Network Flows for Proxies, Firewalls, or WAFs

Some flows depend on your specific configuration. Not all flows are always needed.

Requests served

All servers also serve OPTIONS requests on all URLs to facilitate CORS as configured in the properties file.

Requests served by Email Key Manager (EKM)

EKM should only be available on local LAN or over VPN:

Source	Path	Notes
client	`/v1/keys/private` Methods: GET, PUT
WKD	`/v1/keys/public/{query}` Method: GET	(For WKD Pull Sync)
EAP	`/v1/admin/stats` Method: GET
EAP	`/v1/admin/administrators` Method: GET
EAP	`/v1/admin/end-users` Method: GET
EAP	`/v1/admin/end-users/{email}` Methods: GET, DELETE, POST, PUT
EAP	`/v1/admin/key-pairs` Methods: GET, PUT
EAP	`/v1/admin/key-pairs/fingerprints` Method: GET
EAP	`/v1/admin/key-pairs/public` Method: PUT
EAP	`/v1/admin/key-pairs/key-gen` Method: POST
EAP	`/v1/admin/key-pairs/bulk-modification` Method: PUT
EAP	`/v1/admin/key-pairs/wkd-push-sync-later` Method: PUT	(For WKD Push Sync)
EAP	`/v1/admin/key-pairs/{fingerprint}` Methods: GET, PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/users` Method: PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/private` Method: GET
EAP	`/v1/admin/key-pairs/{fingerprint}/expiration` Method: PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/revocation` Method: PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/rotation` Methods: GET, POST
EAP	`/v1/admin/key-pairs/{fingerprint}/automatic-lifecycle-actions` Method: PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/key-uids` Method: PUT
EAP	`/v1/admin/key-pairs/{fingerprint}/history` Method: GET
EAP	`/v1/admin/key-pairs/{fingerprint}/history/{historyId}` Method: GET
EAP	`/v1/admin/key-pairs/{fingerprint}/history/{historyId}/private` Method: GET
EAP	`/v1/admin/orchestrator-history` Method: GET
EAP	`/v1/admin/key-pairs/{fingerprint}/wkd-push-sync-now` Method: PUT	(For WKD Push Sync)

If you configure EKM/WKD with Pull Sync, you may ignore Push Sync requests and vice versa.

Requests served by Web Key Directory (WKD)

WKD should be available on the public internet on predictable URLs:

Source	Path	Notes
public	`/.well-known/openpgpkey/policy` Method: GET	Direct method
public	`/.well-known/openpgpkey/hu/{hash}` Method: GET, HEAD	Direct method
public	`/.well-known/openpgpkey/{domain}/policy` Method: GET	Advanced method
public	`/.well-known/openpgpkey/{domain}/hu/{hash}` Methods: GET, HEAD	Advanced method
EKM	`/v1/push-sync` Method: PUT	For WKD Push Sync

You may choose to deploy only Direct Method (on your domain https://<domain>/.well-known/...) or only Advanced Method (on https://openpgpkey.<domain>/.well-known/...), or both.

The advanced method is recommended if you foresee the need to handle more than one email domain with a single deployment.

Requests served by FlowCrypt External Service (FES)

FES should be available on the public internet on a predictable URL fes.<domain> for single-tenant deployments. Alternatively, to simplify the deployment, this functionality may be handled by a shared-tenant server flowcrypt.com/api:

Source	Path	Notes
public	`/` Method: GET	Optional
public	`/static/` Method:** GET	Web portal
public	`/message/` Method:* GET	Web portal
public	`/api` Method: GET
public	`/api/health` Method: GET	Optional
public	`/api/v1/account` Method: GET
public	`/api/v1/client-configuration` Method: GET
public	`/api/v1/log-collector/exception` Method: POST	Unused
public	`/api/v1/log-collector/event` Method: POST	Unused
public	`/api/v1/message` Method: POST	Web portal
public	`/api/v1/message/{externalId}/gateway` Method: POST	Web portal
public	`/api/v1/message/{externalId}` Method: GET	Web portal
public	`/api/v1/message/{externalId}/download` Method: GET	Web portal
public	`/api/v1/message/new-reply-token` Method: POST	Web portal
public	`/api/v1/message/{externalId}/reply` Method: POST	Web portal
EAP	`/api/v1/admin/client-configuration` Method: GET

