": 65872,
      "updatedAt": "2026-08-13T12:29:16.612Z",
      "url": "https://whatportis.com/ports/443-https",
      "description": {
        "technical": "HTTPS is an extension of HTTP designed to facilitate secure communication over a computer network. It achieves this by leveraging SSL (Secure Sockets Layer) or its successor TLS (T…",
        "security": "**Common Vulnerabilities:**\n- Misconfigured SSL/TLS implementations (obsolete protocols like SSLv2/v3, weak ciphers)\n- Usage of invalid, expired, or self-signed certificates\n- Susc…"
      },
      "references": [],
      "createdAt": "2025-04-08T08:19:25.902Z"
    }
  ],
  "meta": {
    "count": 1,
    "lookup": "https"
  }
}

more examples — open any of these

get/api/v1/search

Search

Same matching as q on the list endpoint, but ranked rather than sorted: an exact number match leads, then an exact name or slug, then prefixes, then anything containing the term — popularity breaks the ties. Use this to power a search box; use /ports when you want a filtered set rather than a best guess.

query parameters

name	type	default	description
qrequired	string	—	The term to search for.
limit	integer	10	How many records to return, 1–100.

returnsAn array of port summary objects, best match first.

Ranking is done over the 250 most looked-up matches, so meta.total stops counting there. A term that broad wants /api/v1/ports?q= instead, which pages through everything.
There's no offset here — a search that needs paging is a filtered list, not a lookup.

request — a service name

curl -s "https://whatportis.com/api/v1/search?q=sql"

