Azure DevOps (VSTS) self-hosted Agent update URL - azure-devops

Question

I am trying to whitelist URLs for access required by Azure DevOps (VSTS Agent).
However, when trying to do a self-update, I receive the following error (file is /vsts-agent/_diag/Agent_20181127-213126-utc.log):
[2018-11-27 21:37:49Z ERR Terminal] WRITE ERROR: An error occurred: Response status code does not indicate success: 403 (Forbidden).
[2018-11-27 21:37:49Z ERR AgentProcess] System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
at System.Net.Http.HttpClient.FinishGetStreamAsync(Task`1 getTask)
at Microsoft.VisualStudio.Services.Agent.Listener.SelfUpdater.DownloadLatestAgent(CancellationToken token)
at Microsoft.VisualStudio.Services.Agent.Listener.SelfUpdater.SelfUpdate(AgentRefreshMessage updateMessage, IJobDispatcher jobDispatcher, Boolean restartInteractiveAgent, CancellationToken token)
at Microsoft.VisualStudio.Services.Agent.Listener.Agent.RunAsync(AgentSettings settings)
at Microsoft.VisualStudio.Services.Agent.Listener.Agent.RunAsync(AgentSettings settings)
at Microsoft.VisualStudio.Services.Agent.Listener.Agent.RunAsync(AgentSettings settings)
at Microsoft.VisualStudio.Services.Agent.Listener.Agent.ExecuteCommand(CommandSettings command)
at Microsoft.VisualStudio.Services.Agent.Listener.Program.MainAsync(IHostContext context, String[] args)
However, there is no URL listed to whitelist!
The closest I found was:
Configuring Proxy with VSTS Agents
Whitelisted URLs for VSTS
Note the agent is configured successfully and can successfully run builds. It is just every time an update comes around, it fails and won't run builds until it is removed/reconfigured (not an option - this is an agent, not interactive).

Answer 1

The pipeline agent is open source. The code can be found here.
Glancing through the trace, I'd guess it is throwing the error here:
using (Stream result = await httpClient.GetStreamAsync(_targetPackage.DownloadUrl))
Looking through the assets.json specifying the DownloadUrl, I'd guess this is the URL you will want:
https://vstsagentpackage.azureedge.net/agent/<AGENT_VERSION>/vsts-agent-win-x64-<AGENT_VERSION>.zip