> ## Documentation Index
> Fetch the complete documentation index at: https://docs.testdino.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TestDino Cloud Endpoints and Domains

> Complete list of internet-facing TestDino services, domains, and IP ranges used to send Playwright test results and artifacts securely.

All internet-facing TestDino services and their security configuration.

## Quick Reference

| Section                                                 | Description                                   |
| :------------------------------------------------------ | :-------------------------------------------- |
| [Core Services](#core-services)                         | Dashboard, reporter/streaming, Public API     |
| [Platform Services](#platform-services)                 | Backend microservice domains                  |
| [Authentication & Billing](#authentication-and-billing) | Auth endpoints, payment webhooks              |
| [Integrations](#integration-services)                   | GitHub webhooks, third-party connectors       |
| [Internal Services](#internal-services)                 | AI analytics, health checks, artifact storage |
| [Network Security](#network-and-security)               | CORS, TLS, rate limiting, security headers    |
| [Firewall Config](#firewall-configuration)              | Domains to allowlist                          |

***

## Core Services

| Endpoint                         | Description                                                                                                   |
| :------------------------------- | :------------------------------------------------------------------------------------------------------------ |
| `app.testdino.com`               | Web application: dashboard, test results, analytics, settings                                                 |
| `reporter.testdino.com`          | Reporter endpoint: receives and streams live test results via token authentication (`TESTDINO_SERVER_URL`)    |
| `api.testdino.com/api/v1/public` | Public API v1 (read-only): PAT-authenticated access to test runs, analytics, manual tests, and project health |

## Platform Services

TestDino runs as microservices, each on its own domain. The app and reporter call these server-to-server. CI machines reach TestDino through `app.testdino.com` and `reporter.testdino.com`, not these hosts directly.

| Domain                     | Service              | Purpose                                           |
| :------------------------- | :------------------- | :------------------------------------------------ |
| `api.testdino.com`         | Public API / MCP     | Read-only Public API v1 and MCP gateway           |
| `reporter.testdino.com`    | Reporter ingestion   | Receives and streams live test results from CI    |
| `integration.testdino.com` | Integration          | GitHub, Jira, Linear, Slack, and other connectors |
| `billing.testdino.com`     | Billing              | Plans, usage, and subscription management         |
| `user.testdino.com`        | User                 | Accounts, organizations, and access tokens        |
| `tcm.testdino.com`         | Test Case Management | Manual test suites and cases                      |

## Authentication and Billing

| Endpoint                                    | Description                                                              |
| :------------------------------------------ | :----------------------------------------------------------------------- |
| `app.testdino.com/auth`                     | Login, registration, OAuth callbacks, password reset, email verification |
| `api.testdino.com/sso/<org-key>/callback`   | SSO login callback (identity-provider redirect URI)                      |
| `app.testdino.com/api/v1/webhooks/razorpay` | Payment webhook: receives events from Razorpay (signature-verified)      |

## Integration Services

| Endpoint                                              | Description                                                                                            |
| :---------------------------------------------------- | :----------------------------------------------------------------------------------------------------- |
| `app.testdino.com/api/integrations/v1/github/webhook` | GitHub webhook: push events and PR updates (verified via `X-Hub-Signature-256`)                        |
| Integration service (internal)                        | Manages Jira, Linear, Asana, Slack, Monday.com connections. Not internet-facing. Accessed via the app. |

## Internal Services

| Service                      | Description                                                                                         |
| :--------------------------- | :-------------------------------------------------------------------------------------------------- |
| Analytics service (internal) | Project analytics processing. FastAPI/Python. Not internet-facing.                                  |
| `api.testdino.com/health`    | Public API health check for monitoring and load balancer probes                                     |
| Azure Blob Storage           | Artifact storage: screenshots, videos, traces. Access via time-limited SAS tokens (48-hour expiry). |

## Network and Security

### CORS

The API enforces strict CORS policies:

* Only explicitly configured origins are allowed (no wildcard `*`)
* Origins are defined per environment via `CORS_ORIGIN` configuration

### TLS

* All endpoints enforce HTTPS (TLS 1.2+)
* HTTP requests redirect to HTTPS
* Certificates are managed via hosting infrastructure

### Rate Limiting

| Endpoint           | Limit                       |
| :----------------- | :-------------------------- |
| Login              | 10 requests / 15 minutes    |
| Registration       | 5 requests / 15 minutes     |
| Email verification | 3 requests / 60 minutes     |
| Password reset     | 2 requests / 60 minutes     |
| Global API         | 1,000 requests / 15 minutes |

### Security Headers

All responses include headers via Helmet:

* `Content-Security-Policy` (CSP)
* `X-Frame-Options`
* `X-Content-Type-Options`
* `Strict-Transport-Security` (HSTS)

## Firewall Configuration

If your organization uses network-level allowlisting, add these domains:

| Domain                    | Required For                                               |
| :------------------------ | :--------------------------------------------------------- |
| `app.testdino.com`        | Dashboard access                                           |
| `reporter.testdino.com`   | Reporter submission and live test-result streaming from CI |
| `api.testdino.com`        | Public API v1                                              |
| Azure Blob Storage domain | Artifact uploads and downloads                             |

## Related

<CardGroup cols={2}>
  <Card title="Access to Customer Data" icon="database" href="/data-privacy/access-to-customer-data">
    Full list of data TestDino collects
  </Card>

  <Card title="Data Retention" icon="clock" href="/data-privacy/data-retention">
    Retention periods by tier and data category
  </Card>
</CardGroup>