Egress IP allowlist

Static IPs Parseo uses when delivering webhooks, so your firewall or WAF can allow them.

Why this matters

Webhook deliveries originate from Parseo's infrastructure and hit your endpoint. If your receiver sits behind a corporate firewall, a cloud provider's security group, or a WAF with geo-restrictions, you typically need to allowlist the IPs Parseo sends from — otherwise healthy-looking deliveries get rejected by your network layer before reaching your application.

IPs to allowlist

Parseo delivers webhooks from the following static egress addresses. Open them for outbound HTTPS (TCP 443) on your receiver:

The IP list will be published here once launch infrastructure is finalized. Expect a stable set of at most 4 IPv4 addresses per region. We'll give at least 30 days' notice before changing them and maintain both old and new IPs during the transition.

Region	IPv4
EU (primary)	to be announced
EU (failover)	to be announced

Verifying an incoming delivery is from us

IP allowlisting protects your network perimeter; it does not authenticate the payload. A valid delivery must also:

Carry an X-Parseo-Signature header with a valid HMAC-SHA256 signature (see Signing)
Be within 5 minutes of t= in the signature header (replay protection)

Use POST /webhooks/{id}/verify-signature during integration to debug signature issues without waiting on real deliveries.

What to do if IPs change

We'll notify partners with a webhook:manage scope via:

A dashboard banner at least 30 days before the change
Email to the team owner
An announcement in the API changelog

During the transition window, deliveries come from both old and new IPs. After the window closes, only new IPs are used.

Outbound-only

Parseo never initiates inbound connections to your environment beyond webhook deliveries. If you need to send data to Parseo (e.g. forwarding events from your system), use the public API via https://api.parseo.app/api/external/v1/* — your side opens the connection; our IPs aren't relevant in that direction.