diff --git a/README.md b/README.md
index aba22ac3..37f8b09a 100644
--- a/README.md
+++ b/README.md
@@ -545,7 +545,19 @@ In some scenarios, the server can send incomplete or corrupted frames. This can
 
 ### HTTP API
 
-TODO
+The server can be queried and controlled with an HTTP API, that must be enabled by setting the `api` parameter in the configuration:
+
+```yml
+api: yes
+```
+
+The API listens on `apiAddress`, that by default is `127.0.0.1:9997`; for instance, to obtain a list of active paths, run:
+
+```
+curl http//127.0.0.1:9997/list
+```
+
+Full documentation of the API is available on the [dedicated site](https://aler9.github.io/rtsp-simple-server/).
 
 ### Command-line usage
 
diff --git a/internal/conf/conf.go b/internal/conf/conf.go
index 063cbe4c..68627f22 100644
--- a/internal/conf/conf.go
+++ b/internal/conf/conf.go
@@ -212,7 +212,7 @@ func (conf *Conf) CheckAndFillMissing() error {
 	}
 
 	if conf.APIAddress == "" {
-		conf.APIAddress = ":9997"
+		conf.APIAddress = "127.0.0.1:9997"
 	}
 
 	if conf.MetricsAddress == "" {
diff --git a/rtsp-simple-server.yml b/rtsp-simple-server.yml
index b4acd13d..1783b57c 100644
--- a/rtsp-simple-server.yml
+++ b/rtsp-simple-server.yml
@@ -21,7 +21,7 @@ readBufferCount: 512
 # enable the HTTP API.
 api: no
 # address of the API listener.
-apiAddress: :9997
+apiAddress: 127.0.0.1:9997
 
 # enable Prometheus-compatible metrics.
 metrics: no