Skip to main content
CYPEX Documentation
    Support
    v2.0.0 Latest stable release View changelog ->
    CYPEX — PostgreSQL Application Platform › CYPEX Documentation › Administration Panel › Connector Allowlist

    Connector Allowlist

    2 min read
    Tags administration connectors allowlist security integrations ssrf v2.0.0 Category administration

    Under Integrations → Allowlist, the page heading is Connector Allowlist. It is the set of hosts outbound connectors are permitted to call. Connectors cannot reach any host that is not allowlisted — this is enforced at runtime, not just validated at save time:

    Info
    Enterprise licence required. Integrations is gated on an active enterprise licence. Without one the section does not appear in the admin sidebar, regardless of the signed-in user’s role.

    Connector Allowlist

    Each entry has a Host pattern, a Scope (Global or a specific organization), an optional Note, and an Internal badge when it targets a private-network address.

    Each entry has a Host pattern, a Scope (Global or a specific organization), an optional Note, and an Internal badge when it targets a private-network address.

    Entries are curated by the platform operator:

    • A Global entry applies to every organization.
    • A per-organization entry applies to that organization only.
    • The effective allowlist for an organization is the union of global and its own entries.

    Empty list (manage) — No hosts allowlisted yet / Add a host to permit outbound connectors to call it. Until then, connectors cannot reach any external host. CTA: Add host.

    Empty list (read-only org admin) — No hosts allowlisted / No hosts are currently allowlisted for your organization. Contact your platform operator to request access.

    Click Add host to create an entry:

    Add allowlist host

    Choose a Scope (No organization = global, or pick a specific organization), a Host pattern (exact host or single-label wildcard, e.g. *.github.com), and an optional Note.

    Choose a Scope (No organization = global, or pick a specific organization), a Host pattern (exact host or single-label wildcard, e.g. *.github.com), and an optional Note.

    Internal / local network target

    The Internal / local network target toggle marks an entry as pointing at a private-network address (Docker containers, k8s pods, on-premise hosts). Marking it here is necessary but not sufficient — the platform-wide Allow connectors to reach internal/local network targets switch on the Configuration page must also be on, or the entry is still blocked at runtime with ip_not_allowed.

    See also

    Connector execution Credentials