Skip to main content
Question

Network Allowlist + file `public_url`: is there an official list of S3 hosts?

  • June 26, 2026
  • 1 reply
  • 210 views
mtkacz-soldevelo

Hi,

I'm setting up the monday-code Network Allowlist for our app's backend. The allowlist only accepts explicit FQDNs - no wildcards.

Our server downloads files via the `public_url` returned from the GraphQL `assets` API. Testing across a few accounts I'm already seeing different hostnames, e.g.:

- `prod-euc1-files-monday-com.s3.eu-central-1.amazonaws.com`

- `files-monday-com.s3.amazonaws.com`

 

I assume there are more (other regions, different account configurations). Without an exhaustive list I can't safely turn the allowlist on, because a new region would silently break downloads in production.

 

Questions:

1. Is there an **official, exhaustive list** of hosts that may appear in `assets.public_url`?

2. If not, what's the recommended approach - proxy via a stable `*.monday.com` host, or something else?

 

Has anyone solved this for their app? Thanks!

1 reply

mtkacz-soldevelo
  • mtkacz-soldevelo
  • Author
  • Participating Frequently
  • July 1, 2026

Update: I’ve received the answer from the monday.com support.

I have the official list of Fully Qualified Domain Names (FQDNs) used by monday.com for file assets. As you observed, these URLs depend entirely on the hosting region of the specific account.
 
Since the monday-code Network Allowlist requires explicit entries and does not support wildcards, you will need to add the following four hostnames to reliably proxy file downloads across all regions and account tiers:

  • US (Default/Legacy): files-monday-com.s3.amazonaws.com
  • EU (Frankfurt): prod-euc1-files-monday-com.s3.eu-central-1.amazonaws.com
  • APAC (Sydney): prod-apse2-files-monday-com.s3.ap-southeast-2.amazonaws.com
  • Israel (Tel Aviv): prod-ilc1-files-monday-com.s3.il-central-1.amazonaws.com
Terms & ConditionsAccessibility statement