response 200 — long prose fields abridged

{
  "data": [
    {
      "number": 118,
      "slug": "118-sql-services",
      "name": "SQL Services",
      "brief": "Port 118 is associated with various SQL (Structured Query Language) services, which provide functionalities related to database management and data querying in client-server archit…",
      "commonUsage": "Database services",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "well-known",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        },
        {
          "name": "Network Services",
          "slug": "network-services"
        }
      ],
      "views": 11690,
      "updatedAt": "2026-08-13T12:30:05.063Z",
      "url": "https://whatportis.com/ports/118-sql-services"
    },
    {
      "number": 156,
      "slug": "156-sql-service",
      "name": "SQL Service",
      "brief": "Port 156 is officially assigned for SQL Services Provided over either TCP or UDP. It typically facilitates communications in distributed database management systems, allowing datab…",
      "commonUsage": "Database communication",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "well-known",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        },
        {
          "name": "Network Services",
          "slug": "network-services"
        }
      ],
      "views": 11150,
      "updatedAt": "2026-08-13T12:30:09.018Z",
      "url": "https://whatportis.com/ports/156-sql-service"
    },
    {
      "number": 1433,
      "slug": "1433-microsoft-sql-server",
      "name": "Microsoft SQL Server",
      "brief": "Port 1433 is the default communication port for Microsoft SQL Server, a popular relational database management system. This port facilitates client-server communication, allowing a…",
      "commonUsage": "Database Access",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        }
      ],
      "views": 14842,
      "updatedAt": "2026-08-13T12:29:47.460Z",
      "url": "https://whatportis.com/ports/1433-microsoft-sql-server"
    },
    {
      "number": 1434,
      "slug": "1434-mssql-monitor",
      "name": "MSSQL Monitor",
      "brief": "Microsoft SQL Server Monitor port facilitates database discovery and management via the SQL Server Resolution Service. It primarily helps clients locate SQL Server instances and dy…",
      "commonUsage": "Database Discovery",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 5,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Security",
          "slug": "security"
        },
        {
          "name": "Databases",
          "slug": "databases"
        },
        {
          "name": "Network Services",
          "slug": "network-services"
        }
      ],
      "views": 14724,
      "updatedAt": "2026-08-13T12:29:48.036Z",
      "url": "https://whatportis.com/ports/1434-mssql-monitor"
    },
    {
      "number": 3306,
      "slug": "3306-mysql",
      "name": "MySQL",
      "brief": "MySQL is one of the most popular open-source relational database management systems (RDBMS), widely used for web applications, data warehousing, and embedded database solutions. It…",
      "commonUsage": "Databases",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        }
      ],
      "views": 13613,
      "updatedAt": "2026-08-13T12:29:52.220Z",
      "url": "https://whatportis.com/ports/3306-mysql"
    },
    {
      "number": 1533,
      "slug": "1533-ibm-sametime-sql-server",
      "name": "IBM Sametime & SQL Server",
      "brief": "Port 1533 is primarily known for IBM Sametime, which is an enterprise instant messaging and collaboration platform, as well as some communication with Microsoft SQL Server componen…",
      "commonUsage": "Enterprise Chat",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 2,
        "level": "safe"
      },
      "categories": [
        {
          "name": "Network Services",
          "slug": "network-services"
        },
        {
          "name": "Voice and Chat",
          "slug": "voice-and-chat"
        }
      ],
      "views": 13526,
      "updatedAt": "2026-08-13T12:29:52.909Z",
      "url": "https://whatportis.com/ports/1533-ibm-sametime-sql-server"
    },
    {
      "number": 5432,
      "slug": "5432-postgresql",
      "name": "PostgreSQL",
      "brief": "PostgreSQL is a powerful, open-source object-relational database system known for its reliability, feature robustness, and strong compliance with industry standards. It supports ad…",
      "commonUsage": "Databases",
      "protocols": [
        "tcp",
        "udp"
      ],
      "transport": {
        "tcp": true,
        "udp": true,
        "sctp": false
      },
      "official": true,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        }
      ],
      "views": 10764,
      "updatedAt": "2026-08-13T12:30:12.388Z",
      "url": "https://whatportis.com/ports/5432-postgresql"
    },
    {
      "number": 19812,
      "slug": "19812-4d-database-sql",
      "name": "4D Database SQL",
      "brief": "Port 19812 is primarily used by the 4D (4th Dimension) database server for SQL communication. This port facilitates the data exchange between 4D client applications and the databas…",
      "commonUsage": "Database Communication",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Databases",
          "slug": "databases"
        },
        {
          "name": "Network Services",
          "slug": "network-services"
        }
      ],
      "views": 8689,
      "updatedAt": "2026-08-13T12:30:40.718Z",
      "url": "https://whatportis.com/ports/19812-4d-database-sql"
    },
    {
      "number": 7306,
      "slug": "7306-zimbra-mysql-mailbox",
      "name": "Zimbra MySQL Mailbox",
      "brief": "Port 7306 is primarily used within Zimbra Collaboration Suite to facilitate database communication between mailbox servers and their associated MySQL backend. As an internal servic…",
      "commonUsage": "Email backend",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Email",
          "slug": "email"
        },
        {
          "name": "Databases",
          "slug": "databases"
        }
      ],
      "views": 6983,
      "updatedAt": "2026-08-13T12:31:01.973Z",
      "url": "https://whatportis.com/ports/7306-zimbra-mysql-mailbox"
    },
    {
      "number": 7307,
      "slug": "7307-zimbra-mysql-logger",
      "name": "Zimbra MySQL Logger",
      "brief": "Port 7307 is utilized by Zimbra Collaboration Suite as a MySQL logger service, supporting backend operations like email indexing, logging, and internal database management. It faci…",
      "commonUsage": "Email Logging",
      "protocols": [
        "tcp"
      ],
      "transport": {
        "tcp": true,
        "udp": false,
        "sctp": false
      },
      "official": false,
      "encrypted": false,
      "range": "registered",
      "risk": {
        "score": 4,
        "level": "caution"
      },
      "categories": [
        {
          "name": "Email",
          "slug": "email"
        },
        {
          "name": "Databases",
          "slug": "databases"
        },
        {
          "name": "System",
          "slug": "system"
        }
      ],
      "views": 6883,
      "updatedAt": "2026-08-13T12:31:03.422Z",
      "url": "https://whatportis.com/ports/7307-zimbra-mysql-logger"
    }
  ],
  "meta": {
    "query": "sql",
    "total": 10,
    "count": 10,
    "limit": 10,
    "hasMore": false
  }
}

more examples — open any of these

get/api/v1/categories

List categories

Categories are how the registry is filed — web, databases, remote access and so on. The slugs here are what the category filter accepts.

returnsAn array of category objects.

