> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Outbound Network Calls > Every network call a self-hosted Earnie makes to another host: where it goes, why, what it sends, and how to turn it off or point it at a mirror. This page applies when you host Earnie yourself. It lists every network call a self-hosted Earnie makes to another host, what each call sends, and how to turn it off or point it at a mirror. Calls between Earnie's own services aren't listed. Use it to build a firewall allow-list or to audit what leaves your network. For the short list of destinations to open before you install, see [Self-hosting requirements](https://docs.scanoss.com/en/latest/earnie/self-hosting/self-hosting-requirements.md#outbound). Settings named on this page live in `tenant.env`. After you change one, run `./install.sh` again from the bundle directory, as in [Installing Earnie](https://docs.scanoss.com/en/latest/earnie/self-hosting/installation.md). Two kinds of call appear below: * **On use.** A person or an event triggers the call, so an idle Earnie makes none. * **Always.** The call needs no action from you. Only the release check is opt-in. The other calls are what the features they serve need. ## Calls to SCANOSS | Destination | Purpose | What it sends | Turn off or mirror | | - | - | - | - | | **SCANOSS API**, `api.scanoss.com` | Open-source scan, and licence, vulnerability, and provenance enrichment. During each scan. | File fingerprints, never file content. For each file, an MD5 hash, its size, its relative path, and snippet hashes. Component package URLs for enrichment. Your SCANOSS API key, when one is set. | Set `SCANOSS_API_URL` to your own SCANOSS API. A scan can't run its open-source stage without an API. A project's Scan Configuration chooses which scanners it runs. | | SCANOSS API | Knowledge base version. Once per scan. | One fixed placeholder fingerprint, with no project data. | As above. | | SCANOSS API | Component search and versions in the component picker. When a user searches. | The search text, and a package URL for versions. | As above. | | SCANOSS API | SBOM attribution, obligations, copyright holders, and the notice files the API names. When an SBOM or notice report is built. | Component package URLs and versions. Your API key goes with the notice file request. | As above. | | SCANOSS API | API key check shown in **Integrations**. At start when a key is set, and when an administrator runs the key test. | A fixed test message and your API key. | Leave the key unset. | | SCANOSS API | The cryptography detection ruleset. When a cryptography scan finds no fresh copy in its cache, at most about once a day. | Your API key. | Don't enable the cryptography module, or set `SCANOSS_API_URL` to your own API. | | SCANOSS API | The matched file shown in the file viewer. When a user opens a matched file. | The file's hash, and your API key. | Set `SCANOSS_FILE_CONTENT_URL`, which defaults to `SCANOSS_API_URL`, to your own API. | | SCANOSS API | Cryptography builds skip dependencies SCANOSS already analysed. During a cryptography build. | A component package URL and version, and your API key. | Set `SCANS_SANDBOX_SCANOSS_LOOKUP=false` to analyse every dependency locally. | | **SCANOSS AI API**, the SCANOSS API by default | AI model matching and identification. During an AI scan. | Model package URLs, the manifest version, and your API key. | Set `SCANOSS_AI_API_URL` and `SCANOSS_AI_API_KEY`. Don't enable AI provenance. Without a key, Earnie identifies models offline. | ### What SCANOSS Sees About Your Installation Every request to the SCANOSS API carries three headers beside your API key: | Header | Value | | - | - | | `User-Agent` | `earnie/ (deploy=)`. The mode is `self-hosted`. | | `X-Scanoss-Client-Instance` | An installation id: a random UUID made on first boot. It identifies an installation, never a user, organisation, project, or host. It doesn't change on restart or upgrade, and it stays the same when you restore a backup. A new database gets a new one. | | `X-Request-ID` | The id of the Earnie request that caused the call, or the scan's id. It's what you quote in a support case. | These headers can't be switched off. The way to stop sending them to SCANOSS is to stop calling the SCANOSS API, by pointing `SCANOSS_API_URL`, `SCANOSS_FILE_CONTENT_URL`, and `SCANOSS_AI_API_URL` at your own SCANOSS API. They're never sent to `get.earnie.dev`, CISA, GitHub, GitLab, Hugging Face, notification destinations, your identity provider, or package registries. ## Calls to Other Services | Destination | Purpose | What it sends | Turn off or mirror | | - | - | - | - | | `get.earnie.dev/server/stable` | The [release check](https://docs.scanoss.com/en/latest/earnie/self-hosting/releases.md#the-release-check). At start, then every 24 hours. | A plain `GET`. The `User-Agent` carries the running Earnie version. No API key, cookie, tenant name, or installation id. | **Off by default.** Leave `EARNIE_RELEASE_CHECK_OPT_IN` false. Set `EARNIE_RELEASE_CHECK_URL` to read the pointer from a mirror. | | `www.cisa.gov` | The Known Exploited Vulnerabilities catalogue, for KEV flags and advisories. At start, then every `EARNIE_KEV_REFRESH_INTERVAL_HOURS` (24). | A `GET` with the cache validators from the last answer. Nothing about your installation. | **Always on.