Does Portainer CE API remain exposed before initial admin setup?

API Exposure During Initial Setup

Portainer Community Edition (CE) typically binds to all interfaces on ports 9000 and 9443 by default. While the user interface blocks access until the initial administrator account is created via the setup wizard, the behavior of the underlying API during this pre-configuration state is unclear.

There is a concern regarding whether the API endpoints respond to unauthenticated requests before the admin user exists, potentially leaking system status or version information to any entity that can reach the host IP.

Assuming a standard deployment of the portainer/portainer-ce image without the --no-auth flag:

• Does the API return a 401 Unauthorized response or a 200 OK with error details before the setup wizard is completed?
• Which specific API endpoints are reachable without credentials during this window?