Skip to main content
The Observer Agent is the only component that runs inside your network. The cloud sits across an HTTPS boundary and never reaches back into your network. This page is the explicit description of what crosses that boundary and what stays put.

​
What the agent sends to the cloud

That is the entire surface. There are no other calls to the cloud. The agent’s only other network traffic is the probes you define, sent to the targets you name.

​
What the agent does not send

  • Raw PromQL query strings.
  • Raw HTTP request bodies, response bodies, or response headers.
  • DNS resolver responses. A configured expected_value is matched on the agent; only the reading is sent.
  • TLS certificate chains or certificate details. Only the reading (days until expiry) is sent.
  • Credentials. Secret values named by *_ref fields stay on the agent host: database connection strings, mTLS certificates and keys, auth tokens, secret request headers (header_refs), and secret gRPC metadata (metadata_refs). The cloud stores only the env var names; the agent reads the values locally at probe time.
  • Raw query responses: result sets, response bodies, and log lines behind a reading stay on the host.
  • Agent logs, unless you set BROADCAST_LOGS=true (off by default).
  • Any metric series outside the explicit metric definitions.

​
What the cloud sends to the agent

The response to GET /api/agent/metrics-definitions, the heartbeat acknowledgement, and pending jobs: probe tests (a draft source_type, source_config and thresholds) and CloudWatch “list available metrics” requests. The definitions response shape is the projection in the public @observer/protocol package’s MetricDefinition type. The heartbeat acknowledgement carries a few counters and an opaque definitions version string (see the heartbeat payload reference); it never carries instructions or configuration beyond telling the agent that its definitions changed. The cloud has no path back into your network. It cannot pull from your Prometheus, hit your endpoints, or query your DNS. Every probe runs from the agent’s vantage point.
Why this mattersThe agent fits networks where outbound HTTPS is the only allowed path: one connection to the cloud plus the probe targets you define, and no inbound connections.

​
Trust assumptions

  • The agent trusts the cloud’s TLS certificate by default. Set SKIP_SSL_VERIFICATION=true in development only.
  • The cloud trusts the agent only after the agent presents a valid AGENT_KEY. Keys are bound to a single agent identity and a single organisation.
  • A compromised agent key affects only that agent’s pushes. The cloud restricts each request to the agent’s own organisation; a stolen key cannot read or write across tenants.