---
title: "Endpoint profiles"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration-endpoints@main"
source: "Configuration/Endpoints.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# Endpoint profiles {#configuration-endpoints}

A profile binds an approved integration to its origin, methods and narrow
networks. The client obtains its binding through
`EndpointClientFactoryInterface::forEndpoint()` when the trusted
service is constructed. Never derive the profile ID from user fields,
URL parameters or request headers.

## Fields {#configuration-endpoint-fields}

-   **origin**

    -   *Type:* string
    -   *Default:* no default; required

    Exact HTTP or HTTPS origin comprising scheme, host and optional port.
    No path, trailing slash, query, fragment or credentials are allowed.
    For example: `https://erp.internal.example:8443`.
    IPv6 literals require square brackets. Default ports are canonicalized.

-   **allowedCidrs**

    -   *Type:* list\<string>
    -   *Default:* no default; required

    Non-empty list. IPv4 networks must be no broader than /24; IPv6 networks
    no broader than /64. Specify individual addresses as /32 or /128
    respectively. All resolved addresses must match these networks, even
    for an endpoint resolving publicly. Operator restrictions and hard
    metadata restrictions take precedence.

-   **methods**

    -   *Type:* list\<string>
    -   *Default:* no default; required

    Non-empty list of valid HTTP method tokens. Comparison is exact and
    case sensitive. Standard names such as `GET` and
    `POST` are uppercase. `CONNECT` is always excluded.

-   **redirects**

    -   *Type:* string
    -   *Default:* 'none'

    `none` forbids redirects. `same-origin` permits them
    within the same origin, subject to the general redirect limit.
    A redirect does not grant permission to access another endpoint.

-   **allowLoopback**

    -   *Type:* boolean
    -   *Default:* false

    Loopback requires both `true` and exactly one permitted
    /32 IPv4 or /128 IPv6 address. The entire `127.0.0.0/8`
    network remains invalid. This setting does not permit other special
    or metadata addresses.

-   **purpose**

    -   *Type:* string
    -   *Default:* no default; required

    Non-empty UTF-8 purpose with at most 200 characters and no control
    characters. Describe the actual connection, such as ERP order
    synchronization.

-   **owner**

    -   *Type:* string
    -   *Default:* no default; required

    Non-empty responsible team or role, at most 120 UTF-8 characters,
    without control characters. Do not include credentials or personal
    secrets.

-   **reviewAfter**

    -   *Type:* string|null
    -   *Default:* null

    Actual calendar date in `YYYY-MM-DD` format. After that date,
    `config-check` and `doctor` report an overdue review;
    the profile is not disabled automatically.

-   **expiresAt**

    -   *Type:* string|null
    -   *Default:* null

    Actual timestamp with timezone, for example
    `2027-04-01T00:00:00Z`. Optional fractional seconds have at
    most six digits. A date without time or an implicit server timezone
    is not accepted. After expiry, every new attempt is denied, including
    redirects, retries and sends after secret or body preparation.
    Transfers already in progress are not immediately revoked.

## Address classes and revocation {#configuration-endpoint-networks}

A bound permission can allow narrow RFC1918, ULA and CGNAT networks.
Loopback has the additional single-address rule. Link-local, multicast,
documentation networks, special reserved ranges and known metadata
addresses do not receive a general exception.

IPv4-mapped IPv6 targets are classified as their embedded IPv4 address
and compared with IPv4 networks. A configuration such as
`::ffff:10.23.4.12/128` is invalid; use
`10.23.4.12/32` instead.

Profile changes require replacing the configuration snapshot and its
clients. A different registry rejects foreign or outdated contexts.
A client retained in an old worker still owns its old registry: restart
that worker to revoke access operationally. A DNS cache hit bypasses
neither the profile checks of the registry in use nor
`expiresAt`.