Python Eikon API - not working anymore when moved from VPN to Zscaler

alessandro.bolis

I have been able to use Eikon Python API from my machine within my company VPN as long as Reuters App is running on my machine. A few months ago my company mode to Zscaler to control traffic and since then my Python API does not work anymore - see below the error message. I already contacted Reuters support that pointed me to my administrator, pointing me back to Reuters.

Access Denied

The web content has been deemed by your Security Administrator to be unsafe or unsuitable for you to access. The content has been blocked. No further action is required.</p>

Access to This Website or Web Content Has Been Blocked!

This web content has been identified as having illegal, harmful, or otherwise inappropriate content for ?????? business use.

For further information regarding appropriate uses, please see ???????????

????

????

Blocked due to invalid server IP

You tried to visit: "http://127.0.0.1:9060/api/v1/data&quot;

Need help? Contact our support team at Local Helpdesk, xxxxxxxxxxxxxxxxx

Your organization has selected Zscaler to protect you from internet threats.

zoya faberov

Hi @alessandro.bolis and all,

Please find the conclusion from the investigation conducted into this matter:

"...Following with Alessandro's email and based from the analysis we had, I think the only best way is to have a test machine which can replicate the issue so we can do further investigation on it without interrupting Alessandro. With this, I will close the case as unresolved for the meantime... "

jason.ramchandani01

@alessandro.bolis I sent you the Refinitiv Eikon Networking guide on 24th Feb. This is definitely a firewall issue from your side- in particular - please note the following and send to your IT team so the can whitelist the necessary serviices:

Please see pages 15-20 for configuring firewall, proxy and internet options in the attached document.

Also on page 14, you will see the IP Subnet and TCP Port that we are using.

Here I will give you a summary of the changes that have to be made on your proxy server and the firewall.

Proxy Server:

Please approve the connection to the following domains (on port 80 and 443)

*.cp.extranet.thomsonreuters.biz
*.refinitiv.biz
*.thomsonreuters.net
*.refinitiv.net

Firewall and Antivirus:

Please also make sure that the firewall and antivirus allows the following processes:

Eikon.exe (Thomson Reuters Eikon Desktop)
EikonBox.exe (Thomson Reuters Eikon, Interactive Map Component)
EikonDM.exe (Thomson Reuters Eikon Deployment / Update Manager)
TRUserServiceHostv4.exe (Thomson Reuters Common Office User Service Daemon)
Excel.exe (Thomson Reuters Eikon Excel)
EikonSupportTool.exe (Eikon Support Tool)

Please make sure that the firewall server allows you to download EXE files from the following domains (on port 80 and 443):

*.cp.extranet.thomsonreuters.biz
*.refinitiv.biz
*.thomsonreuters.net
*.refinitiv.net

HTTPS Tunneling
Thomson Reuters Eikon uses HTTPS Tunneling to connect to Thomson Reuters Eikon platform for Streaming Service. In some Proxy Server, HTTP/HTTPS Tunneling is disabled by default because of unknown protocol e.g. Web Sense. Meanwhile some Proxy Servers are able to set up a rule to enable or disable it.

It is necessary that customers set up a rule to ALLOW HTTPS Tunneling to the following URL:

*.cp.extranet.thomsonreuters.biz
*.refinitiv.biz
*.thomsonreuters.net
*.refinitiv.net

You may also need to allow our domains if you are implementing SSL/TLS decryption or inspection as this might break the certificate from our servers and will break the connection to the Eikon Desktop application.

*.cp.extranet.thomsonreuters.biz
*.refinitiv.biz
*.thomsonreuters.net
*.refinitiv.net

I hope this can help. Please let me know how you get on.

Alex.Putkov12

@alessandro.bolis

Eikon Data APIs depends on being able to send HTTP requests to the HTTP listener on localhost (implemented in Eikon desktop application). It appears that Zscaler blocks HTTP requests to localhost on your machine. To verify this and to be able to easily demonstrate and explain the problem to your internal IT support, you can enter the following URL in your Internet browser: http://localhost:9060/api/status. Make sure Eikon desktop application is running when you do this. The normal response displayed in the browser is {"statusCode":"ST_PROXY_READY","version":"2.8.0"}. For illustration see the screenshot in Chapter 3, paragraph 7 of the article titled "Eikon Data API(Python) Troubleshooting". However, in your case I expect you to get the same response you quoted in your post (i.e. that Zscaler blocked the request). I'd be very surprised if Zscaler cannot be configured to allow HTTP requests to localhost. But I'm afraid Refinitiv cannot help with that. You need to chase your IT support to make it happen.

alessandro.bolis

Hi Jason & Alex,

Thanks for your replies, much appreciated. My IT is working on this.

@Alex.Putkov12

Just as an FYI if I look at http://localhost:9060/api/status it returns

{"statusCode":"ST_PROXY_READY","version":"2.8.0"}

@jason.ramchandani01

Two things I have notice :

1. Even if we switch off Zscaler/VPN, so direct web connection, this is not working with a different error.

Suggesting that the Python SDK is set up to always rely on the Eikon desktop application, that is set up to always use a private connection. Is this correct?

2. The Python SDK used to work even if my Eikon desktop app was not running initially (say December last year). Then it got fixes to work through the VPN by Refinitiv support. Is this something that can be reverted? It would be nice to use the SDK without having the Eikon desktop up and running.

Thanks,

Alessandro

Alex Putkov.1

@alessandro.bolis

Eikon Data APIs have always had dependency on Eikon desktop application running on the same machine where you execute your Python scripts. It was never possible to retrieve data from Eikon using Eikon Data APIs without running Eikon desktop application. I see quite a bit of confusion on this thread with regard to what happens in which scenario. I don't think this forum is an effective tool for troubleshooting the issues you experienced. I opened a ticket with Refinitiv Support on your behalf. You will be contacted by Refinitiv Helpdesk to start gathering the facts and troubleshooting the problem. For your reference the case number is 09889532.