> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/deployment-and-it-ops/security-and-hardening/network-and-security-hardening/allowlist-guide.md).

# The "Allowlist" Guide

All <code class="expression">space.vars.company\_name</code> traffic uses **HTTPS or WSS on TCP port 443**. No other ports are required. These apply identically to Windows and macOS.

**Wildcard rules (strongly recommended):**

| Domain pattern  | Notes                                                                        |
| --------------- | ---------------------------------------------------------------------------- |
| `*.we360.ai`    | Covers all <code class="expression">space.vars.company\_name</code> services |
| `*.in.we360.ai` | India-region endpoints                                                       |

**Individual URL fallback list** (use if your firewall does not support wildcards):

| URL                              | Purpose                                                                                                                                                                                                                                                                                                                                                                  |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `https://portal.we360.ai`        | Admin portal; delivers installers and agent updates                                                                                                                                                                                                                                                                                                                      |
| `https://assets.we360.ai`        | Configuration bundles                                                                                                                                                                                                                                                                                                                                                    |
| `https://assets.v2.we360.ai`     | Configuration bundles (v2)                                                                                                                                                                                                                                                                                                                                               |
| `https://origin.in.we360.ai`     | Tenant discovery / bootstrap: returns tenant + device manifests (API gateway and auth-server addresses) and version metadata. Carries tenant/device identifiers and install telemetry only — no captured user data. **Optional when devices are pre-provisioned with `zs-origin.json` — may then be blocked entirely (see&#x20;*****Pre-Provisioned Origin Data*****).** |
| `https://origin.global.we360.ai` | Tenant discovery / bootstrap (see above); same pre-provisioning exemption applies                                                                                                                                                                                                                                                                                        |
| `https://api.in.we360.ai`        | Primary API endpoint: REST (HTTPS) and real-time livestream (WSS), both on port 443                                                                                                                                                                                                                                                                                      |
| `https://auth.in.we360.ai`       | Issues and refreshes authentication tokens for agent-to-backend communication                                                                                                                                                                                                                                                                                            |
| `https://<base_domain>.we360.ai` | Customer admin console (e.g., `acme.we360.ai`)                                                                                                                                                                                                                                                                                                                           |

#### Screen recording & screenshot uploads

Screen recordings and screenshots are uploaded directly from the agent to **cloud object storage** using short-lived, pre-signed upload links issued by <code class="expression">space.vars.company\_name</code>. Depending on your deployment, this storage may be hosted on a cloud provider whose hostname sits **outside the `we360.ai` domains**.

* If your firewall filters by domain, allow the storage hostname(s) that the pre-signed links resolve to. These vary by deployment — contact <code class="expression">space.vars.company\_name</code> support for the exact hostname(s) used by your tenant.
* As with all agent traffic, **exclude these uploads from SSL/TLS inspection**. The upload links are cryptographically signed and a proxy that alters the request will cause the upload to be rejected.
* If this endpoint is unreachable, all other tracking continues normally — only screen recording and screenshot media stays queued on the device and is retried until the connection succeeds.

#### 2.7 Cloudflare IP allowlist

<code class="expression">space.vars.company\_name</code> sits behind Cloudflare. Domain-based rules are preferred; the IPs below are provided as a supplementary reference for environments where only IP-based rules are possible.

| IP              | Notes      |
| --------------- | ---------- |
| `104.26.15.125` | Cloudflare |
| `104.26.14.125` | Cloudflare |
| `172.67.72.141` | Cloudflare |

These addresses may change through Cloudflare anycast re-routing. To future-proof your rules, allow all Cloudflare proxy ranges. The authoritative and machine-readable lists are maintained at:

* **Human-readable:** <https://www.cloudflare.com/ips/>
* **IPv4 list:** <https://www.cloudflare.com/ips-v4>
* **IPv6 list:** <https://www.cloudflare.com/ips-v6>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.we360.ai/deployment-and-it-ops/security-and-hardening/network-and-security-hardening/allowlist-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.