request — all categories

curl -s "https://whatportis.com/api/v1/categories"

response 200

{
  "data": [
    {
      "slug": "cloud",
      "name": "Cloud",
      "description": "",
      "portCount": 102,
      "url": "https://whatportis.com/categories/cloud"
    },
    {
      "slug": "databases",
      "name": "Databases",
      "description": "",
      "portCount": 58,
      "url": "https://whatportis.com/categories/databases"
    },
    {
      "slug": "email",
      "name": "Email",
      "description": "",
      "portCount": 42,
      "url": "https://whatportis.com/categories/email"
    },
    {
      "slug": "file-transfer",
      "name": "File Transfer",
      "description": "",
      "portCount": 114,
      "url": "https://whatportis.com/categories/file-transfer"
    },
    {
      "slug": "gaming",
      "name": "Gaming",
      "description": "",
      "portCount": 124,
      "url": "https://whatportis.com/categories/gaming"
    },
    {
      "slug": "iot",
      "name": "IoT",
      "description": "",
      "portCount": 89,
      "url": "https://whatportis.com/categories/iot"
    },
    {
      "slug": "media",
      "name": "Media",
      "description": "",
      "portCount": 41,
      "url": "https://whatportis.com/categories/media"
    },
    {
      "slug": "mobile",
      "name": "Mobile",
      "description": "",
      "portCount": 17,
      "url": "https://whatportis.com/categories/mobile"
    },
    {
      "slug": "network-services",
      "name": "Network Services",
      "description": "",
      "portCount": 604,
      "url": "https://whatportis.com/categories/network-services"
    },
    {
      "slug": "remote-access",
      "name": "Remote Access",
      "description": "",
      "portCount": 110,
      "url": "https://whatportis.com/categories/remote-access"
    },
    {
      "slug": "security",
      "name": "Security",
      "description": "",
      "portCount": 216,
      "url": "https://whatportis.com/categories/security"
    },
    {
      "slug": "streaming",
      "name": "Streaming",
      "description": "",
      "portCount": 30,
      "url": "https://whatportis.com/categories/streaming"
    },
    {
      "slug": "system",
      "name": "System",
      "description": "",
      "portCount": 342,
      "url": "https://whatportis.com/categories/system"
    },
    {
      "slug": "virtualization",
      "name": "Virtualization",
      "description": "",
      "portCount": 13,
      "url": "https://whatportis.com/categories/virtualization"
    },
    {
      "slug": "voice-and-chat",
      "name": "Voice and Chat",
      "description": "",
      "portCount": 120,
      "url": "https://whatportis.com/categories/voice-and-chat"
    },
    {
      "slug": "web-services",
      "name": "Web Services",
      "description": "",
      "portCount": 112,
      "url": "https://whatportis.com/categories/web-services"
    }
  ],
  "meta": {
    "total": 16,
    "count": 16
  }
}

get/api/v1/categories/{slug}

Get a category

The category itself plus a paged list of its ports. Equivalent to filtering /ports by that slug, with the category record attached so you don't need a second request to render a heading.

path parameters

name	type	default	description
slugrequired	string	—	The category slug, as returned by `/api/v1/categories`.

query parameters

name	type	default	description
sort	string	-views	Field to order by. A leading `-` reverses it: `number` is ascending, `-number` descending. `views` is how often a port is looked up on the site.views-viewsnumber-numberrisk-riskname-nameupdated-updated
limit	integer	25	How many records to return, 1–100.
offset	integer	0	How many records to skip. Combine with `limit` to page; `links.next` does the arithmetic for you.

returnsAn object with the category and its ports — an array of port summaries.

request — databases

curl -s "https://whatportis.com/api/v1/categories/databases?limit=5"

