> ## Documentation Index > Fetch the complete documentation index at: https://developers.hubspot.com/docs/llms.txt > Use this file to discover all available pages before exploring further. --- id: f634b5ee-e1c2-40a4-9a6d-01971b6f2080 --- # HubSpot IP ranges > Learn how to retrieve HubSpot's active IP addresses. export const ScopesList = ({scopes = [], description = "This API requires one of the following scopes:"}) => { if (!scopes || scopes.length === 0) { return null; } const sortedScopes = scopes.sort((a, b) => a.localeCompare(b)); return
{description}
{sortedScopes.map((scope, index) =>
{scope}
)}
; }; Use the IP range API to retrieve information about the IP addresses that HubSpot uses for various tools such as [marketing email](https://knowledge.hubspot.com/marketing-email/create-and-send-marketing-emails) or [one-to-one emails](https://knowledge.hubspot.com/one-to-one-email/send-and-reply-to-one-to-one-emails). This IP address information can be useful to forward to your IT team to configure allowlist rules for your company's firewall or other network configuration purposes. Check out [this Knowledge Base article](https://knowledge.hubspot.com/marketing-email/not-receiving-hubspot-system-or-notification-emails) for related information on troubleshooting other issues with HubSpot notifications and emails. This functionality is currently in beta. By participating in this beta, you agree to HubSpot's Developer Terms and Developer Beta Terms. Note that the functionality is still under active development and is subject to change based on testing and feedback. **Please note:** the IP ranges returned from the API may change over time. By regularly retrieving the latest IP ranges using this API, you'll ensure that you're not using a stale list of HubSpot-related IP addresses in your firewall or network configuration. ## Retrieve IP range data in JSON format To retrieve active HubSpot IP addresses, make a `GET` request to `/meta/network-origins/2026-09-beta/ip-ranges`. The response will resemble the following: ```json theme={null} { "results": [ { "cidr": "3.127.29.218/32", "direction": "EGRESS", "service": "WEB_SCRAPING", "description": "Web crawling and user-generated traffic" }, { "cidr": "18.159.155.92/32", "direction": "EGRESS", "service": "WEB_SCRAPING", "description": "Web crawling and user-generated traffic" }, { "cidr": "3.125.129.244/32", "direction": "EGRESS", "service": "WEB_SCRAPING", "description": "Web crawling and user-generated traffic" }, { "cidr": "54.174.53.218/32", "direction": "EGRESS", "service": "DNS", "description": "External DNS" } ] } ``` Each entry in the `results` returned in the response will include the following properties: | Property | Type | Description | | ------------- | ------ | ---------------------------------------------------------------------------------------------------------------------- | | `cidr` | String | The range of IP addresses used for a specific purpose in HubSpot. | | `direction` | String | Denotes the direction of IP traffic. Available values are: `"INGRESS"`, `"EGRESS"`. | | `service` | String | Denotes the nature of the service for the IP addresses. Values include: `"EMAIL"`, `"API"`, `"DNS"`, `"WEB_SCRAPING"`. | | `description` | String | Details about the purpose of the set of IP addresses. | ## Retrieve IP range data in plaintext format If you just want to retrieve HubSpot's IP address data in plaintext format, you can make a `GET` request to `/meta/network-origins/2026-09-beta/ip-ranges/simple` and include a header of `Accept: text/plain` in your request. This will filter the results to just the IP address ranges themselves with none of the other properties in the table above. The response will resemble the following: ```text wrap expandable theme={null} 3.127.29.218/32 141.193.185.128/25 18.159.155.92/32 141.193.184.128/25 3.127.84.21/32 18.158.38.39/32 158.247.16.0/20 54.174.53.6/31 18.157.238.182/32 3.93.157.0/24 216.157.40.0/27 216.139.64.0/19 143.244.87.0/25 18.193.15.23/32 54.174.53.242/32 143.244.80.0/20 54.174.53.52/30 54.174.53.56/30 18.185.234.1/32 216.157.42.96/28 18.192.136.149/32 54.174.62.128/26 54.174.53.46/32 54.174.53.64/28 18.156.57.155/32 141.193.185.32/27 54.174.53.217/32 54.174.53.230/32 18.208.124.128/25 54.174.53.144/32 18.184.86.102/32 54.174.53.51/32 216.157.41.64/27 54.174.53.10/32 18.192.172.225/32 18.159.93.15/32 18.159.234.92/32 54.174.60.0/23 216.157.41.112/29 3.125.100.85/32 18.157.153.160/32 216.157.42.0/27 54.174.63.0/24 18.159.128.28/32 54.174.52.0/24 54.174.53.62/32 216.157.41.96/28 141.193.184.64/26 54.174.53.44/31 216.157.40.64/27 3.126.182.232/32 54.174.53.8/32 3.127.178.149/32 54.174.58.224/27 3.126.163.49/32 18.184.24.22/32 54.174.53.38/32 18.157.252.152/32 108.179.144.0/20 54.174.53.15/32 54.174.53.244/32 54.174.53.221/32 141.193.184.0/27 18.157.207.111/32 3.210.190.0/24 216.157.40.96/28 54.174.53.142/32 54.174.53.238/32 141.193.185.0/27 3.127.31.193/32 18.192.252.214/32 139.180.17.0/24 54.174.57.0/24 54.174.53.43/32 18.192.141.124/32 216.157.41.0/27 18.158.189.225/32 3.125.72.185/32 141.193.185.64/26 18.159.231.78/32 3.127.53.179/32 18.159.199.77/32 216.157.42.112/29 216.157.40.112/29 3.126.39.79/32 141.193.184.32/27 54.174.59.0/24 216.157.42.64/27 54.174.53.60/31 54.174.53.210/32 3.125.129.244/32 54.174.53.218/32 ``` ## Webhook notifications Subscribe to IP range changes via webhooks. When