Official Raims webhook IPs

All webhooks sent by Raims use the IPv4 addresses listed on this page. Add all five addresses to the allowlist of the infrastructure protecting your receiving endpoint.

Webhook source IPs

18.230.162.249
54.94.189.157
54.21.10.37
54.233.100.88
54.232.137.193

Allow all addresses: a delivery may come from any of them. If the tool requires CIDR notation, add /32 to each IPv4 address to allow only that address.

Production and Sandbox

Production and Sandbox webhooks use the same five IPs. Allow this list through the firewall during Sandbox integration tests as well; there is no additional address list for that environment.

When to configure the allowlist

Configure the list when endpoint access depends on a source rule, such as a firewall, WAF, Security Group, reverse proxy, or load balancer. If your infrastructure already accepts public requests, check whether another rule could block webhooks.

Configure endpoint access

1. Locate the layer controlling access to the address registered to receive webhooks.
2. Add the five official IPv4 addresses as allowed sources.
3. Restrict the rule to the webhook endpoint's domain and path when the tool permits. Allow POST requests received over HTTPS.
4. Check whether other security rules still block the request after the IP has been allowed.

If the endpoint is dedicated to Raims webhooks, you can restrict its sources to this list. Preserve the access required by other application routes; do not apply this restriction to the entire site.

Cloudflare and other proxies

If the domain uses the Cloudflare proxy, configure the Raims IP list in Cloudflare's incoming rules. The origin server receives the connection from Cloudflare, so its firewall must continue allowing the proxy addresses. Restricting that firewall directly to the five Raims IPs may block forwarded requests.

The same care applies to other proxies and load balancers. When using a header such as CF-Connecting-IP or X-Forwarded-For to identify the source, accept that information only from trusted proxies. A header sent directly by a client does not prove the source IP.

See the Cloudflare documentation on IP addresses and WAF exceptions to configure your infrastructure.

Validate the configuration

After saving the rules, follow a webhook delivery:

1. Check the firewall, WAF, or proxy logs to see whether the request was allowed.
2. Confirm in the application logs that the POST reached the correct endpoint.
3. If there is a 403 Forbidden response, identify which layer generated it and review the corresponding rule. Other WAF or application rules may reject the request even when the IP is already allowed.

If there is no record of the request in the application, also check the registered address, DNS resolution, HTTPS certificate, and rules in the layers before the server.