Documentation Grafana Cloud Security and account management List of Grafana Cloud IP addresses to add to your allowlist

List of Grafana Cloud IP addresses to add to your allowlist

If your network restricts inbound or outbound traffic, you can allowlist Grafana Cloud’s IP addresses so your services can communicate with Grafana Cloud, and so that Grafana Cloud can reach your services.

Ingress and egress IP addresses

Grafana Cloud publishes two kinds of allowlist, distinguished by the direction field in the Allowlist API:

• Ingress (ingress-to-grafana): the public destination IP addresses your systems connect to when sending data to or querying Grafana Cloud services. Allow these ranges when your network restricts outbound connections to Grafana Cloud.
• Egress (egress-from-grafana): the public source IP addresses Grafana Cloud uses when it connects to your systems, for example a Grafana instance querying your data source or sending alert notifications (the grafana service). Allow these ranges when your network restricts inbound connections from Grafana Cloud.

You don’t need these IP addresses for traffic that flows over private connectivity such as PrivateLink.

Allowlist API

The Allowlist API publishes the current source IP addresses as JSON, at three levels of granularity. Every entry includes the traffic direction (ingress-to-grafana or egress-from-grafana) and a list of ipv4 CIDR ranges. The IP addresses in the following examples are for illustration only.

Valid service names are grafana, metrics, logs, traces, profiles, otlp, alerts, and fleet-management.

Global (all non-BYOC Grafana Cloud regions)

Returns every service for every Grafana Cloud-managed, non-BYOC region, keyed by region under a top-level regions object. BYOC regions are intentionally excluded.

Bash Copy

curl -s https://allowlists.grafana.net/v1/

JSON Copy

{
  "metadata": { "schemaVersion": "v1" },
  "regions": {
    "prod-eu-west-2": {
      "services": {
        "metrics": {
          "direction": "ingress-to-grafana",
          "ipv4": ["198.51.100.10/32", "198.51.100.11/32"]
        },
        "grafana": {
          "direction": "egress-from-grafana",
          "ipv4": ["203.0.113.20/32"]
        }
      }
    }
  }
}

Single region

Returns all services for one region. Replace <region> with your stack’s region, for example prod-eu-west-2.

Bash Copy

curl -s https://allowlists.prod-eu-west-2.grafana.net/v1/

JSON Copy

{
  "metadata": { "schemaVersion": "v1", "region": "prod-eu-west-2" },
  "services": {
    "metrics": {
      "direction": "ingress-to-grafana",
      "ipv4": ["198.51.100.10/32", "198.51.100.11/32"]
    },
    "grafana": {
      "direction": "egress-from-grafana",
      "ipv4": ["203.0.113.20/32"]
    }
  }
}

Single service in a region

Returns a single service for one region.

Bash Copy

curl -s https://allowlists.prod-eu-west-2.grafana.net/v1/metrics

JSON Copy

{
  "metadata": { "schemaVersion": "v1", "region": "prod-eu-west-2" },
  "service": {
    "name": "metrics",
    "direction": "ingress-to-grafana",
    "ipv4": ["198.51.100.10/32", "198.51.100.11/32"]
  }
}

BYOC (Bring Your Own Cloud)

BYOC region IP addresses are not included in the global endpoint. BYOC customers must use their regional endpoint directly:

https://allowlists.<your-region>.grafana.net/v1/

Migrate from legacy allowlists

This is not a drop-in URL change. The legacy endpoints return flat JSON arrays, plain-text lists, or DNS records. The new API returns structured JSON containing CIDR ranges, region metadata, and traffic-direction metadata.

To migrate:

1. Find every legacy reference. Check your automation and firewall configuration for grafana.com/api/*/source-ips, their .txt variants, and src-ips.*.grafana.net DNS records. Include global records and instance- or cluster-specific records.

2. Choose the appropriate endpoint.

   • For one service in one region, use https://allowlists.<region>.grafana.net/v1/<service>.
   • For all services in one region, use https://allowlists.<region>.grafana.net/v1/.
   • For all services across non-BYOC regions, use https://allowlists.grafana.net/v1/.

