Does Portainer CE API remain exposed before initial admin setup?

Direct answer

Yes. A standard portainer/portainer-ce container binds the API to all interfaces on ports 9000 and 9443 by default, and the setup wizard does not close that port. Before an administrator account exists, the port is reachable, but whether protected API routes return 401 Unauthorized, redirect to setup, or return 200 OK with details depends on the Portainer CE version and is not confirmed by available research.

Confirmed facts

• Default deployment listens on 9000 HTTP and 9443 HTTPS on all interfaces unless container publishing, bind address, host firewall, or network policy restricts it.
• The pre-admin setup state does not by itself close the port or stop the API process.
• TLS on 9443 encrypts traffic but does not authenticate clients; a certificate warning is not authorization.
• This applies to deployments without the --no-auth flag.

Likely behavior, marked for review

• Unauthenticated requests to /api/endpoints, /api/users, and /api/settings are expected to be challenged or redirected to the setup wizard rather than return system data.
• /api/version and /api/status returning 200 OK before admin creation is unverified and version-sensitive; treat any such response as a finding requiring review.
• auth/login, setup/init, and static UI assets are the most likely endpoints reachable without credentials.

Verification steps

1. Start a fresh portainer/portainer-ce container without --no-auth, publish 9000 and 9443, and confirm no administrator exists from container logs or portainer.db.
2. Before creating the admin, run scoped requests from the host:

   curl -i http://127.0.0.1:9000/api/version
   curl -i http://127.0.0.1:9000/api/status
   curl -i http://127.0.0.1:9000/api/endpoints
   curl -i http://127.0.0.1:9000/api/settings

3. Record status codes, WWW-Authenticate, Location, and response bodies for each endpoint, then repeat against 9443 if TLS is enabled.
4. Repeat from a separate test client using a non-loopback host IP permitted by the firewall to confirm reachability beyond localhost.
5. Create the administrator account and compare the same endpoints to isolate pre-setup behavior.

Recommendation

Do not expose Portainer ports to untrusted networks before setup. Keep the host behind a firewall or private network until the administrator account and TLS are configured, then complete setup promptly. An instance left in the pre-admin state on a reachable host is outside the intended secured configuration.

Missing diagnostic detail: which Portainer CE version are you running? Behavior differs across versions, and the version determines whether protected routes return 401, redirect, or 200 before setup.