Network boundaries
Understand Tenvyr's application, agent, and SCIM planes and the connections each requires.
Tenvyr separates user, agent, and provisioning traffic:
| Plane | Production origin | Used by |
|---|---|---|
| Application | https://app.tenvyr.com | Browser console, CLI login, user APIs |
| Agent | https://agents.tenvyr.com | Host enrollment, heartbeat, desired state |
| SCIM | https://scim.tenvyr.com | Identity-provider provisioning |
| Documentation | https://docs.tenvyr.com | Administrators and end users |
Agents connect outbound to the agent plane using their host identity. Tenvyr does not require an inbound management listener on enrolled hosts.
Firewall policy
Allow only the planes a system needs:
- administrators and users need application-plane HTTPS;
- managed hosts need outbound agent-plane HTTPS;
- Entra or another provisioning service needs SCIM-plane HTTPS;
- documentation access is optional for runtime operation.
Do not rewrite agent endpoints to app.tenvyr.com. An agent request sent to the
application plane intentionally returns 404.
Connectivity check
From a candidate host:
curl -i -X POST https://agents.tenvyr.com/agent/v1/enroll \
-H 'Content-Type: application/json' \
--data '{}'A reachable agent plane returns 400 with invalid_enrollment. This test
contains no credential and does not enroll the host.
TLS inspection and proxies
Qualify any TLS interception, egress proxy, or private DNS path before rollout. Agent mTLS and certificate validation must remain intact. Do not install a global trust bypass or disable certificate verification.
Record proxy ownership, allowlist changes, and certificate renewal dependencies in the production runbook.