# Safelist IPs

Learn about PagerDuty's best practices for IP safelisting


> **Best Practice:** PagerDuty supports safelisting IP addresses. However, this method of ensuring webhook delivery security is no longer best practice. [TLS 1.2](/developer/mutual-tls) and custom headers are now available for webhooks, which will ensure that webhooks deliver from PagerDuty. If you are migrating away from IP safelisting and have questions about PagerDuty's webhook deliverability, [contact our Support Team](https://www.pagerduty.com/contact-us/#contact-support).

> **EU Service Region:** Safelist IPs resolving to the URLs corresponding to [your service region](/get-started/service-regions). Currently available regions are US and EU.

## Events API

PagerDuty's [Events API](/developer/events-api-v2-overview) is used for triggering, acknowledging, and resolving incidents. To access the Events API, your system must be able to make outbound connections to `events.pagerduty.com` on TCP port 443 (for HTTPS).

`events.pagerduty.com` and `events.eu.pagerduty.com` resolve to multiple IPs, which you can find by querying the A records using `dig` or `nslookup`.

### Example Query (US)

```shell
$ dig a +short events.pagerduty.com 
35.167.69.145
44.231.93.240
44.233.86.211
```

In this example, the Events API is accessible in the US region at the IPs `35.167.69.145`, `44.231.93.240`, and `44.233.86.211`.

### Example Query (EU)

```shell
$ dig a +short events.eu.pagerduty.com
18.159.153.65
18.198.156.244
35.159.34.57
```

In this example, the Events API is accessible in the EU region at the IPs `18.159.153.65`, `18.198.156.244`, and `35.159.34.57`.

## REST API

To access the [REST API](/developer/rest-api-overview), your system must be able to make outbound connections to `api.pagerduty.com` and/or `api.eu.pagerduty.com` on TCP port 443. The REST API only allows HTTPS connections — HTTP connections are not allowed.

`api.pagerduty.com` and `api.eu.pagerduty.com` resolve to multiple IPs. These IPs will differ from those used for the [Events API](#events-api) or [webhooks](#webhooks).

While the IPs used by the REST API are not expected to change often, they may change from time to time. PagerDuty provides a list of [REST API IPs](/developer/rest-api-ips). Any changes to these IPs will be reflected in that list at least 30 days before they take effect, giving you time to update any filtering you may have in place.

Note that while multiple IPs are listed, not all of them may be in use at a given time. To avoid interruptions, do not use DNS lookups to determine the IPs to filter.

## Webhooks

[Webhooks](/integrations/webhooks) are HTTP or HTTPS calls sent from PagerDuty to your web server on the IP and port of your choosing. See the current list of IPs that PagerDuty uses to send webhooks in the developer documentation: [Webhook IPs](/developer/webhook-ips).

### Firewalls and Access Control Lists (ACLs)

The IP addresses listed in [Webhook IPs](/developer/webhook-ips) are a fixed list and are not expected to change. You can safely hardcode them into your firewall or ACL.

> **Webhook IPs:** Prior to May 5th, 2022, the list of Webhook IPs was subject to change without notice. Since Webhook IPs are now fixed, the scripts previously provided to notify you and automatically update EC2 security groups have been retired.

### Incident Workflow Actions

Incident Workflow actions that make external HTTP requests — including **Web API** actions such as [Send GET Request](/workflow-actions/web-api-1/send-get-request) and [Send POST Request](/workflow-actions/web-api-1/send-post-request) — will originate from the IP addresses listed in [Webhook IPs](/developer/webhook-ips).

## Jira Server Integration

If you are using the [Jira Server](/integrations/jira-server) integration, you will also need to add the address records of `app.pagerduty.com` or `app.eu.pagerduty.com` to any safelist that controls network egress traffic, depending on your account's service region. This integration makes API calls to PagerDuty that go directly to the hostname of your account's service region.