response 200 — long prose fields abridged

{
  "data": {
    "category": {
      "slug": "databases",
      "name": "Databases",
      "description": "",
      "portCount": 58,
      "url": "https://whatportis.com/categories/databases"
    },
    "ports": [
      {
        "number": 8882,
        "slug": "8882-atlasz-secure-app-server",
        "name": "Atlasz Secure App Server",
        "brief": "Atlasz Secure Application Server, developed by Atlasz Informatics Research Ltd, provides secure hosting and deployment for enterprise-level distributed applications. Designed to fa…",
        "commonUsage": "Application Hosting",
        "protocols": [
          "tcp"
        ],
        "transport": {
          "tcp": true,
          "udp": false,
          "sctp": false
        },
        "official": false,
        "encrypted": false,
        "range": "registered",
        "risk": {
          "score": 4,
          "level": "caution"
        },
        "categories": [
          {
            "name": "Web Services",
            "slug": "web-services"
          },
          {
            "name": "Databases",
            "slug": "databases"
          },
          {
            "name": "Mobile",
            "slug": "mobile"
          }
        ],
        "views": 66910,
        "updatedAt": "2026-08-13T12:29:16.471Z",
        "url": "https://whatportis.com/ports/8882-atlasz-secure-app-server"
      },
      {
        "number": 9001,
        "slug": "9001-etl-service-manager",
        "name": "ETL Service Manager",
        "brief": "Port 9001 is commonly associated with ETL (Extract, Transform, Load) Service Manager processes. These services facilitate the management, scheduling, and monitoring of ETL workflow…",
        "commonUsage": "ETL orchestration",
        "protocols": [
          "tcp",
          "udp"
        ],
        "transport": {
          "tcp": true,
          "udp": true,
          "sctp": false
        },
        "official": true,
        "encrypted": false,
        "range": "registered",
        "risk": {
          "score": 4,
          "level": "caution"
        },
        "categories": [
          {
            "name": "Databases",
            "slug": "databases"
          },
          {
            "name": "Network Services",
            "slug": "network-services"
          },
          {
            "name": "Cloud",
            "slug": "cloud"
          }
        ],
        "views": 28594,
        "updatedAt": "2026-08-13T12:29:20.708Z",
        "url": "https://whatportis.com/ports/9001-etl-service-manager"
      },
      {
        "number": 2484,
        "slug": "2484-oracle-ssl-listener",
        "name": "Oracle SSL Listener",
        "brief": "Port 2484 is primarily used by Oracle Database systems to accept SSL-encrypted client connections to the Oracle Net Listener service. This secure communication channel ensures conf…",
        "commonUsage": "Oracle SSL Access",
        "protocols": [
          "tcp",
          "udp"
        ],
        "transport": {
          "tcp": true,
          "udp": true,
          "sctp": false
        },
        "official": true,
        "encrypted": true,
        "range": "registered",
        "risk": {
          "score": 4,
          "level": "caution"
        },
        "categories": [
          {
            "name": "Security",
            "slug": "security"
          },
          {
            "name": "Databases",
            "slug": "databases"
          },
          {
            "name": "Network Services",
            "slug": "network-services"
          }
        ],
        "views": 25049,
        "updatedAt": "2026-08-13T12:29:27.960Z",
        "url": "https://whatportis.com/ports/2484-oracle-ssl-listener"
      },
      {
        "number": 5495,
        "slug": "5495-applix-tm1-admin",
        "name": "Applix TM1 Admin",
        "brief": "Port 5495 is primarily used by the Applix TM1 Admin server, which is part of IBM's Cognos TM1 suite for enterprise planning, budgeting, and forecasting solutions. This port facilit…",
        "commonUsage": "BI Administration",
        "protocols": [
          "tcp"
        ],
        "transport": {
          "tcp": true,
          "udp": false,
          "sctp": false
        },
        "official": false,
        "encrypted": false,
        "range": "registered",
        "risk": {
          "score": 4,
          "level": "caution"
        },
        "categories": [
          {
            "name": "Databases",
            "slug": "databases"
          },
          {
            "name": "System",
            "slug": "system"
          },
          {
            "name": "Cloud",
            "slug": "cloud"
          }
        ],
        "views": 24792,
        "updatedAt": "2026-08-13T12:29:28.383Z",
        "url": "https://whatportis.com/ports/5495-applix-tm1-admin"
      },
      {
        "number": 591,
        "slug": "591-filemaker-web-sharing",
        "name": "FileMaker Web Sharing",
        "brief": "Port 591 is commonly used by FileMaker's Web Publishing feature as an alternate HTTP port, allowing clients to access FileMaker databases via a web browser. It serves as an alterna…",
        "commonUsage": "Database Web Access",
        "protocols": [
          "tcp"
        ],
        "transport": {
          "tcp": true,
          "udp": false,
          "sctp": false
        },
        "official": true,
        "encrypted": false,
        "range": "well-known",
        "risk": {
          "score": 4,
          "level": "caution"
        },
        "categories": [
          {
            "name": "Web Services",
            "slug": "web-services"
          },
          {
            "name": "Databases",
            "slug": "databases"
          }
        ],
        "views": 23119,
        "updatedAt": "2026-08-13T12:29:30.671Z",
        "url": "https://whatportis.com/ports/591-filemaker-web-sharing"
      }
    ]
  },
  "meta": {
    "total": 58,
    "count": 5,
    "limit": 5,
    "offset": 0,
    "hasMore": true,
    "sort": "-views"
  },
  "links": {
    "self": "https://whatportis.com/api/v1/categories/databases?limit=5",
    "next": "https://whatportis.com/api/v1/categories/databases?limit=5&offset=5",
    "prev": null
  }
}

