Accessing the TeamCity REST API from outside using HTTPS

Question

How can the TeamCity REST API be reached from outside the server machine over HTTPS, when it is currently available only internally (for example, at http://localhost:8111)?

Answer

The REST API is not a separate service or port. It is part of the TeamCity web application, served under <server-url>/app/rest. Exposing the TeamCity server to external clients over HTTPS therefore exposes the REST API the same way, so there is nothing REST-specific to open.

To make the server, and with it the REST API, reachable from outside over HTTPS:

1. Make the server reachable on a routable hostname or network interface instead of localhost. A server reached only at http://localhost:8111 is available solely on the server machine.
2. Enable HTTPS access using one of the two supported options:
   • TeamCity's built-in HTTPS settings: upload an HTTPS certificate (or certificate chain) in PEM format, and TeamCity configures its bundled Tomcat. See Configure HTTPS for TeamCity Web UI.
   • A reverse proxy (NGINX, Apache, or IIS) that terminates TLS and forwards to TeamCity's HTTP port. This is recommended for public-facing installations. The proxy must pass the WebSocket upgrade headers and must not strip the Referer header. See Configuring Proxy Server.
3. Set the Server URL to the external HTTPS URL, on the Administration | Global Settings page, or in <TeamCity Data Directory>/config/main-config.xml via the <server rootURL="https://..."> element. See Configuring Server URL.
4. Call the REST API at https://<external-host>/app/rest/.... Authenticate with a personal access token passed in the Authorization: Bearer <token> header. Access tokens are created under Your Profile | Access Tokens. Token authentication is preferred over basic authentication. See REST API Quick Start.

Security considerations

Exposing a TeamCity server outside the internal network makes it a public-facing target and warrants review of the Security Notes. In particular:

• Serve TeamCity over HTTPS only and disable plain HTTP access.
• Authenticate REST requests with access tokens rather than basic authentication, and restrict each token to the minimum required permissions.
• Patch the server against CVE-2026-63077 before exposing it. This is a CVSS 9.8 unauthenticated remote code execution vulnerability in TeamCity On-Premises, reachable over HTTP or HTTPS without credentials and under active exploitation. It is fixed in TeamCity 2025.11.7 and 2026.1.3, and a security patch plugin is available for earlier releases. See the JetBrains security advisory.