Network & Firewall Requirements

If your organization runs a firewall, proxy, or content filter, your IT team should allow the domains below so Prevu3D products load and function correctly. This page is aimed at IT and network administrators.

These endpoints are shared across the whole Prevu3D solution — the web experiences (RealityPlatform, RealityTwin, and RealityPlan Web), the RealityPlan desktop application and Hub, and the RealityConnect plugins. Allowing them once covers every Prevu3D product your organization uses.

---

Prevu3D service endpoints

Prevu3D products connect to the following domains for the web portal, API, project data, updates, and regional storage:

• Web portal: https://cloud.prevu3d.com/

  • If your organization uses a white-labeled portal, allow your custom subdomain instead — for example, https://your-domain.prevu3d.com/.

• Prevu3D API: https://cloud-api.prevu3d.com/

• Project data and binaries: https://assets-cloud.prevu3d.com/

  • Serves authenticated requests only. A direct URL returns 403 Forbidden — see Testing connectivity.

• Update server: https://hub-binaries.prevu3d.com/

• RealityConnect plugin binaries: https://binaries.prevu3d.com/

  • Plugin installers and thumbnails on Settings > Apps & Plugins. A different host from the update server above — allow both.

• Regional layout / 3D model storage:

  • [Europe] https://prevu3d-production-assets-165572999906-ec1.s3.eu-central-1.amazonaws.com/

  • [US] https://prevu3d-production-assets-165572999906-ue1.s3.amazonaws.com/

  • [Japan] https://prevu3d-production-assets-165572999906-an1.s3.ap-northeast-1.amazonaws.com/

  • [Canada] https://prevu3d-production-assets-165572999906-cc1.s3.ca-central-1.amazonaws.com/

• RealityConnect API (regional):

  • https://api-ec1.prevu3d.com/realityconnect-api

  • https://api-ue1.prevu3d.com/realityconnect-api

  • https://api-an1.prevu3d.com/realityconnect-api

  • https://api-cc1.prevu3d.com/realityconnect-api

Third-party services

A few features load resources from vendor domains rather than from prevu3d.com. Start with the security check: it runs before the portal completes a sign-in, including single sign-on, so users cannot sign in while it is unreachable.

Service	Domains	What depends on it
hCaptcha security check	hcaptcha.com, *.hcaptcha.com	Required for sign-in, including the redirect to your identity provider
Map tiles	api.maptiler.com	The map on the Sites page
Web fonts	fonts.googleapis.com, fonts.gstatic.com	Page typography; text stays readable in a fallback font
Monitoring	*.browser-intake-datadoghq.com	Error reporting that helps support diagnose issues

TLS/SSL inspection

If your organization uses a TLS-intercepting proxy or secure web gateway — Zscaler, Netskope, Palo Alto, Blue Coat, or similar — configure it to bypass SSL inspection for the Prevu3D domains listed above.

Inspection that rewrites URLs, query strings, or headers will break access to project data even though the domains are allowed. The usual symptom is a RealityPlan Hub Cloud tab that stays empty, or thumbnails and projects that never load.

Redirection matters more than inspection

Some gateways answer a request for an allowed domain with an HTTP 302 or 307 redirect to their own hostname. Prevu3D pages carry a Content Security Policy that permits only the vendor domains listed above, so the browser refuses the redirected address and the resource never loads. The most visible symptom is a sign-in that stays on the login page instead of moving on to your identity provider.

Decrypting and inspecting the traffic is fine on its own; rewriting the destination is not. If your proxy logs show a 302 or 307 for hcaptcha.com, add a rule that lets that domain through without redirection. Zscaler, Netskope, Palo Alto and similar gateways all offer one, usually called an authentication bypass or a redirect exemption. Keep inspection enabled if your policy requires it.

Testing connectivity

These checks need no credentials. Five should return 200 OK; assets-cloud.prevu3d.com should return 403 Forbidden.

curl -i https://cloud-api.prevu3d.com/status                     # expect 200 OK
curl -i https://cloud.prevu3d.com/                               # expect 200 OK
curl -i https://hub-binaries.prevu3d.com/                        # expect 200 OK
curl -i https://binaries.prevu3d.com/plugins/revit/thumbnail.png # expect 200 OK
curl -i https://hcaptcha.com/1/api.js                            # expect 200 OK
curl -i https://assets-cloud.prevu3d.com/                        # expect 403 Forbidden

On hcaptcha.com, a 302 or 307 in place of the 200 OK points to the redirection described above, even when the domain itself is allowed.

Caution

On assets-cloud.prevu3d.com, 403 Forbidden is the expected result. That host serves authenticated requests only, so a direct URL is always refused — on every network, including a working one. It is not evidence of a block.

A genuine problem looks different: a connection timeout, a DNS or TLS handshake error, or a 403 returned as an HTML or proxy-branded page rather than a short XML response.

If all six checks behave as described and the issue persists, contact Prevu3D support with a HAR capture of the session from your browser’s developer tools.

We do not maintain a source-IP allowlist for any Prevu3D endpoint. You never need to register your organization’s egress IP ranges with us.

Avatars & third-person view

Configuring an avatar and using third-person view depend on the avatar service. If this domain is blocked, users cannot set up their avatar and third-person mode will not work correctly.

• Avatar service: https://avatar.prevu3d.io/

Note

This applies to RealityTwin and RealityPlan Web (third-person navigation) as well as avatar configuration from Settings > Avatar. See Avatar.

RealityPlan desktop deployment

The RealityPlan desktop application and Hub use the same Prevu3D service endpoints listed above. For desktop-specific installation details — command-line options, files written, and registry keys — see the RealityPlan Deployment Guide.