Do I need a Hosted Agent?
You need a Hosted Agent only when APIsec's cloud cannot reach your API directly. If your API is open to the public internet, you can skip it. This page helps you decide in a minute.
What a Hosted Agent is
A Hosted Agent is a small APIsec worker that runs as a container inside your own network. It makes outbound-only connections to APIsec, so nothing connects inbound to your environment. It exists so APIsec can test APIs that its cloud cannot reach on its own.
Make the decision
Start by asking one question: can APIsec's cloud reach your API over the public internet?
| Your API is… | You need a Hosted Agent? |
|---|---|
| Reachable from the public internet | No — APIsec's cloud scans it directly |
| Internal-only, behind a firewall, or on a private network | Yes — a Hosted Agent reaches it from inside your network |
Use a Hosted Agent when your API is:
- Internal-only or not exposed to the internet
- Behind a corporate firewall
- On a private network or VPC
Skip the Hosted Agent when your API is:
- Published to the public internet and reachable without a VPN or private link
tip
Not sure which case you are in? Run a reachability check first. See Reachability to confirm whether APIsec's cloud can reach your API.
Next steps
- Confirm whether your API is reachable: Reachability
- Understand how Hosted Agents work: Understanding Hosted Agents
- Deploy one when you need it: Hosted Agent quickstart