---
title: Network Traffic
description: Learn about the domains used for the Observability Pipelines Worker.
breadcrumbs: Docs > Observability Pipelines > Configuration > Network Traffic
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Network Traffic

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

The Observability Pipelines Worker communicates with Datadog over HTTPS on port 443 to validate credentials, receive pipeline configurations, and send Worker logs and metrics to Datadog. If your environment restricts outbound traffic, allowlist the domains listed on this page.

## Domains{% #domains %}

The domains depend on the [Datadog Site](https://docs.datadoghq.com/getting_started/site.md) you use. Replace `<DD_SITE>` with ``.

{% tab title="Linux" %}

{% dl %}

{% dt %}
`api.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for API key and pipeline ID validation at startup, including Live Capture status.
{% /dd %}

{% dt %}
`config.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for Remote Configuration pipeline configuration delivery, polled every 5 seconds.
{% /dd %}

{% dt %}
`http-intake.logs.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used to send the Observability Pipelines Worker's operational logs to Datadog.
{% /dd %}

{% dt %}
`*.agent.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used to send Observability Pipelines Worker metrics (`pipelines.*`) to Datadog. A wildcard is required because the subdomain changes with each Worker version. For example, for Worker version 2.15.1, the domain is `2-15-1-observability-pipelines.agent.datadoghq.com`. See [Pipeline Usage Metrics](https://docs.datadoghq.com/observability_pipelines/monitoring_and_troubleshooting/pipeline_usage_metrics.md) for information about the metrics.
{% /dd %}

{% dt %}
`obpipeline-intake.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for Live Capture. See [Live Capture permissions](https://docs.datadoghq.com/observability_pipelines/configuration/live_capture.md#permissions) for more information.
{% /dd %}

{% dt %}
`install.datadoghq.com:443`
{% /dt %}

{% dd %}
**Description**: Used by the one-line install script to download and install the Worker package.
{% /dd %}

{% dt %}
`keys.datadoghq.com:443`
{% /dt %}

{% dd %}
**Description**: Used to download and verify the Datadog package signing keys.
{% /dd %}

{% dt %}
`apt.datadoghq.com:443`
{% /dt %}

{% dd %}
**Description**: Datadog APT repo used to install and upgrade the Worker on Debian-based distributions.
{% /dd %}

{% dt %}
`yum.datadoghq.com:443`
{% /dt %}

{% dd %}
**Description**: Datadog RPM repo used to install and upgrade the Worker on RPM-based distributions.
{% /dd %}

{% /dl %}

### Use wildcards in domains{% #use-wildcards-in-domains %}

Most enterprise firewalls support wildcard rules. If you prefer to allowlist by wildcard instead of listing each domain explicitly, add the following:

{% dl %}

{% dt %}
`*.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches the following domains: - `api.<DD_SITE>` - `config.<DD_SITE>` - `obpipeline-intake.<DD_SITE>`
{% /dd %}

{% dt %}
`*.logs.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches `http-intake.logs.<DD_SITE>`.
{% /dd %}

{% dt %}
`*.datadoghq.com:443`
{% /dt %}

{% dd %}
**Description**: Matches the following domains: - `install.datadoghq.com:443` - `keys.datadoghq.com:443` - `yum.datadoghq.com:443` - `apt.datadoghq.com:443`
{% /dd %}

{% dt %}
`*.agent.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches the version-prefixed Worker metrics domain, such as `2-15-1-observability-pipelines.agent.datadoghq.com`.
{% /dd %}

{% /dl %}

{% /tab %}

{% tab title="Docker, Kubernetes, CloudFormation, ECS Fargate" %}

{% dl %}

{% dt %}
`api.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for API key and pipeline ID validation at startup, including Live Capture status.
{% /dd %}

{% dt %}
`config.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for Remote Configuration pipeline configuration delivery, polled every 5 seconds.
{% /dd %}

{% dt %}
`http-intake.logs.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used to send the Observability Pipelines Worker's operational logs to Datadog.
{% /dd %}

{% dt %}
`*.agent.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used to send Observability Pipelines Worker metrics (`pipelines.*`) reported to your account. A wildcard is required because the subdomain changes with each Worker version. For example for Worker 2.15.1, the domain is `2-15-1-observability-pipelines.agent.datadoghq.com`. See [Pipeline Usage Metrics](https://docs.datadoghq.com/observability_pipelines/monitoring_and_troubleshooting/pipeline_usage_metrics.md) for information about the metrics.
{% /dd %}

{% dt %}
`obpipeline-intake.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Used for Live Capture. See [Live Capture permissions](https://docs.datadoghq.com/observability_pipelines/configuration/live_capture.md#permissions) for more information.
{% /dd %}

{% /dl %}

### Use wildcards in domains{% #use-wildcards-in-domains %}

Most enterprise firewalls support wildcard rules. If you prefer to allowlist by wildcard instead of listing each domain explicitly:

{% dl %}

{% dt %}
`*.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches the following domains: - `api.<DD_SITE>` - `config.<DD_SITE>` - `obpipeline-intake.<DD_SITE>`
{% /dd %}

{% dt %}
`*.logs.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches `http-intake.logs.<DD_SITE>`.
{% /dd %}

{% dt %}
`*.agent.<DD_SITE>:443`
{% /dt %}

{% dd %}
**Description**: Matches the version-prefixed Worker metrics domain, such as `2-15-1-observability-pipelines.agent.datadoghq.com`.
{% /dd %}

{% /dl %}

{% /tab %}