# Network Requirements

Defakto components connect to the following public endpoints. Ensure these are accessible from your environment before proceeding with installation. You may need to allow list these endpoints in egress filtering systems for your organization.

## Management tooling[​](#management-tooling "Direct link to Management tooling")

These endpoints are used by Defakto's web UI and [spirlctl](/cli/spirlctl/overview.md).

| Endpoint                      | Purpose                                               |
| ----------------------------- | ----------------------------------------------------- |
| api.defakto.security:443      | Management API (console.defakto.security)             |
| console.defakto.security:443  | Management web UI                                     |
| auth.api.defakto.security:443 | Authentication for the web UI                         |
| api.spirl.com:443             | Management API (legacy app.spirl.com console)         |
| app.spirl.com:443             | Legacy management web UI                              |
| auth.api.spirl.com:443        | Authentication for the spirlctl CLI and legacy web UI |

## Self-hosted Trust Domain Server[​](#self-hosted-trust-domain-server "Direct link to Self-hosted Trust Domain Server")

Self-hosted Trust Domain Servers will connect to these endpoints.

| Endpoint                   | Purpose                                               |
| -------------------------- | ----------------------------------------------------- |
| auth.cp.spirl.com:443      | Authenticates a server with the Control Plane         |
| events.cp.spirl.com:443    | Receives events (e.g. SVID issuance) from servers     |
| relay-web.cp.spirl.com:443 | Persistent management connection to the Control Plane |

## Hosted Trust Domain Server[​](#hosted-trust-domain-server "Direct link to Hosted Trust Domain Server")

Defakto Agents connecting to a hosted Trust Domain Server need access to these endpoints.

| Endpoint               | Purpose                                       |
| ---------------------- | --------------------------------------------- |
| \*.agent.spirl.com:443 | Agent API provided by the Trust Domain Server |

## Federation[​](#federation "Direct link to Federation")

Defakto's federation infrastructure is hosted at these endpoints

| Endpoint          | Purpose                         |
| ----------------- | ------------------------------- |
| fed.spirl.org:443 | SPIFFE Bundle and OIDC metadata |