---
icon: material/lan-disconnect
title: "Outbound"
description: "What a deployed 10x Engine can send to log10x, the three states that decide whether it happens, and what removes it."
---

# Outbound to log10x

Three streams can reach log10x, all of them addressed by the same
`backendEndpoint`, and as shipped an engine sends none of them because that
endpoint is empty. Two are calls the engine makes about itself and neither
can stop a pipeline. The third is the pipeline's own per-pattern metrics,
which reach log10x only when an operator adds the log10x metric output.

| Property | Value |
|----------|-------|
| Engine version | **1.1.136** |
| Verified against | the shipped 1.1.136 release and images |
| Verified | 2026-10-07 |

## :material-connection: What can be sent

| Call | Route | Method | Body | When |
|------|-------|--------|------|------|
| License enrichment | `api/v1/agent/whoami` | GET | none | Once at startup, then retried at keepalive, at most once every 60 seconds, until it succeeds once |
| Metric write | `api/v1/write` | POST | Prometheus remote-write of the engine's own health series, listed in [Telemetry](telemetry.md) | Every flush tick |
| Per-pattern metrics | the configured metric output | POST | Event counts and byte volumes per pattern, listed in [Telemetry](telemetry.md) | Every flush tick, when `run/output/metric/log10x` is in the config |

The shipped Receiver, Reporter and Retriever configs include no metric
output. Each lists the outputs an operator can turn on, all of them a
backend the customer owns: Prometheus (scrape, push gateway or remote
write), CloudWatch, Datadog, Elastic, or the log. The third row reaches
log10x only when `run/output/metric/log10x` is added and the endpoint is set.

Local ES256 verification against the public keys compiled into the binary is
the license gate, so an unreachable endpoint logs a warning and the engine
runs. A failed metric send trips a circuit breaker for the rest of the run
rather than retrying on every tick.

## :material-tune: When they happen

Two settings decide it.

| Setting | Ships as | Set it with |
|---------|----------|-------------|
| `backendEndpoint` | empty, which is no destination | `TENX_BACKEND_ENDPOINT` |
| License | none, so the engine runs the built-in Free tier | `TENX_LICENSE_KEY` or `TENX_LICENSE_FILE` |

Three states, and only the third makes a call:

1. **No license configured.** The launcher synthesizes the built-in
   [Free tier](../manage/license.md) and forces air-gapped, whatever
   the endpoint says. A downloaded engine run without a token makes no call.
2. **`airgapped=true` (`TENX_AIRGAPPED`).** Honored for every license type,
   including `demo` and `limited`, whatever the endpoint says.
3. **A license plus a configured endpoint.** Everything above is sent. This
   is the state a licensed deployment opts into by naming an endpoint.

In states 1 and 2 the engine builds an environment class that has no HTTP
client, so the silence is structural rather than a flag on a live client.

## :material-package-down: What the shipped configuration produces

The shipped app configs leave `backendEndpoint` empty and the public images
carry no license, so a pulled image on the shipped config is in state 1: no
license, no endpoint, nothing sent. The engine links in no analytics SDK, no
crash reporting and no update check, so there is nothing beyond the streams
above to disable. Every other outbound destination in a running pipeline is
one the deployment configured.

!!! warning "Adding your own metric output does not stop engine telemetry"

    A [metric output](../run/output/metric/index.md) you add carries the
    per-pattern stream to that destination. With `backendEndpoint` set, the
    engine's own two calls still go to log10x whatever metric output is
    configured. Clearing `backendEndpoint` or setting `airgapped=true` is
    what stops them.

## :material-arrow-right-circle-outline: Next

| Page | What is on it |
|------|---------------|
| [Verifying](verifying.md) | The packet capture that settles each state, and the image check |
| [Telemetry](telemetry.md) | Every field these streams carry, typed, with a PII column |