get/api/v1/stats

Registry statistics

Aggregate counts across the whole registry: transports, IANA registration, encryption, risk bands and allocation ranges, plus when a record was last corrected. Cheap to poll and useful for dashboards or for sanity-checking a local mirror.

returnsAn object of counts and averages.

request — registry composition

curl -s "https://whatportis.com/api/v1/stats"

response 200

{
  "data": {
    "ports": 993,
    "categories": 16,
    "transport": {
      "tcp": 812,
      "udp": 496,
      "sctp": 4
    },
    "registration": {
      "official": 471,
      "unofficial": 522
    },
    "encryption": {
      "encrypted": 47,
      "cleartext": 946
    },
    "risk": {
      "safe": 59,
      "caution": 934,
      "risk": 0,
      "critical": 0,
      "average": 3.93
    },
    "ranges": {
      "well-known": 251,
      "registered": 741,
      "dynamic": 1
    },
    "updatedAt": "2026-08-13T12:31:38.114Z"
  }
}

get/api/v1/openapi.json

OpenAPI document

Generate a typed client, import into Postman or Insomnia, or point an agent at it. The document is built from the same definitions this page is rendered from, so it describes the API as deployed.

returnsAn OpenAPI 3.1 document.

request — the spec

curl -s "https://whatportis.com/api/v1/openapi.json"

04 / schemas

Objects

also in the openapi document

port

Lists return everything except the four fields marked detail; those arrive when you fetch a port by number or slug.

field	type	description
number	integer	The port number, 0–65535.
slug	string	Stable identifier for the service. Unique across the registry and usable as a path segment.
name	string	Service name as it's normally written.
brief	string	A paragraph describing what runs on the port. Usually plain text, though a few older records still carry inline HTML — sanitise before rendering.
commonUsage	string	The one-line answer to “what is this for”.
protocols	string[]	Transports the service speaks, lowercase — some subset of tcp, udp, sctp.
transport	object	The same information as booleans (`tcp`, `udp`, `sctp`), for callers that would rather test a flag than search an array.
official	boolean	Whether IANA has registered this assignment.
encrypted	boolean	Whether the service is encrypted by default. Not whether it can be — whether it is, out of the box.
range	string	Which IANA band the number falls in: well-known, registered or dynamic.
risk	object	`score` is 0–10; `level` buckets it as safe, caution, risk or critical. It rates exposure of the service as commonly deployed, not of your particular host.
categories	object[]	Categories the port is filed under, each with `name` and `slug`.
views	integer	How often the port has been looked up on whatportis.com. The default sort, and a decent proxy for how commonly it's met in the wild.
updatedAt	string	When the record last changed, ISO 8601.
url	string	The human-readable page for this port.
descriptiondetail	object	Long-form markdown: `technical` covers how the protocol works, `security` covers vulnerabilities and mitigations. Either may be null where nobody has written it yet.
referencesdetail	object[]	External sources — RFCs, vendor docs — each with `title` and `url`.
createdAtdetail	string	When the record was first added, ISO 8601.

What the risk score is not: it rates a service as commonly deployed — telnet is risky wherever it runs — not your host, your version, or your firewall. It is a sorting aid and a prompt to look closer, never a finding.

field	type	description
slug	string	Identifier accepted by the `category` filter.
name	string	Display name.
description	string \| null	What belongs in this category, where it's been written.
portCount	integer	How many ports are filed under it.
url	string	The human-readable page for this category.

