Egress IP ranges

If the pages you capture are behind a WAF, an IP allow-list, or a staging firewall, you need to know which addresses our browsers come from.

Machine-readable

curl https://api.pagecapture.dev/egress-ips.json

{
  "version": "egress-2026-08-1",
  "updated_at": "2026-08-01",
  "change_notice_days": 30,
  "ranges": [
    { "cidr": "203.0.113.0/24", "region": "default", "effective_from": "2026-08-01" }
  ]
}

The document needs no API key — firewall automation is usually a cron with curl and no credential to give.

An empty list is an answer

If ranges comes back empty, that is the current state and not a failure: it means we are not publishing fixed exit addresses, so there is nothing for you to allow-list yet. The JSON above is the shape of the response, not a promise about its contents.

We would rather return nothing than a plausible-looking block. An invented range is worse than no range — you would open your firewall to an address we never use, your captures would keep failing, and our documentation would be the reason you looked in the wrong place.

The list is empty for a specific reason, not an oversight. Our browsers currently leave through addresses on shared platform infrastructure that we did not reserve. We can observe today's address, but we cannot commit to it: it is not ours to keep, and it can move without anyone telling us. Publishing it would break the promise directly below this section — change_notice_days of warning before a range changes — on the first reassignment. It would also be the wrong advice: an address we share with other workloads is one you would be opening your firewall to on their behalf, not only on ours.

If your pages sit behind a WAF today, authenticate the capture at the origin instead of at the network edge: send a shared token with headers, or a session with cookies, and have the origin allow that instead of an address. That control is yours, it does not depend on our infrastructure staying put, and it survives us changing hosting.

When we reserve dedicated outbound addresses, they appear here first, with a future effective_from, and this section goes away.

How we change it

• A new range appears with an effective_from date before we start using it, so you can allow-list it ahead of time.
• A range being retired carries retiring_on for at least change_notice_days — 30 days — rather than disappearing between two deploys.
• version changes whenever the set changes, so a diff is cheap to detect.

Poll the document daily and reconcile. Hard-coding today's list into a firewall rule is the failure mode this endpoint exists to prevent.

Regions

When you pin captures to a country with ip_country_code, the exit addresses come from that region's block. The region field on each range tells you which. The country catalog itself is at /v1/regions.