I read through the documentation last night. Here on P63 it says there is only a TCP socket in soft AP pass-through mode:
How to use Soft AP mode
When the module is operating in Soft AP provisioning mode, it is waiting for a connection from a STA device. ATAI will be 0x23 because the SSID is not configured. The STA device needs to support Wi-Fi and it needs to have an HTTP browser operating on TCP port 80. Some examples of devices that might connect to the module operating in Soft AP mode are smart phones, tablets, and laptop computers.
The connecting STA device should scan for an AP. The XBee module will advertise an SSID of ‘xbee<MAC>’ where <MAC> is the 6 byte MAC address of the XBee module formatted as follows: xbee-XXXXXXXXXXXX where each X represents a hex digit. The STA needs to connect to that SSID, and then open a browser by entering 192.168.1.10 into the address bar.
This will bring up the web page from the XBee module to allow the module to be configured as desired. The primary purpose of this feature is to configure the device to connect to the desired access point with the desired security settings. The secondary purpose is to configure any other parameters.
The current value of each configuration field is displayed on the web page. The user can enter the desired parameters and then go to the bottom of the page and press the apply button. The selected parameters will be written to the non-volatile memory on the module. However, the network access parameters are only written if a valid set of parameters is entered. The module tests the validity of those parameters by attempting to connect to the given access point. When the module is operating in Soft AP pass through mode, HTTP on port 80 is not used and it operates the same as it would in STA mode with a few expectations:
1. Only one device may connect and the connecting device must be operating in STA mode.
2. A TCP listening socket on the port specified by C0 is open to accept connections, but no UDP listening socket is available.
3. ID specifies the SSID sent by the module in the beacon, but if ID is NULL, it will advertise an SSID based on the MAC address of the module as described in Soft AP provisioning mode.