Errors

always json

Errors carry the same content type and CORS headers as everything else, and they name what went wrong rather than making you guess. Where a parameter is at fault it appears in error.param, and a fix, where we can suggest one, in error.hint.

status	code	when
400	invalid_parameter	A parameter is the wrong type, out of range, or not one of the accepted values. The body names the offending parameter in `error.param` and often suggests the fix in `error.hint`.
404	not_found	Nothing is registered under that port number, slug or category. Not an error in your request — just an answer of “nothing here”.
405	method_not_allowed	The API is read-only. Anything other than GET, HEAD or OPTIONS is refused, with an `Allow` header saying so.
500	internal_error	Something broke on our side. Retry with backoff; if it persists, it's a bug worth reporting.

GET /api/v1/ports?limit=500 → 400

{
  "error": {
    "status": 400,
    "code": "invalid_parameter",
    "message": "`limit` must be 100 or less, received 500.",
    "param": "limit",
    "docs": "https://whatportis.com/api"
  }
}

06 / in anger

Recipes

copy, paste, adapt

A shell function for “what is this port?”

Drop this in your shell profile and stop opening a browser tab mid-incident.

~/.zshrc

whatportis() {
  curl -s "https://whatportis.com/api/v1/ports/$1" | jq -r '
    .data[] |
    "\(.number)/\(.protocols | join(",")) \(.name)
  \(.commonUsage)
  risk \(.risk.score)/10 (\(.risk.level)) · \(if .encrypted then "encrypted" else "cleartext" end) · \(if .official then "iana" else "unregistered" end)"
  '
}

# $ whatportis 3306
# 3306/tcp,udp MySQL
#   Databases
#   risk 4/10 (caution) · cleartext · iana

Annotate an nmap scan

Turn a column of open ports into a table that says what they are.

annotate.sh

nmap -Pn --open -p- "$1" -oG - \
  | awk -F'Ports: ' '/Ports:/{print $2}' | tr ',' '\n' \
  | awk -F'/' '{print $1}' | tr -d ' ' | sort -un \
  | while read -r port; do
      curl -s "https://whatportis.com/api/v1/ports/$port" \
        | jq -r --arg p "$port" '
            (.data[0] // {name: "unrecognised", risk: {score: 0}}) |
            [$p, .name, (.risk.score | tostring), (if .encrypted then "tls" else "clear" end)] |
            @tsv'
    done | column -t -s $'\t'

Audit for cleartext services

Everything in the well-known range that ships without encryption, riskiest first.

shell

curl -s "https://whatportis.com/api/v1/ports?encrypted=false&range=well-known&sort=-risk&limit=100" \
  | jq -r '.data[] | [.number, .name, .risk.score, .risk.level] | @tsv' \
  | column -t -s $'\t'

Mirror the whole registry

Page through with links.next until it runs out. Ten requests, then cache it and stop asking.

mirror.sh

next="https://whatportis.com/api/v1/ports?limit=100"

while [ -n "$next" ] && [ "$next" != "null" ]; do
  page=$(curl -s "$next")
  echo "$page" | jq -c '.data[]' >> ports.ndjson
  next=$(echo "$page" | jq -r '.links.next')
done

wc -l ports.ndjson

Type-ahead search

The search endpoint ranks exact matches first, so the top hit is usually the one meant.

search.ts

export async function suggest(term: string, signal: AbortSignal) {
  const url = new URL("https://whatportis.com/api/v1/search");
  url.searchParams.set("q", term);
  url.searchParams.set("limit", "8");

  const response = await fetch(url, { signal });
  if (!response.ok) return [];

  const { data } = await response.json();
  return data.map((port) => ({
    label: `${port.number} · ${port.name}`,
    hint: port.commonUsage,
    href: port.url,
  }));
}

07 / the deal

Fair Use

short version: go ahead

use it for anything

Scripts, dashboards, teaching material, commercial products — all fine, and no permission needed. A link back to whatportis.com where it fits is appreciated, not required.

cache what you fetch

There is no rate limit, which only works while nobody needs one. Responses ship with cache headers — honour them, and pull the registry once rather than per page view.

it can be wrong

The data is community-maintained and offered as-is. If a record is wrong, send a correction — it's the fastest way to fix it for everyone.

Last record corrected 2026-08-13. Something missing from this API? The registry is open — tell us what you need.