IP addresses

Allow these addresses in your firewall if your endpoints only accept traffic from known sources. They cover webhooks, webhook actions in triggers and automations, the sidebar apps proxy, the customer data connector, end-user SSO discovery and token requests, and every other HTTP call ChaosDesk makes on your behalf.

Private beta addresses

ChaosDesk is in private beta on a single server in Falkenstein, Germany, so one pair of addresses covers both directions.

Direction	IPv4	IPv6
Outbound (requests we make to you)	2.31.172.241	2a01:4f8:c015:94d4::1
Inbound (what your DNS points at for a custom help centre domain)	2.31.172.241	2a01:4f8:c015:94d4::1

Allow both the IPv4 and the IPv6 address: which one we use depends on your DNS.

The machine-readable list

There is also a machine-readable endpoint, shaped like Zendesk’s GET /api/v2/ips:

GET https://api.chaosdesk.io/public/ips.json

{
  "ips": {
    "egress": { "all": ["2.31.172.241/32", "2a01:4f8:c015:94d4::1/128"] },
    "ingress": { "all": ["2.31.172.241", "2a01:4f8:c015:94d4::1"] }
  }
}

During the private beta the endpoint is not serving yet, so take the addresses from the table above. Once it answers, read them from there instead of copying them into code; we will say so in the API changelog.

These addresses change at the public launch

The table above is the private beta, not the final list. At the public launch the stack moves onto its production cluster, with per-region NAT gateways and edge load balancers, and the addresses change. That move is the only planned change.

Before any address changes:

• the new addresses are published here and in /public/ips.json at least 30 days before any traffic moves,
• the old and the new addresses both work during those 30 days,
• workspace administrators get an e-mail.

If you cannot allow a range by hand on short notice, tell us at [email protected] and we will plan your cutover with you.

Stability between deploys

Within the beta the addresses belong to the server, not to a container, so deploys, restarts and scaling never change them. After the launch they belong to the region’s NAT gateway and edge load balancer, not to pods or nodes, for the same reason.

Inbound, for custom help centre domains

If you point your own domain at your ChaosDesk help centre, use a CNAME to hc.chaosdesk.io wherever your DNS provider allows it: then you never have to care about these addresses. Use the A and AAAA records above only for an apex domain whose provider cannot do a CNAME (also described in use your own domain), and expect to update them at the launch.

Not an authentication method

An allowlist is a useful second layer, but do not treat a request’s source address as proof that it came from us. Verify the webhook signature on every delivery; that is the check that matters.