Updated 2019-09-13

Access Besu APIs

Access the Hyperledger Besu API using:

Information applying to JSON-RPC, RPC Pub/Sub, and GraphQL is included below.

Enabling API Access

Use the --rpc-http-enabled, --ws-http-enabled, and --graphql-http-enabled options to enable API access.

Service Hosts

Use the --rpc-http-host, --rpc-ws-host, and --graphql-http-host options to specify the host on which the API service listens. The default host is

Set the host to to allow remote connections.


Setting the host to exposes the API service connection on your node to any remote connection. In a production environment, ensure you use a firewall to avoid exposing your node to the internet.

Service Ports

Use the --rpc-http-port, --rpc-ws-port, and --graphql-http-port options to specify the port on which the API service listens.

The default ports are:

  • 8545 for JSON-RPC over HTTP
  • 8546 for JSON-RPC over WebSockets
  • 8547 for GraphQL over HTTP

Ports must be exposed appropriately.

Host Whitelist

To prevent DNS rebinding, incoming HTTP requests, WebSockets connections, and GraphQL requests are only accepted from hostnames specified using the --host-whitelist option. By default, localhost and are accepted.

If your application publishes RPC ports, specify the hostnames when starting Besu.


besu --host-whitelist=example.com

Specify “*” for --host-whitelist to effectively disable host protection.


Specifying “*” for --host-whitelist is not recommended for production code.

Not Supported by Besu

Account Management

Account management relies on private key management in the client which is not implemented by Besu.

Use eth_sendRawTransaction to send signed transactions; eth_sendTransaction is not implemented.

Use third-party wallets for account management.


Besu does not implement the Whisper and Swarm protocols.