Requests served by Enterprise Admin Panel

Source	Path
admin	`/` Method: GET
admin	`/static/` Method:** GET
admin	`/api` Method: GET
admin	`/api/health` Method: GET
admin	`/login` Methods: GET, POST
admin	`/login/idp/{provider}` Method: GET
admin	`/login/finalize` Method: POST
admin	`/login/cookie-test` Method: GET
admin	`/login/expired` Method: POST
admin	`/login/log-out` Method: POST
admin	`/dashboard` Method: GET
admin	`/stats` Method: GET
admin	`/orchestrator` Method: GET
admin	`/end-users` Method: GET
admin	`/end-users/add` Methods: GET, POST
admin	`/end-users/{email}/key-pairs-csv` Method: GET
admin	`/end-users/{email}` Method: GET
admin	`/end-users/{email}/delete` Method: POST
admin	`/end-users/{email}/rename` Method: POST
admin	`/key-pairs` Method: GET
admin	`/key-pairs/private` Method: POST
admin	`/key-pairs/public` Method: POST
admin	`/key-pairs/generate` Methods: GET, POST
admin	`/key-pairs/bulk-modification` Method: POST
admin	`/key-pairs/{fingerprint}` Method: GET
admin	`/key-pairs/{fingerprint}/users` Methods: GET, POST
admin	`/key-pairs/{fingerprint}/key-uids` Method: POST
admin	`/key-pairs/{fingerprint}/public` Method: GET
admin	`/key-pairs/{fingerprint}/private` Method: GET
admin	`/key-pairs/{fingerprint}/history/{historyId}` Method: GET
admin	`/key-pairs/{fingerprint}/history/{historyId}/public` Method: GET
admin	`/key-pairs/{fingerprint}/history/{historyId}/private` Method: GET
admin	`/key-pairs/{fingerprint}/change-expiration` Methods: GET, POST
admin	`/key-pairs/{fingerprint}/revoke` Method: POST
admin	`/key-pairs/{fingerprint}/rotate` Method: POST
admin	`/key-pairs/{fingerprint}/automatic-lifecycle-actions` Method: POST
admin	`/key-pairs/{fingerprint}/wkd-push-sync-now` Method: POST
admin	`/key-pairs/wkd-push-sync-later` Method: POST
admin	`/client-configuration` Method: GET
admin	`/documentation` Method: GET
admin	`/elements` Method: GET

Initiated Requests (except requests above)

URL Pattern (Method)	Description
The URL from `auth.enduser.openid.jwks` in the properties file or `jwks_uri` in openid-configuration (GET) Response type: application/json Target: External	Use to fetch JWKs to verify the end-user OIDC token signature. Source: `FES` and `EKM`
URL from `auth.admin.openid.jwks` in the properties file or `jwks_uri` in openid-configuration (GET) Response type: application/json Target: External	Use to fetch JWKs to verify the admin OIDC token signature. Source: `FES`, `EAP`, and `EKM`
`https://<enduser-issuer>/.well-known/openid-configuration` (GET) Response type: application/json Target: External	Use to fetch JWKs URL for end-users if `auth.enduser.openid.jwks` isn’t present in the properties file. Source: `FES` and `EKM`
`https://<admin-issuer>/.well-known/openid-configuration` (GET) Response type: application/json Target: External	Use to fetch JWKs and login URLs for admins if `auth.admin.openid.jwks` or `auth.admin.openid.authorize.url` isn’t present in the properties file. Source: `FES`, `EKM`, and `EAP`
WKD RDBMS host (`TCP`) Response type: Socket-based Target: Internal	RDBMS server for the storage of end-user public keys. Source: `WKD`
EKM RDBMS host (`TCP`) Response type: Socket-based Target: Internal	RDBMS server for the storage of end-users and their keys. Source: `EKM`
KMIP host (`TCP`) Response type: Socket-based Target: Internal optional	KMS or HSM server for storing Database Encryption Key. Source: `EKM`
Depends on logging configuration ( - ) Response type: Logging calls are expected when `StackdriverLogger` or `SplunkHttpLogger` is configured. Not needed for `StdoutLogger` and `FileLogger`. Target: -	- Source: `FES`, `EAP`, `EKM`, and`WKD`