Egress IP ranges

Allow-list our capture traffic in your WAF or firewall.

If the pages you capture are behind a WAF, an IP allow-list, or a staging firewall, you need to know which addresses our browsers come from.

Machine-readable

curl https://api.pagecapture.dev/egress-ips.json

{
  "version": "egress-2026-08-1",
  "updated_at": "2026-08-01",
  "change_notice_days": 30,
  "ranges": [
    { "cidr": "203.0.113.0/24", "region": "default", "effective_from": "2026-08-01" }
  ]
}

The document needs no API key — firewall automation is usually a cron with curl and no credential to give.

How we change it

A new range appears with an effective_from date before we start using it, so you can allow-list it ahead of time.
A range being retired carries retiring_on for at least change_notice_days — 30 days — rather than disappearing between two deploys.
version changes whenever the set changes, so a diff is cheap to detect.

Poll the document daily and reconcile. Hard-coding today's list into a firewall rule is the failure mode this endpoint exists to prevent.

Regions

When you pin captures to a country with ip_country_code, the exit addresses come from that region's block. The region field on each range tells you which. The country catalog itself is at /v1/regions.