Wikimedia Enterprise APIs provide various resources, for example, HTML dumps of Wikimedia sites. This resource used to be available via Dumps-Generation, but not anymore. The only way to access those data is via the API (docs).
The API provides direct access to requests from certain IPs (list of IPs is at P82115), allowing access to Toolforge and Wikimedia Cloud in general. While this exemption makes it easier to use Enterprise data for the community, WMF work often happens on the internal Analytics cluster (stat* hosts), which is currently not included:
[urbanecm@stat1008 ~]$ curl https://api.enterprise.wikimedia.com/v2/snapshots
{"status":401,"message":"Unauthorized"}
[urbanecm@stat1008 ~]$vs
urbanecm@bastion-eqiad1-03:~$ curl -s https://api.enterprise.wikimedia.com/v2/snapshots | jq . | head
[
{
"identifier": "aawiki_namespace_0",
"version": "8a3f250fd3c79160e464212519e0b649",
"date_modified": "2025-08-29T01:19:35.864325418Z",
"is_part_of": {
"identifier": "aawiki"
},
"in_language": {
"identifier": "aa"
urbanecm@bastion-eqiad1-03:~$To allow access from analytics hosts, we would likely need to allow access for install* hosts (or at the very least, install1004 and install1005). As far as I know, this means allowing access from the following IPs:
- 208.80.154.74 (install1004)
- 208.80.154.134 (install1005)
- 208.80.153.105 (install2004)
- 208.80.153.70 (install2005)
- 185.15.59.3 (install3003)
- 198.35.26.11 (install4003)
- 103.102.166.11 (install5003)
- 185.15.58.7 (install6003)
- 195.200.68.100 (install7002)
I'm not sure if there is a way to put this in a single range. We specifically probably shouldn't use all of our production-assigned ranges, as eg. urldownloader makes requests on behalf of MediaWIki, which might result in unauthorised external requests (OTOH, MediaWIki allowing arbitrary HTTP calls for an unprivileged user is bad enough as it is, so maybe it doesn't matter?)