Skip to main content

​
API endpoint addresses

The API hosts are served through Cloudflare’s global anycast network. They have no static inbound IP addresses: the addresses they resolve to belong to Cloudflare and can change at any time. If your outbound firewall or proxy restricts destinations, allow the hostname (for example by SNI or in your egress proxy) rather than IP addresses. If you can only filter by address, use Cloudflare’s published ranges (IPv4, IPv6); AllRide does not announce changes to them. The base URLs and the addresses AllRide connects from are returned by the developer reference of each environment and shown on the developer reference page:
egressIps are the addresses AllRide connects from.

​
Addresses we connect from

Webhook deliveries leave from a small set of static egress addresses per environment (egressIps above). If your webhook receiver filters inbound traffic, allow them. The receiver must also be publicly resolvable on port 443 or 8443; private, loopback and cloud metadata addresses are refused when you save the endpoint and again at every delivery.

​
Change policy

  • New egress addresses are announced at least 30 days before AllRide starts using them.
  • Addresses being retired stay in use for at least 30 days after the announcement.
  • The API hosts have no published inbound addresses (see above); only the hostnames are stable.
  • Every change is announced by email to your technical contact (contacts.technicalEmail) and in a banner on this site, and the developer reference shows the new state.
Allow announced addresses as soon as they are announced, and remove retired ones only after their removal date.

​
TLS requirements

  • TLS 1.2 or newer with SNI. Plain-HTTP requests to the API host are refused with 403 and never redirected; always use https:// so that your key is never sent unencrypted.
  • The API hosts are proxied by Cloudflare and use a publicly trusted certificate that Cloudflare renews automatically. Do not pin the server certificate or its intermediate.
  • The API does not use client certificates: authenticate with your API key and, optionally, restrict calls to your addresses with the IP allowlist. The allowlist sees the address your request reaches Cloudflare from.
  • Webhooks are sent with TLS 1.2 or newer and certificate validation; your receiver needs a certificate from a public CA. Redirects are not followed.