--- title: "List of source IPs to add to your allowlist | Grafana Cloud documentation" description: "Lists IP addresses your network must allow" --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # List of source IPs to add to your allowlist If your network requires external services to be on an allowlist (formerly called a whitelist) to allow access, you can use the following lists to update your ACLs. > Note > > These lists can change. To stay up-to-date and receive notifications for changes to these lists, subscribe to the [Grafana status page](https://status.grafana.com/). ### Hosted Alerts Hosted Alerts publishes lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-alerts/source-ips](/api/hosted-alerts/source-ips) - Text format: [https://grafana.com/api/hosted-alerts/source-ips.txt](/api/hosted-alerts/source-ips.txt) - DNS lookup: `src-ips.hosted-alerts.grafana.net` > Note > > Instead of using these global lists, individual DNS lookup records are also available for each Hosted Alerts instance. > > These records can be found in your Grafana Cloud stack details on the **Alerts instance details** page, in the **Allowing IPs for this cluster** section. Hosted Alerts are generated by **data source-managed alert rules**. These rules are evaluated within the data source itself, rather than by the Grafana instance. The resulting alerts are forwarded to a hosted Alertmanager instance, which then triggers the alert notifications. To receive **Grafana-managed alerts**—alerts that are evaluated within Grafana and triggered by its built-in Alertmanager—enable access to the [Hosted Grafana lists](#hosted-grafana). ### Hosted Grafana Hosted Grafana publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-grafana/source-ips](/api/hosted-grafana/source-ips) - Text format: [https://grafana.com/api/hosted-grafana/source-ips.txt](/api/hosted-grafana/source-ips.txt) - DNS lookup: `src-ips.hosted-grafana.grafana.net` ### Hosted Metrics Hosted Metrics publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-metrics/source-ips](/api/hosted-metrics/source-ips) - Text format: [https://grafana.com/api/hosted-metrics/source-ips.txt](/api/hosted-metrics/source-ips.txt) - DNS lookup: `src-ips.hosted-metrics.grafana.net` > Note > > Instead of using these global lists, individual DNS lookup records are also available for each Hosted Metrics instance. > > These records can be found in your Grafana Cloud stack details on the **Prometheus or Graphite instance details** page, in the **Allowing IPs for this cluster** section. ### Hosted Traces Hosted Traces publishes similar lists of up-to-date IP addresses that can be used for allow-listing: - JSON format: [https://grafana.com/api/hosted-traces/source-ips](/api/hosted-traces/source-ips) - Text format: [https://grafana.com/api/hosted-traces/source-ips.txt](/api/hosted-traces/source-ips.txt) - DNS lookup: `src-ips.hosted-traces.grafana.net` > Note > > Instead of using these global lists, individual DNS lookup records are also available for each Hosted Traces instance. > > These records can be found in your Grafana Cloud stack details on the **Tempo instance details** page, in the **Allowing IPs for this cluster** section. ### Hosted Logs Hosted Logs publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-logs/source-ips](/api/hosted-logs/source-ips) - Text format: [https://grafana.com/api/hosted-logs/source-ips.txt](/api/hosted-logs/source-ips.txt) - DNS lookup: `src-ips.hosted-logs.grafana.net` > Note > > Instead of using these global lists, individual DNS lookup records are also available for each Hosted Logs instance. > > These records can be found in your Grafana Cloud stack details on the **Loki instance details** page, in the **Allowing IPs for this cluster** section. ### Hosted Profiles Hosted Profiles publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-profiles/source-ips](/api/hosted-profiles/source-ips) - Text format: [https://grafana.com/api/hosted-profiles/source-ips.txt](/api/hosted-profiles/source-ips.txt) - DNS lookup: `src-ips.hosted-profiles.grafana.net` > Note > > Instead of using these global lists, individual DNS lookup records are also available for each Hosted Profiles instance. > > These records can be found in your Grafana Cloud stack details on the **Pyroscope instance details** page, in the **Allowing IPs for this cluster** section. ### OTLP Gateway Grafana Cloud OTLP Gateway publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/hosted-otlp/source-ips](/api/hosted-otlp/source-ips) - Text format: [https://grafana.com/api/hosted-otlp/source-ips.txt](/api/hosted-otlp/source-ips.txt) - DNS lookup: `src-ips.hosted-otlp.grafana.net` ### Synthetic Monitoring Synthetic Monitoring publishes a list of up-to-date CIDR ranges that can be used for allowlisting: - JSON format: [https://allowlists.grafana.com/synthetics](https://allowlists.grafana.com/synthetics) #### DNS records > Warning > > DNS records for Synthetic Monitoring probes have been removed. They are no longer deployed, enhanced, or supported. ### Private data source connect (PDC) The PDC agent requires outbound access to two cluster-specific endpoints. Replace `` with your Grafana Cloud cluster value, which you can find in the Grafana UI under **Connections > Private data source connections > Configuration Details**. The endpoint format depends on your cluster. Newer clusters and BYOC clusters use a regional format with a `.` (dot) separator, while older clusters use a flat format with a `-` (dash) separator: Expand table | Endpoint | Regional format (newer clusters) | Flat format (older clusters) | |------------------------------------|------------------------------------------------------------|------------------------------------------------------------| | SSH tunnel (port 22) | `private-datasource-connect..grafana.net:22` | `private-datasource-connect-.grafana.net:22` | | Certificate signing API (port 443) | `private-datasource-connect-api..grafana.net:443` | `private-datasource-connect-api-.grafana.net:443` | The exact hostnames for your cluster appear in the Grafana UI under **Connections > Private data source connections > Configuration Details**. > Note > > PDC endpoints are DNS-based and cluster-specific, so there is no global IP list. If your firewall doesn’t support DNS-based rules, you can resolve the current IPs with `dig` or `nslookup`, but these IPs can change. Use DNS names where possible. For full setup instructions, refer to [Configure private data source connect (PDC)](/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/configure-pdc/). ### Grafana Assistant Grafana Assistant publishes similar lists of up-to-date IP addresses that can be used for allowlisting: - JSON format: [https://grafana.com/api/grafana-assistant/source-ips](/api/grafana-assistant/source-ips) - Text format: [https://grafana.com/api/grafana-assistant/source-ips.txt](/api/grafana-assistant/source-ips.txt) - DNS lookup: `src-ips.grafana-assistant.grafana.net`