Egress

Outbound network (egress) requirements for CARTO Self-Hosted

Overview

The CARTO Self-Hosted deployment requires access to some external services. Some are required for the software to work, others depend on the cloud and data warehouse you connect CARTO to, and a final set is optional depending on the features you use. If your environment uses a firewall, proxy, or network policies, you must allow outbound (egress) traffic to these destinations. For these services, HTTP/HTTPS domains must be "accepted".

Required services

Domain	Description
auth.carto.com	CARTO authentication service
*.self-hosted.carto.com	Used to deliver new Self-Hosted releases
docker.io	Needed for downloading the images to execute the Admin Console

Cloud / Data warehouse specific requirements

Depending on the cloud you are deploying and the data warehouse you are using, you will also need to open certain services to connect your data.

Provider	Domain(s)	Description
Google Cloud	bigquery.googleapis.com, oauth2.googleapis.com, bigquerydatatransfer.googleapis.com, www.googleapis.com	Required for BigQuery and CARTO Data Warehouse
Google Cloud	storage.googleapis.com, www.googleapis.com	Access to CARTO platform buckets
AWS	*.amazonaws.com	Required for AWS S3 buckets
Azure	*.blob.core.windows.net	Required for Azure Blob storage
Snowflake	*.snowflakecomputing.com	Required for Snowflake connections
Databricks	*.databricks.com	Required for Databricks connections
Oracle	*.oraclecloud.com	Required for Oracle Autonomous Database on OCI

AI specific requirements

The following egress domains are required depending on which AI provider you configure for CARTO AI. Only whitelist the domains for the providers you intend to use.

Provider	Domain(s)	Notes
OpenAI	api.openai.com	Not needed if configuring a custom Base URL to route through your own proxy
Anthropic	api.anthropic.com
Google AI Studio	generativelanguage.googleapis.com	Gemini API
Google Vertex AI	*-aiplatform.googleapis.com	Region-specific subdomain (e.g., us-central1-aiplatform.googleapis.com)
Azure OpenAI	*.openai.azure.com	The exact domain depends on your Azure resource
AWS Bedrock	See *.amazonaws.com above	Covered in Cloud/Data warehouse section
Snowflake Cortex	See *.snowflakecomputing.com above	Covered in Cloud/Data warehouse section
Databricks	See *.databricks.com above	Covered in Cloud/Data warehouse section
Oracle GenAI	See *.oraclecloud.com above	Covered in Cloud/Data warehouse section
Custom (OpenAI-compatible)	Your custom Base URL	Whitelist your endpoint's domain

LDS specific requirements

These are the requirements for Location Data Services:

Domain	Description
api.tomtom.com	Geocoding and routing
api.traveltimeapp.com	Isolines
isoline.router.hereapi.com	Isolines (if Here is the configured provider)

If you need further and more detailed information, please contact us.

Checklist

• Firewall rules / network policies allow outbound traffic to all required services

• Cloud / data warehouse domains for your providers are allowlisted

• AI provider domains are allowlisted (if using CARTO AI)

• If using an HTTP proxy, CARTO is configured to route traffic through it (see Configure a forward proxy)