egress feed

Official, verified IP ranges for third-party services — machine-readable, with provenance.

v1/index.json · changelog · source & methodology · Terraform provider

Use with Terraform: data "egress_ranges" "x" { service = "<slug>" purpose = "<purpose>" }. egress purposes are ranges you connect to; ingress purposes are webhook/agent sources.

Entry counts matter: every CIDR consumes one security-group rule (default quota: 60 per SG, IPv4 and IPv6 counted separately). Ranges are losslessly aggregated — published coverage is preserved exactly, never widened. Purposes with hundreds+ of entries belong in prefix lists or firewall rule groups, not security groups.

Cloud / IaaS

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`aws`	Amazon Web Services	dedicated	`all` (egress, 1731+2047) `cloudfront` (egress, 179+31) `dynamodb` (egress, 28+0) `route53-healthchecks` (ingress, 27+23) `s3` (egress, 175+447)	json
`azure`	Microsoft Azure (Service Tags)	dedicated	`all` (egress, 2705+1941) `sql` (egress, 1113+400) `storage` (egress, 496+79)	json
`digitalocean`	DigitalOcean	dedicated	`all` (egress, 179+53)	json
`google`	Google (all services)	dedicated	`all` (egress, 97+15)	json
`google-cloud`	Google Cloud Platform	dedicated	`all` (egress, 441+20)	json
`ibm-cloud`	IBM Cloud (Classic infrastructure)	dedicated	`frontend` (egress, 42+0) `load-balancers` (egress, 39+0)	json
`linode`	Akamai Connected Cloud (Linode)	dedicated	`all` (egress, 238+38)	json
`oracle-cloud`	Oracle Cloud Infrastructure	dedicated	`all` (egress, 781+0) `object-storage` (egress, 29+0)	json
`vultr`	Vultr (Constant, AS20473)	dedicated	`all` (egress, 124+27)	json

CDN / Edge

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`cloudflare`	Cloudflare	cdn-shared	`edge` (both, 15+7)	json
`fastly`	Fastly	cdn-shared	`edge` (both, 19+2)	json

Payments & fintech

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`braintree`	Braintree (PayPal)	dedicated	`api` (egress, 46+0) `sandbox` (egress, 102+0)	json
`paypal`	PayPal	dedicated	`all` (both, 8+0)	json
`plaid`	Plaid	dedicated	`webhooks` (ingress, 4+0)	json
`stripe`	Stripe	dedicated	`api` (egress, 130+0) `terminal` (egress, 38+0) `webhooks` (ingress, 15+0)	json

Observability

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`datadog`	Datadog	dedicated	`agents-eu` (egress, 2+1) `agents` (egress, 1+1) `api-eu` (egress, 2+2) `api` (egress, 1+1) `apm` (egress, 1+1) `logs` (egress, 1+1) `synthetics` (ingress, 113+0) `webhooks` (ingress, 35+0)	json
`grafana-cloud`	Grafana Cloud	dedicated	`alerts` (ingress, 26+0) `logs` (ingress, 42+0) `metrics` (ingress, 67+0)	json
`new-relic`	New Relic	dedicated	`agents` (egress, 5+4) `synthetics` (ingress, 59+0)	json
`sentry`	Sentry (hosted)	dedicated	`ingest` (egress, 4+2) `uptime` (ingress, 12+0) `webhooks` (ingress, 10+0)	json

Developer platforms & CI

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`buildkite`	Buildkite	dedicated	`webhooks` (ingress, 3+0)	json
`circleci`	CircleCI	dedicated	`core` (egress, 10+0) `jobs` (ingress, 21+0)	json
`github`	GitHub	dedicated	`actions` (ingress, 3902+1444) `api` (egress, 20+2) `git` (egress, 32+2) `hooks` (ingress, 4+2) `packages` (egress, 25+0) `pages` (egress, 6+4) `web` (egress, 20+2)	json
`gitlab`	GitLab.com	mixed	`web-api` (egress, 2+0) `webhooks` (ingress, 2+0)	json

Data platforms

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`databricks`	Databricks	dedicated	`all` (both, 2662+0)	json
`elastic-cloud`	Elastic Cloud	dedicated	`api` (egress, 102+0) `outbound` (ingress, 166+0)	json
`neon`	Neon (Serverless Postgres)	dedicated	`outbound` (ingress, 98+0)	json

