Skip to main content

​
API endpoint addresses

The API hosts are served through Cloudflare’s anycast network. They have no static inbound IP addresses: the addresses they resolve to are Cloudflare’s and can change at any time. If your network filters outbound traffic, allow the API hosts by hostname (for example in your proxy or firewall’s FQDN rules). If your firewall can only work with addresses, allow Cloudflare’s published ranges (IPv4, IPv6). Both hosts resolve to IPv4 and IPv6. Do not derive addresses from a DNS lookup. The base URL and the addresses AllRide connects from are returned by the developer reference of each environment and shown on the developer reference page:
egressIps lists the current addresses AllRide connects from (Get developer reference information), including the two disaster-recovery addresses. It is a plain list without status or dates: it holds the addresses that are in use (active or retiring), and an announced address joins it only on its since date. Take announced addresses from the announcement email or the egress address tables. Do not derive the addresses from a DNS lookup.

​
Addresses we connect from

AllRide connects to your systems from four static egress IPv4 addresses per environment (egressIps above): two that are in use, and two disaster-recovery addresses that carry traffic only after a failover to the second region. Allow all four, so that deliveries keep arriving after a failover. They are used for:
  • Webhook deliveries to your webhook endpoints (Webhooks).
  • OTP emails sent through your SMTP server, if you use email OTP links.
If your webhook receiver or SMTP server filters inbound traffic, allow all egress addresses of the environment you use, including the disaster-recovery addresses.

​
Egress address tables

The tables for sandbox and production, with each address’s status (active: in use; announced: used from its since date; retiring: still in use until its removeAfter date), are published here from AllRide’s infrastructure configuration. Status and dates are shown only in these tables; the developer reference lists the current set.
The tables appear here after the first network sync. Until then, egressIps in the developer reference lists the current addresses, and every change is announced by email to your technical contact.

​
Change policy

  • New egress addresses are announced at least 30 days before AllRide starts using them.
  • Addresses being retired stay in use for at least 30 days after the announcement.
  • The API hosts have no published inbound addresses (see above); only the hostnames are stable.
  • Every change is announced by email to your technical contact (contacts.technicalEmail) and in a banner on this site, and the developer reference shows the new state.
Allow announced addresses as soon as they are announced, and remove retired ones only after their removal date (removeAfter in the egress address tables); the announcement email gives the same dates.

​
TLS requirements

  • The API accepts only HTTPS with TLS 1.2 or newer and requires SNI. Plain-HTTP requests to the API host are refused with 403 and never redirected; always use https:// so that your key is never sent unencrypted.
  • The API hosts are served through Cloudflare and present a publicly trusted certificate that is managed and renewed automatically. Do not pin the server certificate or its intermediate: validate it against your system trust store.
  • Webhook deliveries connect to your endpoint over TLS 1.2 or newer and validate your server certificate against its hostname. Self-signed server certificates are not accepted.
  • The API authenticates your client with its API key over HTTPS; client certificates (mutual TLS) are not used. To restrict where your keys work from, use the IP allowlist.