From 1f73ea6d6a64060377afdfd36fda218af6ac5e17 Mon Sep 17 00:00:00 2001
From: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Date: Tue, 14 Nov 2023 02:43:18 +0900
Subject: [PATCH] Guide for which API endpoints to expose (#15118)

Added a guide for which API endpoints to expose and fixed an associated
broken link. See https://github.com/fleetdm/fleet/issues/15115 for
context.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Manual QA for all new/changed functionality
---
 ...points-to-expose-to-the-public-internet.md | 45 +++++++++++++++++++
 .../fleet-server-configuration.md             |  2 +-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 articles/what-api-endpoints-to-expose-to-the-public-internet.md

diff --git a/articles/what-api-endpoints-to-expose-to-the-public-internet.md b/articles/what-api-endpoints-to-expose-to-the-public-internet.md
new file mode 100644
index 0000000000..96c5e535b7
--- /dev/null
+++ b/articles/what-api-endpoints-to-expose-to-the-public-internet.md
@@ -0,0 +1,45 @@
+# Which API endpoints to expose to the public internet?
+
+This guide details which API endpoints to make publicly accessible.
+
+## Managing hosts that can travel outside VPN or intranet
+
+If you would like to manage hosts that can travel outside your VPN or intranet, we recommend only exposing the osquery endpoints to the public internet:
+
+- `/api/osquery`
+- `/api/v1/osquery`
+
+## Using Fleet Desktop on remote devices
+
+If you are using Fleet Desktop and want it to work on remote devices, the bare minimum API to expose is `/api/latest/fleet/device/*/desktop`. This minimal endpoint will only provide the number of failing policies.
+
+For full Fleet Desktop and scripts functionality, `/api/fleet/orbit/*` and`/api/fleet/device/ping` must also be exposed.
+
+## Using fleetctl CLI from outsite of your network
+
+If you would like to use the fleetctl CLI from outside of your network, the following endpoints will also need to be exposed for `fleetctl`:
+
+- `/api/setup`
+- `/api/v1/setup`
+- `/api/latest/fleet/*`
+- `/api/v1/fleet/*`
+
+## Using Fleet's MDM features
+
+If you would like to use Fleet's MDM features, the following endpoints need to be exposed:
+
+- `/mdm/apple/scep` to allow hosts to obtain a SCEP certificate.
+- `/mdm/apple/mdm` to allow hosts to reach the server using the MDM protocol.
+- `/api/mdm/apple/enroll` to allow DEP-enrolled devices to get an enrollment profile.
+- `/api/*/fleet/device/*/mdm/apple/manual_enrollment_profile` to allow manually enrolled devices to
+  download an enrollment profile.
+
+> The `/mdm/apple/scep` and `/mdm/apple/mdm` endpoints are outside of the `/api` path because they
+> are not RESTful and are not intended for use by API clients or browsers.
+
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="mike-j-thomas">
+<meta name="authorFullName" value="Mike Thomas">
+<meta name="publishedOn" value="2023-11-13">
+<meta name="articleTitle" value="Which API endpoints to expose to the public internet?">
\ No newline at end of file
diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md
index e13b3822e4..313060ee75 100644
--- a/docs/Configuration/fleet-server-configuration.md
+++ b/docs/Configuration/fleet-server-configuration.md
@@ -2738,7 +2738,7 @@ packaging:
 
 ## Mobile device management (MDM)
 
-> MDM features require some endpoints to be publicly accessible outside your VPN or intranet, for more details see [What API endpoints should I expose to the public internet?](https://fleetdm.com/docs/get-started/faq#what-api-endpoints-should-i-expose-to-the-public-internet)
+> MDM features require some endpoints to be publicly accessible. For more details, see the guide, [Which API endpoints to expose to the public internet?](https://fleetdm.com/guides/what-api-endpoints-to-expose-to-the-public-internet)
 
 This section is a reference for the configuration required to turn on MDM features in production.