> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/egress.md). # Egress ## Overview The CARTO Self-Hosted deployment requires access to some external services. Some are required for the software to work, others depend on the cloud and data warehouse you connect CARTO to, and a final set is optional depending on the features you use. If your environment uses a firewall, proxy, or network policies, you must allow outbound (egress) traffic to these destinations. For these services, HTTP/HTTPS domains must be "accepted". ## Required services | Domain | Description | | ------------------------- | -------------------------------------------------------------- | | `auth.carto.com` | CARTO authentication service | | `*.self-hosted.carto.com` | Used to deliver new Self-Hosted releases | | `docker.io` | Needed for downloading the images to execute the Admin Console | ## Cloud / Data warehouse specific requirements Depending on the cloud you are deploying and the data warehouse you are using, you will also need to open certain services to connect your data. | Provider | Domain(s) | Description | | ------------ | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | Google Cloud | `bigquery.googleapis.com`, `oauth2.googleapis.com`, `bigquerydatatransfer.googleapis.com`, `www.googleapis.com` | Required for BigQuery and [CARTO Data Warehouse](/carto-self-hosted/configuration/data-and-storage/enable-the-carto-data-warehouse.md) | | Google Cloud | `storage.googleapis.com`, `www.googleapis.com` | Access to CARTO platform [buckets](/carto-self-hosted/configuration/data-and-storage/configure-your-own-buckets.md) | | AWS | `*.amazonaws.com` | Required for AWS S3 [buckets](/carto-self-hosted/configuration/data-and-storage/configure-your-own-buckets.md) | | Azure | `*.blob.core.windows.net` | Required for [Azure Blob storage](/carto-self-hosted/configuration/data-and-storage/configure-your-own-buckets.md) | | Snowflake | `*.snowflakecomputing.com` | Required for Snowflake connections | | Databricks | `*.databricks.com` | Required for Databricks connections | | Oracle | `*.oraclecloud.com` | Required for Oracle Autonomous Database on OCI | ## AI specific requirements The following egress domains are required depending on which AI provider you configure for [CARTO AI](/carto-user-manual/settings/carto-ai.md). Only whitelist the domains for the providers you intend to use. | Provider | Domain(s) | Notes | | -------------------------------------------------------------------------------------- | ------------------------------------ | --------------------------------------------------------------------------- | | [OpenAI](https://platform.openai.com/docs/api-reference) | `api.openai.com` | Not needed if configuring a custom Base URL to route through your own proxy | | [Anthropic](https://docs.anthropic.com/en/api/getting-started) | `api.anthropic.com` | | | [Google AI Studio](https://ai.google.dev/gemini-api/docs) | `generativelanguage.googleapis.com` | Gemini API | | [Google Vertex AI](https://cloud.google.com/vertex-ai/docs) | `*-aiplatform.googleapis.com` | Region-specific subdomain (e.g., `us-central1-aiplatform.googleapis.com`) | | [Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-services/openai/) | `*.openai.azure.com` | The exact domain depends on your Azure resource | | [AWS Bedrock](https://docs.aws.amazon.com/bedrock/) | See `*.amazonaws.com` above | Covered in Cloud/Data warehouse section | | [Snowflake Cortex](https://docs.snowflake.com/en/user-guide/snowflake-cortex) | See `*.snowflakecomputing.com` above | Covered in Cloud/Data warehouse section | | [Databricks](https://docs.databricks.com/en/machine-learning/model-serving/index.html) | See `*.databricks.com` above | Covered in Cloud/Data warehouse section | | [Oracle GenAI](https://docs.oracle.com/en-us/iaas/Content/generative-ai/home.htm) | See `*.oraclecloud.com` above | Covered in Cloud/Data warehouse section | | Custom (OpenAI-compatible) | Your custom Base URL | Whitelist your endpoint's domain | ## LDS specific requirements These are the requirements for [Location Data Services](/carto-for-developers/key-concepts/apis.md#location-data-services-lds): | Domain | Description | | ---------------------------- | --------------------------------------------- | | `api.tomtom.com` | Geocoding and routing | | `api.traveltimeapp.com` | Isolines | | `isoline.router.hereapi.com` | Isolines (if Here is the configured provider) | {% hint style="info" %} If you need further and more detailed information, please [contact us.](mailto:support@carto.com) {% endhint %} ## Checklist * [ ] Firewall rules / network policies allow outbound traffic to all required services * [ ] Cloud / data warehouse domains for your providers are allowlisted * [ ] AI provider domains are allowlisted (if using CARTO AI) * [ ] If using an HTTP proxy, CARTO is configured to route traffic through it (see [Configure a forward proxy](/carto-self-hosted/configuration/networking/configure-an-external-proxy.md)) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/egress.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.