SDK client network egress
This page describes outbound connectivity from your application or CI runner when using the StackGen SDK. It does not cover Guild agent runtime egress (remote runners, LLM providers, integrations).
Summary
| Item | Value |
|---|---|
| Direction | Outbound only from your process |
| Protocol | HTTPS (TLS) |
| Port | 443 |
| Inbound | None required from StackGen to your workers |
Host
Set StackgenConfig.base_url to your mothership root, for example:
https://app.stackgen.com
Do not append /guild or /app/sre — the SDK adds product paths.
Paths (by namespace)
| Namespace | Prefix | Example |
|---|---|---|
| Aiden | {base_url}/guild/api/v1/... |
Webhook trigger, sessions, executions |
| SRE | {base_url}/app/sre/api/v1/... |
Alerts, investigations |
| Vault | {base_url}/vault/v1/... |
(reserved; not in current SDK release) |
Authentication
| Token | Header / query | Used for |
|---|---|---|
API token (stackgen_…) |
Authorization: Bearer … |
Sessions, artifacts, executions, SRE, run polling |
Webhook token (sg_aios_…) |
Same, or apiKey query on trigger |
POST …/webhooks/trigger only |
Org scope: orgId query parameter on Aiden routes when using project-scoped tokens.
Proxy and firewall
- Standard HTTPS proxy env vars (
HTTPS_PROXY,NO_PROXY) apply if your runtime honors them forurllib/fetch. - Allow egress to your mothership hostname on 443.
- No fixed IP list is documented here; use your account team if allowlisting by IP is required.
Data leaving your network
The SDK sends:
- Request URLs, auth headers, and request bodies you provide (alert payloads, Ask messages, etc.)
- Poll GET responses (execution status, artifact metadata, investigation lists)
It does not push telemetry to StackGen beyond normal API traffic.
For Guild agent data egress (LLM prompts, tool results, remote runners), see the StackGen Guild data-egress documentation (agent runtime, not this SDK).