** There is no switch and no URL setting. A host without access keeps serving the last good copy. A firewall rule is the only control. | | `api.github.com`, or your GitHub Enterprise Server host | Connect GitHub, list repositories, installation tokens, pull request checks and comments. When an administrator connects or imports, and for each pull request scan. | REST calls with the GitHub App or user token. Pull request comments carry finding titles and links. | Don't connect GitHub. For Enterprise Server, set `EARNIE_GITHUB_BASE_URL`. | | `github.com`, or your GitHub Enterprise Server host | Device sign-in for **Connect GitHub**. While an administrator connects. | A public client id, the `read:org` scope, and the device code. | Don't connect GitHub. Enterprise Server needs its own client id, `EARNIE_GITHUB_DEVICE_CLIENT_ID`. | | The Git host of a scanned repository | Clone the source to scan. For each scan. | The clone, authenticated with the connection's token in a request header. | Scan uploaded archives instead. | | GitLab, per connection (`gitlab.com` by default) | List repositories, merge request checks and comments. On connect and import, and for each merge request scan. | API calls with the connection's token. | Don't connect GitLab. A private CA is supported per connection. | | `huggingface.co` | Resolve and list a public model repository. When a user adds a Hugging Face model. | A `GET` for the repository and its file list. No credentials, and no model weights are downloaded. | Don't add Hugging Face models. | | Your identity provider, `OIDC_ISSUER` | Single sign-on. At start when set, and at every sign-in. | The standard OpenID Connect discovery, key set, and code exchange with your client id and secret. | Leave `OIDC_ISSUER` empty for password sign-in only. | | Your telemetry collector, `EARNIE_OTLP_ENDPOINT` | The telemetry profile: metrics and service logs. Continuously while the profile is on. | Earnie and host metrics, and every container's logs. | Leave `EARNIE_OTLP_ENDPOINT` empty. No collector starts. | | Package registries, and `SCANS_SANDBOX_MIRROR_CIDRS` | The dependency sandbox resolves Go and Maven trees and builds cryptography dependencies. During a dependency resolve or build. | What the package managers send: package coordinates from your manifests. The sandbox holds no credentials. | Set `SCANS_SANDBOX_GOPROXY` for Go. Set `SCANS_SANDBOX_MIRROR_CIDRS` for Maven or any private mirror. The sandbox can't reach the SCANOSS API or the public internet outside those ranges. | ### Notification Destinations Notification channels call out only after an administrator creates one. See [Notifications](https://docs.scanoss.com/en/latest/earnie/using-earnie/notifications.md). | Destination | What it sends | Turn off | | - | - | - | | Slack, `hooks.slack.com` | The notification's title and a link to your Earnie host. No finding data. | Delete or disable the channel. | | Microsoft Teams, `api.powerplatform.com` or `logic.azure.com` | A card with the title and a link. | Delete or disable the channel. | | A webhook URL (HTTPS) | A JSON body with ids, kind, class, title, link, counts, and a timestamp, signed with `X-Earnie-Signature`. | Delete or disable the channel. Private addresses are refused unless `EARNIE_NOTIFICATIONS_ALLOW_PRIVATE_TARGETS=true`. | | Your SMTP server | An email with the title and a link, and the SMTP password when the server asks for one. | Delete or disable the channel. Without an email channel, Earnie doesn't mail password links. | ## Calls the Host Makes These calls come from you, or from Docker, not from Earnie itself. | Destination | Purpose | Notes | | - | - | - | | `get.earnie.dev` | `install.sh` downloads the release bundle and its checksums. | Once per install or upgrade. A host with no access passes `./install.sh `. | | `ghcr.io` and `docker.io` | Docker pulls the images. | Set `EARNIE_API_IMAGE`, `EARNIE_WEB_IMAGE`, and the other `*_IMAGE` settings to point at your own registry. | | Let's Encrypt | The certificate, with `EARNIE_TLS=acme`. | `EARNIE_TLS=custom` makes no certificate authority call. | ## What Earnie Doesn't Call Earnie doesn't call OSV, doesn't call any LLM provider, and has no analytics or error-reporting client. The Earnie command line tool is separate. It checks `api.github.com` for a newer CLI release on the machine that runs it, not on the server. See [Earnie CLI](https://docs.scanoss.com/en/latest/earnie/using-earnie/earnie-cli.md). ## Auditing the Result To audit what leaves your network, allow-list only the destinations above that you use, and watch your egress log for the rest. Features you don't use, such as GitHub, GitLab, Hugging Face, notification channels, single sign-on, and the telemetry profile, AI provenance, and cryptography, make no call until someone configures them. CISA is the one call you can't turn off in Earnie. To run without the KEV feed, block it at the firewall. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.