Skip to main content
Use the IP range API to retrieve information about the IP addresses that HubSpot uses for various tools such as marketing email or one-to-one emails. This IP address information can be useful to forward to your IT team to configure allowlist rules for your company’s firewall or other network configuration purposes. Check out this Knowledge Base article for related information on troubleshooting other issues with HubSpot notifications and emails.
This functionality is currently in beta. By participating in this beta, you agree to HubSpot’s Developer Terms and Developer Beta Terms. Note that the functionality is still under active development and is subject to change based on testing and feedback.
Please note: the IP ranges returned from the API may change over time. By regularly retrieving the latest IP ranges using this API, you’ll ensure that you’re not using a stale list of HubSpot-related IP addresses in your firewall or network configuration.

​
Retrieve IP range data in JSON format

To retrieve active HubSpot IP addresses, make a GET request to /meta/network-origins/2026-09-beta/ip-ranges. The response will resemble the following: 
{
  "results": [
    {
      "cidr": "3.127.29.218/32",
      "direction": "EGRESS",
      "service": "WEB_SCRAPING",
      "description": "Web crawling and user-generated traffic"
    },
    {
      "cidr": "18.159.155.92/32",
      "direction": "EGRESS",
      "service": "WEB_SCRAPING",
      "description": "Web crawling and user-generated traffic"
    },
    {
      "cidr": "3.125.129.244/32",
      "direction": "EGRESS",
      "service": "WEB_SCRAPING",
      "description": "Web crawling and user-generated traffic"
    },
    {
      "cidr": "54.174.53.218/32",
      "direction": "EGRESS",
      "service": "DNS",
      "description": "External DNS"
    }
  ]
}
Each entry in the results returned in the response will include the following properties:
PropertyTypeDescription
cidrStringThe range of IP addresses used for a specific purpose in HubSpot.
directionStringDenotes the direction of IP traffic. Available values are: "INGRESS", "EGRESS".
serviceStringDenotes the nature of the service for the IP addresses. Values include: "EMAIL", "API", "DNS", "WEB_SCRAPING".
descriptionStringDetails about the purpose of the set of IP addresses.

​
Retrieve IP range data in plaintext format

If you just want to retrieve HubSpot’s IP address data in plaintext format, you can make a GET request to /meta/network-origins/2026-09-beta/ip-ranges/simple and include a header of Accept: text/plain in your request. This will filter the results to just the IP address ranges themselves with none of the other properties in the table above. The response will resemble the following: 
3.127.29.218/32
141.193.185.128/25
18.159.155.92/32
141.193.184.128/25
3.127.84.21/32
18.158.38.39/32
158.247.16.0/20
54.174.53.6/31
18.157.238.182/32
3.93.157.0/24
216.157.40.0/27
216.139.64.0/19
143.244.87.0/25
18.193.15.23/32
54.174.53.242/32
143.244.80.0/20
54.174.53.52/30
54.174.53.56/30
18.185.234.1/32
216.157.42.96/28
18.192.136.149/32
54.174.62.128/26
54.174.53.46/32
54.174.53.64/28
18.156.57.155/32
141.193.185.32/27
54.174.53.217/32
54.174.53.230/32
18.208.124.128/25
54.174.53.144/32
18.184.86.102/32
54.174.53.51/32
216.157.41.64/27
54.174.53.10/32
18.192.172.225/32
18.159.93.15/32
18.159.234.92/32
54.174.60.0/23
216.157.41.112/29
3.125.100.85/32
18.157.153.160/32
216.157.42.0/27
54.174.63.0/24
18.159.128.28/32
54.174.52.0/24
54.174.53.62/32
216.157.41.96/28
141.193.184.64/26
54.174.53.44/31
216.157.40.64/27
3.126.182.232/32
54.174.53.8/32
3.127.178.149/32
54.174.58.224/27
3.126.163.49/32
18.184.24.22/32
54.174.53.38/32
18.157.252.152/32
108.179.144.0/20
54.174.53.15/32
54.174.53.244/32
54.174.53.221/32
141.193.184.0/27
18.157.207.111/32
3.210.190.0/24
216.157.40.96/28
54.174.53.142/32
54.174.53.238/32
141.193.185.0/27
3.127.31.193/32
18.192.252.214/32
139.180.17.0/24
54.174.57.0/24
54.174.53.43/32
18.192.141.124/32
216.157.41.0/27
18.158.189.225/32
3.125.72.185/32
141.193.185.64/26
18.159.231.78/32
3.127.53.179/32
18.159.199.77/32
216.157.42.112/29
216.157.40.112/29
3.126.39.79/32
141.193.184.32/27
54.174.59.0/24
216.157.42.64/27
54.174.53.60/31
54.174.53.210/32
3.125.129.244/32
54.174.53.218/32

​
Webhook notifications

Subscribe to IP range changes via webhooks. When HubSpot adds, updates, or removes IP ranges, your endpoint receives a signed POST request with the change details.

