topic Re: HubSpot API domain or IP range in APIs & Integrations

HubSpot API domain or IP range

idanc — Mon, 17 Feb 2025 08:53:13 GMT

Hi,

We're custom integrating hubspot with a niche omnichannel platform. Their practice is to limit access to their APIs with geo blocking.

They've asked us to provide them with either a range of IP addresses for the hubspot API calls (which I told them is not possible as it's a dynamic range), and then they asked for a domain that is more specific than api.hubspot.com, so they can potentiall allowlist it.

Is there such a domain? specifically for API calls originating from the ops hub custom code actions.

Thanks!

Re: HubSpot API domain or IP range

BérangèreL — Mon, 17 Feb 2025 16:44:38 GMT

Hi @idanc, I hope that you are well!

Thanks for asking the HubSpot Community!

I'd love to put you in touch with some of our Top Experts and Community Members: Hi @sylvain_tirreau, @zach_threadint, @DanielJeal, @Maciek-Magic and @ChrisoKlepke do you have suggestions to help @idanc, please?

Have a nice day and thanks so much! ❤️

Best,
Bérangère

Re: HubSpot API domain or IP range

zach_threadint — Tue, 18 Feb 2025 01:34:01 GMT

Hi @idanc 👋

Unfortunately, no, at least not as far as I'm aware. Based on some quick testing, the HubSpot IP address credited with making a request (e.g. via a HubSpot Workflow Webhook or a request made using a Custom Workflow Action) changes frequently and doesn't seem to conform to any easily defined range. Sorry that's probably not the answer you were hoping for.

Is there any scope for the system you're integrating with to forgo IP restrictions in favour of supporting other security measures (e.g. HubSpot Request Validation, API authentication)?

I hope this proves helpful. Please let me know if you have any follow-up questions.

Re: HubSpot API domain or IP range

idanc — Tue, 18 Feb 2025 06:02:47 GMT

Thank you Berangere 🙏

Re: HubSpot API domain or IP range

idanc — Tue, 18 Feb 2025 06:07:06 GMT

Thank you Zach, I suspected as much but wanted to make sure. 🙏 re your question, the other system is already using authentication. they operate in a niche geo market (Israel) and serve primarily local companies so until now this posed no issue for them. Already told them Geo IP blocking is an outdated way to add security, after all, VPNs exist...