> ## Documentation Index
> Fetch the complete documentation index at: https://docs.testdino.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TestDino Network Endpoints

> Complete list of internet-facing TestDino services, domains, and IP ranges used to send Playwright test results and artifacts securely.

All internet-facing TestDino services and their security configuration.

## Quick Reference

| Section | Description |
| :- | :- |
| [Core Services](#core-services) | Dashboard, reporter/streaming, Public API |
| [Platform Services](#platform-services) | Backend microservice domains |
| [Authentication & Billing](#authentication-and-billing) | Auth endpoints, payment webhooks |
| [Integrations](#integration-services) | GitHub webhooks, third-party connectors |
| [Internal Services](#internal-services) | AI analytics, health checks, artifact storage |
| [Network Security](#network-and-security) | CORS, TLS, rate limiting, security headers |
| [Firewall Config](#firewall-configuration) | Domains to allowlist |

***

## Core Services

| Endpoint | Description |
| :- | :- |
| `app.testdino.com` | Web application: dashboard, test results, analytics, settings |
| `reporter.testdino.com` | Reporter endpoint: receives and streams live test results via token authentication |
| `api.testdino.com/api/v1/public` | Public API v1 (read-only): PAT-authenticated access to test runs, analytics, manual tests, and project health |

## Platform Services

TestDino runs as microservices, each on its own domain. The app and reporter call these server-to-server. CI machines reach TestDino through `app.testdino.com` and `reporter.testdino.com`, not these hosts directly.

| Domain | Service | Purpose |
| :- | :- | :- |
| `api.testdino.com` | Public API / MCP | Read-only Public API v1 and MCP gateway |
| `reporter.testdino.com` | Reporter ingestion | Receives and streams live test results from CI |
| `integration.testdino.com` | Integration | GitHub, Jira, Linear, Slack, and other connectors |
| `billing.testdino.com` | Billing | Plans, usage, and subscription management |
| `user.testdino.com` | User | Accounts, organizations, and access tokens |
| `tcm.testdino.com` | Test Case Management | Manual test suites and cases |

## Authentication and Billing

| Endpoint | Description |
| :- | :- |
| `app.testdino.com/auth` | Login, registration, OAuth callbacks, password reset, email verification |
| `user.testdino.com/api/v1/auth/sso/<org-key>/callback` | SSO login callback (identity-provider redirect URI) |
| `user.testdino.com/scim/v2` | SCIM 2.0 provisioning endpoint: user create, update, and deactivate from your IdP |
| `app.testdino.com/api/v1/webhooks/razorpay` | Payment webhook: receives events from Razorpay (signature-verified) |

## Integration Services

| Endpoint | Description |
| :- | :- |
| `app.testdino.com/api/integrations/v1/github/webhook` | GitHub webhook: push events and PR updates (verified via `X-Hub-Signature-256`) |
| Integration service (internal) | Manages Jira, Linear, Asana, Slack, Monday.com connections. Not internet-facing. Accessed via the app. |

## Internal Services

| Service | Description |
| :- | :- |
| Analytics service (internal) | Project analytics processing. FastAPI/Python. Not internet-facing. |
| `api.testdino.com/health` | Public API health check for monitoring and load balancer probes |
| Object storage | Artifact storage: screenshots, videos, traces. Access via time-limited SAS tokens (48-hour expiry). |

## Network and Security

### CORS

The API enforces strict CORS policies:

* Only explicitly configured origins are allowed (no wildcard `*`)
* Origins are defined per environment via `CORS_ORIGIN` configuration

### TLS

* All endpoints enforce HTTPS (TLS 1.2+)
* HTTP requests redirect to HTTPS
* Certificates are managed via hosting infrastructure

### Rate Limiting

| Endpoint | Limit |
| :- | :- |
| Login | 10 requests / 15 minutes |
| Registration | 5 requests / 15 minutes |
| Email verification | 3 requests / 60 minutes |
| Password reset | 2 requests / 60 minutes |
| Global API | 1,000 requests / 15 minutes |

### Security Headers

All responses include headers via Helmet:

* `Content-Security-Policy` (CSP)
* `X-Frame-Options`
* `X-Content-Type-Options`
* `Strict-Transport-Security` (HSTS)

## Firewall Configuration

If your organization uses network-level allowlisting, add these domains:

| Domain | Required For |
| :- | :- |
| `app.testdino.com` | Dashboard access |
| `reporter.testdino.com` | Reporter submission and live test-result streaming from CI |
| `api.testdino.com` | Public API v1 |
| Object storage domain | Artifact uploads and downloads |

## Related

<CardGroup cols={2}>
  <Card title="What Data We Access" icon="database" href="/security/what-data-we-access">
    Full list of data TestDino collects
  </Card>

  <Card title="Data Retention" icon="clock" href="/security/overview#data-retention">
    Retention periods by tier and data category
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.