What Started

IT and security

Firewall and network requirements

All What Started traffic is HTTPS on TCP 443. Diagram: How What Started connects.

Machines: plant network

PLCs, gateways, scripts and PCs running the What Started Agent.

Host Port Protocol Direction Used for
whatstarted.com TCP 443 HTTPS Outbound, with return traffic Pings, agent pairing

People and screens: office network, Wi-Fi or mobile

Browsers, TV screens and phones at QR stickers. These do not need to be on the plant network.

Host Port Protocol Direction Used for
whatstarted.com, www.whatstarted.com TCP 443 HTTPS Outbound, with return traffic App, board, TV screens, operator pages, help
*.supabase.co TCP 443 HTTPS, WebSocket (WSS) Outbound, with return traffic Live updates on the board, machine pages and TV screens; agent downloads
*.stripe.com, *.stripe.network TCP 443 HTTPS Outbound, with return traffic Billing: checkout, card changes, invoices

Without *.supabase.co, pages still work but only update on reload.

Your servers

Host Port Protocol Direction Used for
whatstarted.com TCP 443 HTTPS Outbound, with return traffic Read API
Your webhook URL 443, or the port in the URL HTTPS Inbound to your endpoint Webhooks
  • Webhook URLs must be https:// and reachable from the internet.
  • Webhooks come from cloud hosting with no fixed IP addresses. Verify the Heartbeat-Signature header.
  • Your endpoint must answer within 10 seconds with a 2xx status, or the delivery is retried.

Not used

  • Plain HTTP (port 80). HTTP redirects to HTTPS; pings must use https://.
  • MQTT, OPC UA, Modbus, SSH, UDP and ICMP.
  • Fixed IP addresses. Allow by host name; addresses can change without notice. If the firewall only allows IP addresses, use a proxy that allows by name.
  • The agent's setup page, 127.0.0.1:47100. Local to its own PC; no firewall rule.

TLS and proxies

  • TLS 1.2 or newer. PLCs limited to TLS 1.0 or 1.1, or without TLS, need a gateway, Node-RED or the agent; see Ping from curl, Python or Node-RED.
  • Devices must trust the public certificate authorities and have a correct clock.
  • TLS inspection: exclude whatstarted.com for PLCs and gateways, or install the inspection certificate on them.
  • Agent on Windows: uses the Windows certificate store. Ignores the Windows proxy settings; set the HTTPS_PROXY system environment variable (for example http://proxy.plant.local:8080) and restart the PC.
  • Agent on Linux: add Environment=HTTPS_PROXY=… to the service unit file.
  • DNS: the normal plant or office DNS server.

Email

Alert emails, invitations and sign-in links are sent from @whatstarted.com, for example alerts@whatstarted.com. Add whatstarted.com to allowed senders if your mail filter holds new senders.

Test

From a PC on the machine's network. Expected answer: 401 with Missing or malformed ping token.

curl -i -X POST https://whatstarted.com/api/v1/ping

Windows PowerShell. Expected answer: TcpTestSucceeded : True.

Test-NetConnection whatstarted.com -Port 443

Port open but curl fails with a certificate error: see TLS inspection above.

Summary for an IT ticket

Machines (plant network)
  whatstarted.com            TCP 443  HTTPS

People and screens (office network, Wi-Fi or mobile)
  whatstarted.com            TCP 443  HTTPS
  www.whatstarted.com        TCP 443  HTTPS
  *.supabase.co              TCP 443  HTTPS, WSS   live updates, downloads
  *.stripe.com               TCP 443  HTTPS        billing only
  *.stripe.network           TCP 443  HTTPS        billing only

TLS 1.2+. Allow by host name; IP addresses can change.
Agent setup page 127.0.0.1:47100 is local only.
Email from *@whatstarted.com