Networking and egress
This page lists every network connection the Hosted Agent makes, so you can write firewall and egress policy for it.
Connection model
The agent is outbound-only. It opens HTTPS connections from your network to the APIsec platform and polls for work. The platform never connects inbound to the agent. In its production (broker) mode the agent runs no HTTP server and listens on no ports, so there is nothing to expose, port-forward, or allowlist inbound.
Required egress
| Destination | Port / protocol | Purpose |
|---|---|---|
api.apisecapps.com (production), or api.<stage>.apisecapps.com for staged environments | TCP 443, HTTPS | All agent-to-platform traffic: instruction polling, scan results, status and heartbeat reports, error reports, certificate status |
| Your target API hosts | Whatever your APIs use | The HTTP requests the agent executes against the APIs you scan |
Your proxy host, only if PROXY_MANAGER=true | Your proxy's port | Carries the agent-to-platform traffic when a proxy is configured |
You do not derive the platform hostname yourself — the generated install command embeds it as MANAGER_HOST_URL. See Manage Hosted Agents for where to download that command.
The install script itself, which runs on the Docker host before the container starts, connects to the same platform host on port 443: a TCP reachability check plus two best-effort pre-flight API calls. It needs no other destinations. The reachability check is a direct TCP connection from the host — it does not use the agent's proxy settings, and the script stops if the check fails.
Proxy behavior
- The agent does not read the host-level proxy environment variables
NO_PROXY,HTTP_PROXY, orHTTPS_PROXY. Setting them — on the Docker host or on the container — has no effect on any agent traffic, and the agent logs no message about them. - The agent's own
PROXY_*settings are the only proxy configuration it honors, and they apply to agent-to-platform traffic only. Requests to your target APIs always go direct from the agent to the target.
See Proxy configuration for setup.
Presenting a stable egress IP
Some target environments restrict callers by source IP. The agent has no fixed egress address of its own — its source IP is whatever your network assigns. If you need the agent's traffic to originate from a predictable address, use standard cloud networking on your side: route the agent's subnet through a NAT gateway with a static public IP attached. This is an infrastructure choice in your environment, not an agent setting.
Domains and IP ranges not listed here
This reference covers the connections the agent itself makes. It does not define any additional platform-side domains or published APIsec IP allowlists — if your firewall policy needs those, confirm the current values with APIsec support rather than reusing lists published for other APIsec components.