HubSpot adds, updates, or removes IP ranges, your endpoint receives a signed `POST` request with the change details. ### Requirements You must host a backend service that receives webhook payloads when a subscription is triggered. Provide the service’s callback URL when creating the webhook subscription. ### Subscribe to IP range change notifications To subscribe to IP range changes from HubSpot, make a `POST` request to `/meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}`. In the body of your request, include the URL of your backend service as the `webhookUrl` property. The URL must be a valid `HTTPS`. If it isn't, the endpoint will return a `400 Bad Request`. For example, the following request body would specify `https://example.com/my-webhook-endpoint` as the callback URL: ```json theme={null} { "webhookUrl": "https://example.com/my-webhook-endpoint" } ``` A successful `201 Created` response will resemble the following: ```json theme={null} { "createdResourceId": "12345", "entity": { "id": 12345, "portalId": 100, "appId": 200, "webhookUrl": "https://example.com/my-webhook-endpoint", "createdByUserId": 999, "createdAt": "2026-03-17T15:30:00Z", "updatedAt": "2026-03-17T15:30:00Z" } } ``` The `id` returned, is the subscription ID, which you will need when you test your subscription. If you attempt to register a URL that’s already been registered, you’ll receive a `409 Conflict`. ### Test your webhook subscription Once registered, you can test the subscription by making a `POST` request to `/meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}/{subscription-id}/test`, supplying the subscription ID found in the response you received when you registered your subscription as the `subscriptionId` path parameter, along with the ID of your app. A successful request returns `200 OK` with no response body. Your backend service will receive a test webhook payload to your configured callback URL, shown in the code block below: ```json theme={null} { "timestamp": "2026-03-16T12:00:00Z", "event": { "eventId": "550e8400-e29b-41d4-a716-446655440000", "changeType": "CREATED", "ipRange": { "cidr": "192.0.2.0/24", "description": "Test IP range for webhook validation", "direction": "EGRESS", "service": "TEST_SERVICE" }, "hublets": ["na1"] } } ``` The table below provides details on each of the fields included in the webhook payload: | Property | Type | Description | | ----------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `timestamp` | String | An ISO 8601 formatted timestamp denoting when the event was fired. | | `event` | Object | An object containing details about the webhook payload, which contains the following properties: | The `ipRange` sub-property within the `event` field contains the following properties: | Property | Type | Description | | ------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | `cidr` | String | The range of IP addresses used for a specific purpose in HubSpot. | | `direction` | String | Denotes the direction of IP traffic. Available values are: `"INGRESS"`, `"EGRESS"`. | | `service` | String | Denotes the nature of the service for the IP addresses. Values include: `"EMAIL"`, `"API"`, `"DNS"`, `"WEB_SCRAPING"`, and `"TEST_SERVICE"`. | | `description` | String | Details about the purpose of the set of IP addresses. | #### Validate the signature Webhook requests are signed using the standard HubSpot webhook signature (v3). Learn more about how to [validate incoming requests](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/request-validation) using your app’s client secret. ### Delivery behavior * Webhooks are delivered as signed POST requests with a JSON body and a 30-second timeout per delivery. * Each event is delivered once per subscription. If a delivery succeeds, the same event won't be resent to that subscription. * If your endpoint returns a non-2xx status or times out, the delivery is recorded as failed. There are no automatic retries. Failed deliveries are logged but not reattempted on a schedule. * Events are processed in batches. Multiple IP range changes that occur close together may each trigger a separate webhook delivery to your endpoint. Learn more about [error handling](https://developers.hubspot.com/docs/api-reference/error-handling) for common errors you may encounter when setting up your webhooks. ### Retrieve webhook subscriptions Retrieve a collection of all webhooks for your app by making a `GET` request to `/meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}`, supplying the ID of your app as the `appId` path parameter. A successful response will resemble the following: ```json theme={null} { "results": [ { "id": 12345, "portalId": 100, "appId": 200, "webhookUrl": "https://example.com/my-webhook-endpoint", "createdByUserId": 999, "createdAt": "2026-03-17T15:30:00Z", "updatedAt": "2026-03-17T15:30:00Z" }, ... ] } ``` ### Delete webhook subscriptions Delete webhook subscriptions for your app by making a `DELETE` request to `/meta/network-origins/2026-09-beta/ip-ranges/webhook-subscriptions/{appId}/{subscriptionId}`, supplying the subscription ID found in the response you received when you registered your subscription as the `subscriptionId` path parameter, along with the ID of your app. No further notifications will be sent to the deleted subscription’s URL. A successful request returns `204 No Content` with no response body.