Egress policy
Where httpRequest may and may not connect.
Schemes: http, https. Methods: GET, POST, PUT, PATCH, DELETE. Redirects are not followed automatically: a redirect Location is a fresh URL that never went through the URL check. The response is never visible to the app.
The check runs twice: on the URL, and again on every resolved address at connect time, so DNS rebinding cannot bypass it.
Blocked
| Range | Why |
|---|---|
127.0.0.0/8, ::1 | loopback — the hub agent’s privileged host API listens here |
169.254.0.0/16, fe80::/10 | link-local, including cloud metadata (169.254.169.254) |
0.0.0.0/8, :: | unspecified / "this network" |
224.0.0.0/4, ff00::/8 | multicast |
Allowed
| Range | Why |
|---|---|
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | RFC1918 — talking to LAN devices is a legitimate smart-app use case |
public internet | webhooks, chat platforms, IFTTT, custom backends |