Outbound Network Calls

This page applies when you host Earnie yourself. It lists every network call a self-hosted Earnie makes to another host, what each call sends, and how to turn it off or point it at a mirror. Calls between Earnie’s own services aren’t listed. Use it to build a firewall allow-list or to audit what leaves your network. For the short list of destinations to open before you install, see Self-hosting requirements. Settings named on this page live in tenant.env. After you change one, run ./install.sh again from the bundle directory, as in Installing Earnie. Two kinds of call appear below:

On use. A person or an event triggers the call, so an idle Earnie makes none.
Always. The call needs no action from you.

Only the release check is opt-in. The other calls are what the features they serve need.

Calls to SCANOSS

Destination	Purpose	What it sends	Turn off or mirror
SCANOSS API, `api.scanoss.com`	Open-source scan, and licence, vulnerability, and provenance enrichment. During each scan.	File fingerprints, never file content. For each file, an MD5 hash, its size, its relative path, and snippet hashes. Component package URLs for enrichment. Your SCANOSS API key, when one is set.	Set `SCANOSS_API_URL` to your own SCANOSS API. A scan can’t run its open-source stage without an API. A project’s Scan Configuration chooses which scanners it runs.
SCANOSS API	Knowledge base version. Once per scan.	One fixed placeholder fingerprint, with no project data.	As above.
SCANOSS API	Component search and versions in the component picker. When a user searches.	The search text, and a package URL for versions.	As above.
SCANOSS API	SBOM attribution, obligations, copyright holders, and the notice files the API names. When an SBOM or notice report is built.	Component package URLs and versions. Your API key goes with the notice file request.	As above.
SCANOSS API	API key check shown in Integrations. At start when a key is set, and when an administrator runs the key test.	A fixed test message and your API key.	Leave the key unset.
SCANOSS API	The cryptography detection ruleset. When a cryptography scan finds no fresh copy in its cache, at most about once a day.	Your API key.	Don’t enable the cryptography module, or set `SCANOSS_API_URL` to your own API.
SCANOSS API	The matched file shown in the file viewer. When a user opens a matched file.	The file’s hash, and your API key.	Set `SCANOSS_FILE_CONTENT_URL`, which defaults to `SCANOSS_API_URL`, to your own API.
SCANOSS API	Cryptography builds skip dependencies SCANOSS already analysed. During a cryptography build.	A component package URL and version, and your API key.	Set `SCANS_SANDBOX_SCANOSS_LOOKUP=false` to analyse every dependency locally.
SCANOSS AI API, the SCANOSS API by default	AI model matching and identification. During an AI scan.	Model package URLs, the manifest version, and your API key.	Set `SCANOSS_AI_API_URL` and `SCANOSS_AI_API_KEY`. Don’t enable AI provenance. Without a key, Earnie identifies models offline.

What SCANOSS Sees About Your Installation

Every request to the SCANOSS API carries three headers beside your API key:

Header	Value
`User-Agent`	`earnie/<version> (deploy=<mode>)`. The mode is `self-hosted`.
`X-Scanoss-Client-Instance`	An installation id: a random UUID made on first boot. It identifies an installation, never a user, organisation, project, or host. It doesn’t change on restart or upgrade, and it stays the same when you restore a backup. A new database gets a new one.
`X-Request-ID`	The id of the Earnie request that caused the call, or the scan’s id. It’s what you quote in a support case.

These headers can’t be switched off. The way to stop sending them to SCANOSS is to stop calling the SCANOSS API, by pointing SCANOSS_API_URL, SCANOSS_FILE_CONTENT_URL, and SCANOSS_AI_API_URL at your own SCANOSS API. They’re never sent to get.earnie.dev, CISA, GitHub, GitLab, Hugging Face, notification destinations, your identity provider, or package registries.

