Hi @Diogo Barbosa ,

Regarding hiding the endpoint from the public internet, the documentation mentions that the private channel "can be allowlisted in your O11 firewall or network access policies". However, I couldn't find exact public documentation explaining how to configure this on the O11 side, what should be allowlisted, or how it relates to the O11 Internal Access Only setting. 

I would recommend contacting OutSystems Support to confirm the required O11 network configuration. 

For verification, I would check two things:

• Confirm that the ODC REST integration is using the Secure Connectivity Base URL.
• Once the O11 network restriction is configured, try accessing the normal/public O11 REST endpoint externally. Ideally, that request should fail while the same API call from ODC continues to work.

Hi, I discovered what I was looking for and it works now :)

I write here the setup, for anyone with the same difficult configuring this:

Setup (O11 Cloud + ODC Cloud)

1. Add the secure connection

ODC Portal > Management > Infrastructures > [your O11 infrastructure] > Secure connectivity > Add.

Pick the ODC Stage and the O11 Environment. No token, no Cloud Connector, nothing to install — since both sides are OutSystems-managed, the trust already exists through the registered LifeTime base URL.

Once it goes Active you get a Base URL like https://secure-gateway:60685. Copy it, you need it in step 4.

Note: you need one connection per (ODC stage ↔ O11 environment) pair, so repeat this when you promote to Test and Production.

2. Expose the logic in O11

Standard stuff: wrap your Server Action in an exposed REST API method in Service Studio, publish.

3. Consume it inside the ODC Studio app

Logic > Integrations > REST > Consume REST API, import the OpenAPI/Swagger spec.

4. Point the consumed API at the gateway — this is the step people miss!

ODC Portal > Apps > [your app] > Consumed REST APIs > edit the API. Under URL, switch from Default to Custom and replace the public O11 URL with the gateway one:

https://secure-gateway:60685/[/rest/]

This is configured per stage (there's a stage selector at the top right).

If you skip this, everything still works — which is exactly the trap. It just works over the public internet instead of the tunnel.

How to verify it's actually going through the gateway

O11 Service Center > Monitoring > Integrations > open the request detail. On a call routed through the tunnel you'll see:

• Host: secure-gateway (and OS-Host: secure-gateway)
• User-Agent: OutSystems-ODC-RestConsume/2.0
• x-odc-origin: rest-consume
• Source / X-Forwarded-For on private addresses (10.x range), not a public IP

Compare it against a direct Postman call to the public URL and the difference is obvious.