   If you currently use a global per-product list, there is no equivalent global per-service endpoint. Prefer the regional per-service endpoint for each stack, or read the global response and select the required service under each region.

3. Update your parser. The new response is a structured JSON object, and addresses are expressed as IPv4 CIDR ranges rather than bare IP addresses.

4. Update service names.

   • hosted-alerts becomes alerts.
   • hosted-grafana and grafana-assistant become grafana.
   • hosted-logs becomes logs.
   • hosted-metrics becomes metrics.
   • hosted-otlp becomes otlp.
   • hosted-profiles becomes profiles.
   • hosted-traces becomes traces.

5. Test before removing the legacy configuration. Where possible, temporarily allow the union of the legacy and new results. Validate telemetry delivery, queries, alert notifications, and other affected connections before you remove the legacy configuration.

6. Fetch the API dynamically. Retrieve the current response on a regular schedule rather than copying individual addresses into long-lived firewall configuration.

Complete and validate the migration by January 31, 2027.

Legacy per-product lists (deprecated)

Hosted Alerts

Hosted Alerts publishes lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-alerts/source-ips
• Text format: https://grafana.com/api/hosted-alerts/source-ips.txt
• DNS lookup: src-ips.hosted-alerts.grafana.net

Hosted Alerts are generated by data source-managed alert rules. These rules are evaluated within the data source itself, rather than by the Grafana instance. The resulting alerts are forwarded to a hosted Alertmanager instance, which then triggers the alert notifications.

To receive Grafana-managed alerts—alerts that are evaluated within Grafana and triggered by its built-in Alertmanager—enable access to the Hosted Grafana lists.

Hosted Grafana

Hosted Grafana publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-grafana/source-ips
• Text format: https://grafana.com/api/hosted-grafana/source-ips.txt
• DNS lookup: src-ips.hosted-grafana.grafana.net

Hosted Metrics

Hosted Metrics publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-metrics/source-ips
• Text format: https://grafana.com/api/hosted-metrics/source-ips.txt
• DNS lookup: src-ips.hosted-metrics.grafana.net

Hosted Traces

Hosted Traces publishes similar lists of up-to-date IP addresses that can be used for allow-listing:

• JSON format: https://grafana.com/api/hosted-traces/source-ips
• Text format: https://grafana.com/api/hosted-traces/source-ips.txt
• DNS lookup: src-ips.hosted-traces.grafana.net

Hosted Logs

Hosted Logs publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-logs/source-ips
• Text format: https://grafana.com/api/hosted-logs/source-ips.txt
• DNS lookup: src-ips.hosted-logs.grafana.net

Hosted Profiles

Hosted Profiles publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-profiles/source-ips
• Text format: https://grafana.com/api/hosted-profiles/source-ips.txt
• DNS lookup: src-ips.hosted-profiles.grafana.net

OTLP Gateway

Grafana Cloud OTLP Gateway publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/hosted-otlp/source-ips
• Text format: https://grafana.com/api/hosted-otlp/source-ips.txt
• DNS lookup: src-ips.hosted-otlp.grafana.net

Grafana Assistant

Grafana Assistant publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

• JSON format: https://grafana.com/api/grafana-assistant/source-ips
• Text format: https://grafana.com/api/grafana-assistant/source-ips.txt
• DNS lookup: src-ips.grafana-assistant.grafana.net

Synthetic Monitoring

Synthetic Monitoring publishes a list of up-to-date CIDR ranges that can be used for allowlisting:

• JSON format: https://allowlists.grafana.com/synthetics

DNS records

Private data source connect (PDC)

The PDC agent requires outbound access to two cluster-specific endpoints. Replace <CLUSTER> with your Grafana Cloud cluster value, which you can find in the Grafana UI under Connections > Private data source connections > Configuration Details.

The endpoint format depends on your cluster. Newer clusters and BYOC clusters use a regional format with a . (dot) separator, while older clusters use a flat format with a - (dash) separator:

The exact hostnames for your cluster appear in the Grafana UI under Connections > Private data source connections > Configuration Details.

For full setup instructions, refer to Configure private data source connect (PDC).