SDK client network egress
This page describes outbound connectivity from your application or CI runner when using the StackGen SDK. It does not cover Aiden agent runtime egress (remote runners, LLM providers, integrations).
Summary
| Item | Value |
|---|---|
| Direction | Outbound only from your process |
| Protocol | HTTPS (TLS) |
| Port | 443 |
| Inbound | None required from StackGen to your workers |
Host
Set StackgenConfig.base_url to your mothership root, for example:
https://app.stackgen.com
Do not append /guild or /app/sre — the SDK adds product paths.
Paths (by namespace)
| Namespace | Prefix | Example |
|---|---|---|
| Aiden | {base_url}/guild/api/v1/... |
Webhook trigger, sessions, executions |
| SRE | {base_url}/app/sre/api/v1/... |
Alerts, investigations |
| Vault | {base_url}/api/vault/v1/... |
Store / get / delete secrets |
Authentication
| Token | Header / query | Used for |
|---|---|---|
API token (stackgen_…) |
Authorization: Bearer … |
Sessions, artifacts, executions, SRE, run polling |
Webhook token (sg_aios_…) |
Same, or apiKey query on trigger |
POST …/webhooks/trigger only |
Workspace scope: the workspace ID is sent as the orgId query parameter on Aiden routes.
Proxy and firewall
- Standard HTTPS proxy env vars (
HTTPS_PROXY,NO_PROXY) apply if your runtime honors them forurllib/fetch. - Allow egress to your mothership hostname on 443.
- No fixed IP list is documented here; use your account team if allowlisting by IP is required.
Data leaving your network
The SDK sends:
- Request URLs, auth headers, and request bodies you provide (alert payloads, Ask messages, etc.)
- Poll GET responses (execution status, artifact metadata, investigation lists)
It does not push telemetry to StackGen beyond normal API traffic.
For Aiden agent data egress (LLM prompts, tool results, remote runners), see the Aiden data-egress documentation (agent runtime, not this SDK).