Identity & auth

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`auth0`	Auth0 (Okta CIC)	dedicated	`all` (both, 103+0)	json
`okta`	Okta	dedicated	`all` (both, 1947+0)	json

Communications

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`intercom`	Intercom	dedicated	`all-eu` (both, 84+0) `all` (both, 172+0) `outbound-webhooks` (ingress, 6+0)	json
`klaviyo`	Klaviyo	dedicated	`integrations` (ingress, 2+0)	json
`pagerduty`	PagerDuty	dedicated	`webhooks-eu` (ingress, 12+0) `webhooks` (ingress, 13+0)	json
`postmark`	Postmark	dedicated	`smtp` (egress, 3+0) `webhooks` (ingress, 4+0)	json
`twilio-sip`	Twilio Elastic SIP Trunking	dedicated	`sip-media` (both, 1+0) `sip-signaling` (both, 8+0)	json
`zoom`	Zoom	dedicated	`all` (egress, 49+0)	json

Business SaaS

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`atlassian`	Atlassian Cloud	dedicated	`all` (both, 69+14) `bitbucket` (both, 40+14) `egress` (ingress, 66+14)	json
`docusign`	DocuSign	mixed	`connect-webhooks` (ingress, 81+0) `email` (ingress, 6+0)	json
`microsoft-365`	Microsoft 365	mixed	`common` (egress, 11+29) `exchange` (egress, 15+14) `sharepoint` (egress, 5+5) `teams` (egress, 2+7)	json
`salesforce`	Salesforce	dedicated	`all` (both, 32+5)	json
`zendesk`	Zendesk	mixed	`api` (egress, 3+0) `webhooks` (ingress, 1+0)	json

Security

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`netskope`	Netskope (NewEdge)	dedicated	`dataplane` (both, 5+0)	json
`rapid7`	Rapid7 (InsightAppSec cloud engines)	dedicated	`appsec-engines` (ingress, 24+0)	json
`tenable`	Tenable (Vulnerability Management)	dedicated	`scanners` (ingress, 39+17)	json
`zscaler`	Zscaler (zscaler.net cloud)	dedicated	`enforcement-nodes` (egress, 243+48)	json

AI APIs

Slug	Service	Classification	Purposes (entries v4+v6)	Ranges
`anthropic`	Anthropic (Claude API)	dedicated	`api` (egress, 1+1) `outbound` (ingress, 1+0)	json
`openai`	OpenAI (ChatGPT egress)	mixed	`agents` (ingress, 758+0) `connectors` (ingress, 277+0)	json

Doesn't publish pinnable ranges

Service	Vendor position
Twilio (REST API + webhooks)	IPs 'highly dynamic, span a large range'; allow *.twilio.com instead. SIP trunking IS pinnable — see the twilio-sip service.
Adyen	No IP list; allowlist out.adyen.com or resolve it via DNS hourly (their words).
SendGrid (webhooks/parse)	Dynamic cloud infra; use signed webhooks, not IP allowlists.
Slack	No published egress IPs; their allowlisting feature restricts YOUR IPs calling THEM.
Shopify (webhooks)	Webhook source IPs not published; verify HMAC signatures instead.
Square (webhooks)	No webhook source-IP list published; validate notifications via the documented HMAC-SHA256 signature flow.
Duo Security	Explicitly discourages IP-based egress rules; may change to maintain availability.
Snowflake	Deployment-specific hostnames/IPs per account; no global list.
MongoDB Atlas (data plane)	Cluster IPs are per-project/dynamic; control-plane IPs only via authenticated Admin API. Use private endpoints (PrivateLink) — which is itself the strategy's Tier-2 story.
Vercel (function egress)	Dynamic by default; static IPs are a paid per-customer feature, not a public range.
Netlify (function egress)	No published IPs; any circulating list 'is a guess or outdated'.
HubSpot	No static publication ('change too frequently'); offers an API returning current ranges — could be integrated later as an authed source.
OpenAI API (api.openai.com)	Egress to api.openai.com resolves to shared Cloudflare ranges — pinning would allowlist the whole CDN.
Akamai (CDN)	Customer-specific maps behind login; no public global ranges.
Box	Use domain names; 'IP addresses can change frequently and without notice' (their wording). No webhook source ranges published.
Sumo Logic	No own ranges; officially delegates to AWS ip-ranges.json ('Amazon'/'EC2' services for your deployment region) — covered by our aws service.