Use this article to configure allow rules for traffic from Iterable. For some traffic types, you should allow IP ranges. For others, you should allow domains (hostnames) instead of IP addresses.
# In this article
# Traffic allowance by type
| Traffic type | Allow by | What to allow |
|---|---|---|
| Journey webhooks, system webhooks, and data feeds | IP range |
ip-ranges.json for your Iterable data center |
| API traffic | Domain | Either api.iterable.com (USDC) or api.eu.iterable.com (EDC) depending on your region |
| CDN-backed traffic (including link tracking domains) | Domain | One of:
|
| Data Sync | Feature-specific IPs | See the guide for your destination: |
| Smart Ingest | Feature-specific IPs | Smart Ingest IPs to allow |
# IP addresses for Iterable webhooks and data feeds
The published IP list covers outbound requests from Iterable (egress traffic) for the following features:
- Journey webhooks from the journey Webhook tile
- System webhooks
- Data feeds
Use the IP list that corresponds with your Iterable data center:
TIP
You can programmatically retrieve the IP list for Iterable's IP addresses, as it occasionally changes.
In ip-ranges.json, the top-level labels are webhooks and datafeeds.
Sometimes both labels list the same IP ranges. This is expected and does not
mean those IPs apply to additional features beyond webhooks and data feeds.
# Refresh interval and updates
Iterable's list of IP addresses is programmatically refreshed once per hour (3600s), but it is not truly dynamic. The list is effectively static, but it is refreshed regularly to accommodate potential future additions or changes to Iterable's IP addresses. The refresh process takes 5 minutes for the changes to be reflected in the list.
Iterable reserves capacity on the list for future growth and always maintains a reserve of three unused IP addresses. This list does not change frequently. When Iterable does add new IP addresses, they're added to the list as reserved for future use, and Iterable begins using the IPs that were previously reserved. This guarantees you always have the most up-to-date list of Iterable IP addresses.
# Disaster recovery
In the unlikely event of a disaster recovery scenario, the entire list may change within a 5-minute period in order to accommodate possible incident response needs. Any such incident will be communicated to you via Iterable support.
# Configure domain allow rules for API and CDN traffic
The IP ranges above do not apply to API traffic or CDN-backed traffic. CDN and API IP addresses are dynamic, shared, and region-dependent.
For these traffic types, use domain-based allow rules (FQDN/hostname), not fixed IP allowlisting:
-
Iterable API endpoints:
api.iterable.com(USDC) orapi.eu.iterable.com(EDC) -
Default Iterable link tracking domains:
links.iterable.com(USDC) orlinks.eu.iterable.com(EDC) - Custom link tracking domains: If your project uses a custom tracking domain, allow traffic from your custom domain.
# Features with separate allowlisting requirements
Smart Ingest: See Smart Ingest IPs to allow for a list of IP addresses to allow for this feature.
-
Data Sync: Data Sync destinations use static egress IPs instead of the IP ranges listed above. For specific instructions, see the guide for your Data Sync destination:
# Operational recommendations
To reduce avoidable issues:
- Use the correct region: If you are not sure whether your project is USDC or EDC, confirm this before configuring rules.
-
Allow CIDR ranges as published: Apply values exactly as provided in the
JSON response (for example,
prefixes_ipv4and, when present,prefixes_ipv6). - Do not rely on user-agent for trust decisions: User-agent values can be generic and are not a reliable way to identify Iterable traffic. Use allowlisting and request authentication controls instead.