Skip to main content
Some URLs you give Semicola are called later from inside our network: webhook subscriptions, AdCP push-notification callbacks, a sales agent’s endpoint on an inventory source, and the brand domains we read brand.json from. Each must be a public HTTPS endpoint.

​
Requirements

Your URL must:
  1. Use https://.
  2. Resolve only to public IP addresses.
  3. Carry no user name or password in the URL.
Semicola refuses internal host names, private and loopback addresses, link-local ranges (including the cloud metadata address 169.254.169.254), multicast and reserved ranges. A host name that looks public is also refused when DNS resolves it to a private address; the check runs again when the connection is made, so DNS rebinding doesn’t get around it.

​
Redirects

Semicola follows at most 3 redirects and checks every hop against the same rules. Credentials (authorization, cookies) are dropped when a redirect changes origin. Register the final URL rather than a redirecting one.

​
What you’ll see

Registering a URL that breaks these rules fails with a validation error naming the field. A destination that turns unsafe later isn’t called. Use a stable public DNS name, terminate TLS at that host, and test the exact URL from outside your private network before registering it.