📘

Best Practice

PagerDuty supports safelisting IP addresses. However, this method of ensuring webhook delivery security is no longer best practice. TLS 1.2 and custom headers are now available for webhooks, which will ensure that webhooks deliver from PagerDuty. If you are migrating away from IP safelisting and have questions about PagerDuty's webhook deliverability, contact our Support Team.

⚠️

EU Service Region

Safelist IPs resolving to the URLs corresponding to your service region. Currently available regions are US and EU.

Events API

PagerDuty's Events API is used for triggering, acknowledging, and resolving incidents. To access the Events API, your system must be able to make outbound connections to events.pagerduty.com on TCP port 443 (for HTTPS).

events.pagerduty.com and events.eu.pagerduty.com resolve to multiple IPs, which you can find by querying the A records using dig or nslookup.

Example Query (US)

$ dig a +short events.pagerduty.com 
35.167.69.145
44.231.93.240
44.233.86.211

In this example, the Events API is accessible in the US region at the IPs 35.167.69.145, 44.231.93.240, and 44.233.86.211.

Example Query (EU)

$ dig a +short events.eu.pagerduty.com
18.159.153.65
18.198.156.244
35.159.34.57

In this example, the Events API is accessible in the EU region at the IPs 18.159.153.65, 18.198.156.244, and 35.159.34.57.

REST API

To access the REST API, your system must be able to make outbound connections to api.pagerduty.com and/or api.eu.pagerduty.com on TCP port 443. The REST API only allows HTTPS connections — HTTP connections are not allowed.

api.pagerduty.com and api.eu.pagerduty.com resolve to multiple IPs. These IPs will differ from those used for the Events API or webhooks.

While the IPs used by the REST API are not expected to change often, they may change from time to time. PagerDuty provides a list of REST API IPs in the developer documentation. Any changes to these IPs will be reflected in that list at least 30 days before they take effect, giving you time to update any filtering you may have in place.

Note that while multiple IPs are listed, not all of them may be in use at a given time. To avoid interruptions, do not use DNS lookups to determine the IPs to filter.

Webhooks

Webhooks are HTTP or HTTPS calls sent from PagerDuty to your web server on the IP and port of your choosing. See the current list of IPs that PagerDuty uses to send webhooks in the developer documentation: Webhook IPs.

Firewalls and Access Control Lists (ACLs)

The IP addresses listed in Webhook IPs are a fixed list and are not expected to change. You can safely hardcode them into your firewall or ACL.

📘

Webhook IPs

Prior to May 5th, 2022, the list of Webhook IPs was subject to change without notice. Since Webhook IPs are now fixed, the scripts previously provided to notify you and automatically update EC2 security groups have been retired.

Incident Workflow Actions

Incident Workflow actions that make external HTTP requests — including Web API actions such as Send GET Request and Send POST Request — will originate from the IP addresses listed in Webhook IPs.

Jira Server Integration

If you are using the Jira Server integration, you will also need to add the address records of app.pagerduty.com or app.eu.pagerduty.com to any safelist that controls network egress traffic, depending on your account's service region. This integration makes API calls to PagerDuty that go directly to the hostname of your account's service region.