Environments¶
Where the platform lives and how to reach it from the outside.
Hostnames¶
Every service is reachable at https://<service>.esz.ag — for example
employees.esz.ag, integrations.esz.ag. The service that owns your
integration follows from which entity your system carries; see
Platform and services.
| Environment | Host pattern | Purpose |
|---|---|---|
| Production | <service>.esz.ag |
Live business data. |
| Staging | <service>.esz.info |
Integration testing against non-production data. |
All traffic is HTTPS only. The edge terminates TLS; plain-HTTP requests are redirected, not served.
Sandbox is not optional¶
We do not develop against your production data, and you should not develop against ours. Every integration is built and tested against a sandbox on both sides:
- Your sandbox — a test environment of your API with representative data. Required before engineering starts.
- Our staging — you test webhook delivery and read endpoints against staging, not production.
Egress and allowlisting¶
When we call your API (hop 4) or deliver a webhook, traffic originates from a fixed set of ESZ egress addresses. If your side requires IP allowlisting, raise it in discovery: the addresses must be registered on your side before anything works, and this is a common cause of a first-call failure that looks like an auth problem but is not.
Egress address list: provided per engagement during discovery — ask the owning service's team.
Inbound to us (your calls, your webhooks) needs no allowlisting; the auth on each hop is the control. See Authentication.
Rate limits¶
When you call us, treat a 429 as back-pressure and retry with backoff (see
Errors and retries). When we call you, tell us your
rate limits during discovery and what you return when we hit them (429 with
Retry-After, or a hard block) so we can pace delivery correctly.