​
Requirements

You must host a backend service that receives webhook payloads when a subscription is triggered. Provide the service’s callback URL when creating the webhook subscription.

​
Subscribe to IP range change notifications

To subscribe to IP range changes from HubSpot, make a POST request to /meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}. In the body of your request, include the URL of your backend service as the webhookUrl property. The URL must be a valid HTTPS. If it isn’t, the endpoint will return a 400 Bad Request. For example, the following request body would specify https://example.com/my-webhook-endpoint as the callback URL: 
{
  "webhookUrl": "https://example.com/my-webhook-endpoint"
}
A successful 201 Created response will resemble the following: 
{
  "createdResourceId": "12345",
  "entity": {
    "id": 12345,
    "portalId": 100,
    "appId": 200,
    "webhookUrl": "https://example.com/my-webhook-endpoint",
    "createdByUserId": 999,
    "createdAt": "2026-03-17T15:30:00Z",
    "updatedAt": "2026-03-17T15:30:00Z"
  } 
}
The id returned, is the subscription ID, which you will need when you test your subscription. If you attempt to register a URL that’s already been registered, you’ll receive a 409 Conflict.

​
Test your webhook subscription

Once registered, you can test the subscription by making a POST request to /meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}/{subscription-id}/test, supplying the subscription ID found in the response you received when you registered your subscription as the subscriptionId path parameter, along with the ID of your app. A successful request returns 200 OK with no response body. Your backend service will receive a test webhook payload to your configured callback URL, shown in the code block below: 
{
  "timestamp": "2026-03-16T12:00:00Z",
  "event": {
    "eventId": "550e8400-e29b-41d4-a716-446655440000",
    "changeType": "CREATED",
    "ipRange": {
      "cidr": "192.0.2.0/24",
      "description": "Test IP range for webhook validation",
      "direction": "EGRESS",
      "service": "TEST_SERVICE"
    },
    "hublets": ["na1"]
  }
}
The table below provides details on each of the fields included in the webhook payload:
PropertyTypeDescription
timestampStringAn ISO 8601 formatted timestamp denoting when the event was fired.
eventObjectAn object containing details about the webhook payload, which contains the following properties:
  • eventId: a unique identifier for the event.
  • changeType: An enumeration denoting the webhook change type: CREATED, UPDATED, DELETED.
  • ipRange: an object that describes the updated IP range. The properties of this object are detailed in the table below.
  • hublets: an array that covers the regions where the IP ranges reside.
The ipRange sub-property within the event field contains the following properties:
PropertyTypeDescription
cidrStringThe range of IP addresses used for a specific purpose in HubSpot.
directionStringDenotes the direction of IP traffic. Available values are: "INGRESS", "EGRESS".
serviceStringDenotes the nature of the service for the IP addresses. Values include: "EMAIL", "API", "DNS", "WEB_SCRAPING", and "TEST_SERVICE".
descriptionStringDetails about the purpose of the set of IP addresses.

​
Validate the signature

Webhook requests are signed using the standard HubSpot webhook signature (v3). Learn more about how to validate incoming requests using your app’s client secret.

​
Delivery behavior

  • Webhooks are delivered as signed POST requests with a JSON body and a 30-second timeout per delivery.
  • Each event is delivered once per subscription. If a delivery succeeds, the same event won’t be resent to that subscription.
  • If your endpoint returns a non-2xx status or times out, the delivery is recorded as failed. There are no automatic retries. Failed deliveries are logged but not reattempted on a schedule.
  • Events are processed in batches. Multiple IP range changes that occur close together may each trigger a separate webhook delivery to your endpoint.
Learn more about error handling for common errors you may encounter when setting up your webhooks.

​
Retrieve webhook subscriptions

Retrieve a collection of all webhooks for your app by making a GET request to /meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}, supplying the ID of your app as the appId path parameter. A successful response will resemble the following: 
{
  "results": [
    {
      "id": 12345,
      "portalId": 100,
      "appId": 200,
      "webhookUrl": "https://example.com/my-webhook-endpoint",
      "createdByUserId": 999,
      "createdAt": "2026-03-17T15:30:00Z",
      "updatedAt": "2026-03-17T15:30:00Z"
    },
   ...
  ]
}

​
Delete webhook subscriptions

Delete webhook subscriptions for your app by making a DELETE request to /meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}/{subscriptionId}, supplying the subscription ID found in the response you received when you registered your subscription as the subscriptionId path parameter, along with the ID of your app. No further notifications will be sent to the deleted subscription’s URL. A successful request returns 204 No Content with no response body.
Last modified on April 3, 2026