> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semicola.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Public URL requirements

> Rules for URLs Semicola calls on your behalf: webhook endpoints, sales-agent endpoints, brand domains and task callbacks.

Some URLs you give Semicola are called later from inside our network: webhook subscriptions, AdCP
push-notification callbacks, a sales agent's endpoint on an inventory source, and the brand domains
we read `brand.json` from. Each must be a public HTTPS endpoint.

## Requirements

Your URL must:

1. Use `https://`.
2. Resolve only to public IP addresses.
3. Carry no user name or password in the URL.

Semicola refuses internal host names, private and loopback addresses, link-local ranges (including the
cloud metadata address `169.254.169.254`), multicast and reserved ranges. A host name that looks public
is also refused when DNS resolves it to a private address; the check runs again when the connection is
made, so DNS rebinding doesn't get around it.

## Redirects

Semicola follows at most 3 redirects and checks every hop against the same rules. Credentials
(`authorization`, cookies) are dropped when a redirect changes origin. Register the final URL rather
than a redirecting one.

## What you'll see

Registering a URL that breaks these rules fails with a validation error naming the field. A
destination that turns unsafe later isn't called.

Use a stable public DNS name, terminate TLS at that host, and test the exact URL from outside your
private network before registering it.