The "Allowlist" Guide

Firewall and proxy allowlist domains and URLs required for We360.ai connectivity.

All We360.ai traffic uses HTTPS or WSS on TCP port 443. No other ports are required. These apply identically to Windows and macOS.

Wildcard rules (strongly recommended):

Domain pattern	Notes
*.we360.ai	Covers all We360.ai services
*.in.we360.ai	India-region endpoints

Individual URL fallback list (use if your firewall does not support wildcards):

URL	Purpose
https://portal.we360.ai	Admin portal; delivers installers and agent updates
https://assets.we360.ai	Configuration bundles
https://assets.v2.we360.ai	Configuration bundles (v2)
https://origin.in.we360.ai	Tenant discovery / bootstrap: returns tenant + device manifests (API gateway and auth-server addresses) and version metadata. Carries tenant/device identifiers and install telemetry only — no captured user data. Optional when devices are pre-provisioned with zs-origin.json — may then be blocked entirely (see Pre-Provisioned Origin Data).
https://origin.global.we360.ai	Tenant discovery / bootstrap (see above); same pre-provisioning exemption applies
https://api.in.we360.ai	Primary API endpoint: REST (HTTPS) and real-time livestream (WSS), both on port 443
https://auth.in.we360.ai	Issues and refreshes authentication tokens for agent-to-backend communication
https://<base_domain>.we360.ai	Customer admin console (e.g., acme.we360.ai)

Screen recording & screenshot uploads

Screen recordings and screenshots are uploaded directly from the agent to cloud object storage using short-lived, pre-signed upload links issued by We360.ai. Depending on your deployment, this storage may be hosted on a cloud provider whose hostname sits outside the we360.ai domains.

• If your firewall filters by domain, allow the storage hostname(s) that the pre-signed links resolve to. These vary by deployment — contact We360.ai support for the exact hostname(s) used by your tenant.
• As with all agent traffic, exclude these uploads from SSL/TLS inspection. The upload links are cryptographically signed and a proxy that alters the request will cause the upload to be rejected.
• If this endpoint is unreachable, all other tracking continues normally — only screen recording and screenshot media stays queued on the device and is retried until the connection succeeds.

2.7 Cloudflare IP allowlist

We360.ai sits behind Cloudflare. Domain-based rules are preferred; the IPs below are provided as a supplementary reference for environments where only IP-based rules are possible.

IP	Notes
104.26.15.125	Cloudflare
104.26.14.125	Cloudflare
172.67.72.141	Cloudflare

These addresses may change through Cloudflare anycast re-routing. To future-proof your rules, allow all Cloudflare proxy ranges. The authoritative and machine-readable lists are maintained at:

• Human-readable: https://www.cloudflare.com/ips/
• IPv4 list: https://www.cloudflare.com/ips-v4
• IPv6 list: https://www.cloudflare.com/ips-v6