Calls to Other Services

Destination	Purpose	What it sends	Turn off or mirror
`get.earnie.dev/server/stable`	The release check. At start, then every 24 hours.	A plain `GET`. The `User-Agent` carries the running Earnie version. No API key, cookie, tenant name, or installation id.	Off by default. Leave `EARNIE_RELEASE_CHECK_OPT_IN` false. Set `EARNIE_RELEASE_CHECK_URL` to read the pointer from a mirror.
`www.cisa.gov`	The Known Exploited Vulnerabilities catalogue, for KEV flags and advisories. At start, then every `EARNIE_KEV_REFRESH_INTERVAL_HOURS` (24).	A `GET` with the cache validators from the last answer. Nothing about your installation.	Always on. There is no switch and no URL setting. A host without access keeps serving the last good copy. A firewall rule is the only control.
`api.github.com`, or your GitHub Enterprise Server host	Connect GitHub, list repositories, installation tokens, pull request checks and comments. When an administrator connects or imports, and for each pull request scan.	REST calls with the GitHub App or user token. Pull request comments carry finding titles and links.	Don’t connect GitHub. For Enterprise Server, set `EARNIE_GITHUB_BASE_URL`.
`github.com`, or your GitHub Enterprise Server host	Device sign-in for Connect GitHub. While an administrator connects.	A public client id, the `read:org` scope, and the device code.	Don’t connect GitHub. Enterprise Server needs its own client id, `EARNIE_GITHUB_DEVICE_CLIENT_ID`.
The Git host of a scanned repository	Clone the source to scan. For each scan.	The clone, authenticated with the connection’s token in a request header.	Scan uploaded archives instead.
GitLab, per connection (`gitlab.com` by default)	List repositories, merge request checks and comments. On connect and import, and for each merge request scan.	API calls with the connection’s token.	Don’t connect GitLab. A private CA is supported per connection.
`huggingface.co`	Resolve and list a public model repository. When a user adds a Hugging Face model.	A `GET` for the repository and its file list. No credentials, and no model weights are downloaded.	Don’t add Hugging Face models.
Your identity provider, `OIDC_ISSUER`	Single sign-on. At start when set, and at every sign-in.	The standard OpenID Connect discovery, key set, and code exchange with your client id and secret.	Leave `OIDC_ISSUER` empty for password sign-in only.
Your telemetry collector, `EARNIE_OTLP_ENDPOINT`	The telemetry profile: metrics and service logs. Continuously while the profile is on.	Earnie and host metrics, and every container’s logs.	Leave `EARNIE_OTLP_ENDPOINT` empty. No collector starts.
Package registries, and `SCANS_SANDBOX_MIRROR_CIDRS`	The dependency sandbox resolves Go and Maven trees and builds cryptography dependencies. During a dependency resolve or build.	What the package managers send: package coordinates from your manifests. The sandbox holds no credentials.	Set `SCANS_SANDBOX_GOPROXY` for Go. Set `SCANS_SANDBOX_MIRROR_CIDRS` for Maven or any private mirror. The sandbox can’t reach the SCANOSS API or the public internet outside those ranges.

Notification Destinations

Notification channels call out only after an administrator creates one. See Notifications.

Destination	What it sends	Turn off
Slack, `hooks.slack.com`	The notification’s title and a link to your Earnie host. No finding data.	Delete or disable the channel.
Microsoft Teams, `api.powerplatform.com` or `logic.azure.com`	A card with the title and a link.	Delete or disable the channel.
A webhook URL (HTTPS)	A JSON body with ids, kind, class, title, link, counts, and a timestamp, signed with `X-Earnie-Signature`.	Delete or disable the channel. Private addresses are refused unless `EARNIE_NOTIFICATIONS_ALLOW_PRIVATE_TARGETS=true`.
Your SMTP server	An email with the title and a link, and the SMTP password when the server asks for one.	Delete or disable the channel. Without an email channel, Earnie doesn’t mail password links.

Calls the Host Makes

These calls come from you, or from Docker, not from Earnie itself.

Destination	Purpose	Notes
`get.earnie.dev`	`install.sh` downloads the release bundle and its checksums.	Once per install or upgrade. A host with no access passes `./install.sh <archive>`.
`ghcr.io` and `docker.io`	Docker pulls the images.	Set `EARNIE_API_IMAGE`, `EARNIE_WEB_IMAGE`, and the other `*_IMAGE` settings to point at your own registry.
Let’s Encrypt	The certificate, with `EARNIE_TLS=acme`.	`EARNIE_TLS=custom` makes no certificate authority call.

What Earnie Doesn’t Call

Earnie doesn’t call OSV, doesn’t call any LLM provider, and has no analytics or error-reporting client. The Earnie command line tool is separate. It checks api.github.com for a newer CLI release on the machine that runs it, not on the server. See Earnie CLI.

Auditing the Result

To audit what leaves your network, allow-list only the destinations above that you use, and watch your egress log for the rest. Features you don’t use, such as GitHub, GitLab, Hugging Face, notification channels, single sign-on, and the telemetry profile, AI provenance, and cryptography, make no call until someone configures them. CISA is the one call you can’t turn off in Earnie. To run without the KEV feed, block it at the firewall.

Get Started

Development

Pull Requests & CI

Governance

Evidence & Audit

Administration

Migrating

API Reference

Calls to SCANOSS

What SCANOSS Sees About Your Installation

Calls to Other Services

Notification Destinations

Calls the Host Makes

What Earnie Doesn’t Call

Auditing the Result

​Calls to SCANOSS

​What SCANOSS Sees About Your Installation

​Calls to Other Services

​Notification Destinations

​Calls the Host Makes

​What Earnie Doesn’t Call

​Auditing the Result

Calls to SCANOSS

What SCANOSS Sees About Your Installation

Calls to Other Services

Notification Destinations

Calls the Host Makes

What Earnie Doesn’t Call

Auditing the Result