What are PagerDuty's IPs for whitelisting and firewall purposes?

Follow

Events API

The PagerDuty Events API, which is used for triggering, acknowledging, and resolving incidents, requires that your system be able to make outbound connections to events.pagerduty.com on TCP ports 80 or 443, depending on whether you would like to send events to PagerDuty via HTTP or HTTPS. Most integrations use HTTPS (TCP port 443).

events.pagerduty.com resolves to multiple IPs, which you can find by querying the A records using dig or nslookup.

Example Query

$ dig a +short events.pagerduty.com
events.gslb.pagerduty.com.
54.244.255.45
54.241.36.66
54.245.112.46

In this example, you see that PagerDuty's Events API is accessible at the IPs 54.244.255.45, 54.241.36.66, and 54.245.112.46.

REST API

To access our REST API, your system must be able to make outbound connections to <subdomain>.pagerduty.com or api.pagerduty.com on TCP port 443. Our REST API only allows HTTPS connections; HTTP connections are not allowed for security.

<subdomain>.pagerduty.com and api.pagerduty.com usually resolve to multiple IPs as well, however these IPs will be different than the ones used for our Events API or webhooks.

Example Query

$ dig a +short api.pagerduty.com
54.203.252.221
50.112.113.201
50.112.113.204

In this example, you see that PagerDuty's REST API is accessible at the IPs 54.203.252.221, 50.112.113.201, and 50.112.113.204.

Webhooks

Webhooks are HTTP or HTTPS calls sent from PagerDuty to your web server on the IP and port of your choosing. The current list of IPs that our webhooks are sent from can be found by querying the A records for webhooks.pagerduty.com.

Example Query

$ dig a +short webhooks.pagerduty.com
54.185.79.76
50.18.129.59
54.212.55.143
52.13.4.226
104.42.123.77
54.176.87.101

In this example, you see that PagerDuty is sending webhooks from the IPs 54.185.79.76, 50.18.129.59, 54.212.55.143, 52.13.4.226, 104.42.123.77, and 54.176.87.101.

Please be aware that the IPs above are only example DNS queries, and do not necessarily reflect the current IPs in use. These IPs can change at any time without warning. If we were to change IPs and your firewall policies were not updated, you will not be able to reach our API endpoints and/or you will stop receiving webhooks from PagerDuty.

If you are hardcoding IPs into your firewall, you can use a script to receive updates when the A records for these hostnames change, or perform lookups on the aforementioned hostnames regularly to update your configurations.

Tip: Be sure to Follow this article to receive email updates about any changes to PagerDuty webhook origination.

If you do not see an option to Follow this article (at the top of the page), then you will need to create or login to your PagerDuty Support site account here. This is separate from your main PagerDuty account.

Have more questions? Submit a request

Comments

  • Avatar
    Ryan Hoskin

    If you follow this article, the IP blocks had changes today.

  • Avatar
    Ryan Hoskin

    For anyone following this article, two of the old IPs for the Integrations API are being removed tomorrow and two new IPs are being added. The list in this article reflects what will be active as of tomorrow.

  • Avatar
    David Taylor

    I see requests from 104.42.123.77/32. Does this article need updating?

  • Avatar
    Alexis Chu

    Hi David,

    This IP address is associated with our webhooks API (this particular article is in relation to our Integrations and REST API). Although we are not able to provide a static list of our webhook IP addresses, we recommend doing an nslookup on webhooks.pagerduty.com to find a list of our webhook IPs.

    Please let us know if you have any other questions.

    Cheers,
    Alexis

  • Avatar
    Tommy McNeely

    Hi,

    By design a monitoring system is a fairly critical part of the infrastructure, with access to everything internally. It would be a "good thing" (tm) to track the "webhooks" IPs on this page (or another similar one), because we are poking a hole in our firewall to allow access to this otherwise restricted host. It would be good to be able to subscribe to changes to these addresses.

    Tommy

  • Avatar
    Ryan Hoskin

    Hi Tommy,

    I've updated the article to address to address your concerns. Please let us know if there's anything else that we can do.

    Cheers,
    Ryan

  • Avatar
    Robert Bell

    Is there any way you can expose this via the API? We have a site with restricted access and any change could break our integrations. Via the API I could automate these changes to our proxy

  • Avatar
    Alexis Chu

    Hi Robert,

    Since we are hosted on several providers for redundancy, we recommend running an nslookup or dig on (events|<subdomain>|webhoooks).pagerduty.com periodically to update any firewall configuration.

    Let us know if you have any other questions.

    Cheers,
    Alexis

  • Avatar
    Jonathan Curry

    For those following this article, we've updated the webhook IP address list to include two additional IPs.

    There is also a set of scripts you can use to monitor for IP changes available here: https://github.com/mdcollins05/PD-IP-Checker

  • Avatar
    John Bauer

    Resolving events.pagerduty.com currently only resolves 3 IPs, can we rely on DNS lookups? The list on this page and what's being currently being resolved doesn't match.

    ;; ANSWER SECTION:
    events.pagerduty.com. 30 IN CNAME events.gslb.pagerduty.com.
    events.gslb.pagerduty.com. 30 IN A 104.42.125.229
    events.gslb.pagerduty.com. 30 IN A 54.244.255.45
    events.gslb.pagerduty.com. 30 IN A 54.245.112.46

  • Avatar
    Jonathan Curry

    Hi John,

    Yes, DNS lookups are in fact the most reliable method to use for whitelisting IPs, as they reflect the live infrastructure API calls are made to (or from in the case of webhooks), whereas the IP list on this page is manually updated after infrastructure changes go live. This page has just been updated with all of the current IPs in use.

    I hope this clears things up!

  • Avatar
    Jonathan Curry

    For those following this article, we've updated the Integration API IP address list to reflect two IPs being replaced. If you filter outbound traffic in your monitoring environment, you'll want to make sure the new IPs are allowed to make outbound HTTP/HTTPS connections to PagerDuty so that your monitoring system can continue to trigger incidents.

  • Avatar
    Jonathan Curry

    The PagerDuty Events API (formerly known as the Integration API) has had some IP address changes which are now reflected in this article.