ArchivesSpace manages archival descriptions, accessions, subjects and repository records. A production deployment may expose a staff interface, a public interface and a backend REST API. Those services serve different audiences and do not share the same exposure expectation. Finding an ArchivesSpace title is the beginning of a service-boundary review, not a finding that archival data is public.
On 2026-10-31, a count-only ZoomEye query returned zero matches for app="ArchivesSpace" and 1,508 for title="ArchivesSpace". The title query ran at 23:44:43 UTC and the application query at 23:44:42 UTC. Both used sub_type=all, page 1 and page size 1. The 1,508 title matches can include documentation, project pages and public reading-room interfaces. The zero application count is not evidence that no backend exists.
ArchivesSpace technical documentation makes the network issue explicit: not every API endpoint requires authentication, and the backend API port should be restricted to trusted addresses. The default backend port is 8089 in the documented examples. A team should know which interface is reachable from the internet and which sits behind a private network, VPN or administrative proxy.
Start with a port and hostname inventory. Map the staff interface, public interface, backend API and search services. Check whether the public site links directly to the backend or whether a reverse proxy exposes an API path under the public hostname. Verify that the backend accepts connections only from expected application servers and administrators. A firewall rule that permits the whole corporate network may be too broad for an API that can create and edit archival records.
Authentication and repository authorization are separate. An ArchivesSpace API user may authenticate successfully but only have access to a subset of repositories. Test list, read, create and update operations with a low-privilege account. Confirm that repository identifiers are enforced in the backend and are not merely hidden by the staff interface. A token or password should not grant every repository because the client omitted a repository context.
The public interface should be reviewed for metadata exposure. Archival description may intentionally include names, dates, collection locations and links to digital objects. Some fields can be restricted in the staff system but still appear in exports, search indexes or finding aids. Compare the public record with the internal record and document any field that was intended to remain private.
Administrative accounts deserve stronger controls than ordinary staff accounts. Require unique accounts, MFA where supported by the surrounding identity layer, short session lifetimes and logging for exports and bulk updates. Review integrations that use the API for migration or synchronization. A script with a shared password can become an unaudited administrator if it is left running after a project ends.
The 1,508 title matches are too broad to treat as a target list. Use them to find candidate services, confirm the installation with an owned hostname, and then test the three-interface model. The useful result is a documented path from public finding aid to metadata, from staff page to authenticated action, and from backend port to network policy. ArchivesSpace security depends on keeping those paths separate.