# Rapids Egress IP Addresses

When a Rapids container makes an outbound request, that request leaves our platform from one of a small set of public IPv4 addresses. If you need to allowlist Rapids traffic at a firewall, CDN or WAF, these are the addresses to use.

## Current addresses

The authoritative, machine-readable list lives at:

```
https://docs.danubedata.ro/rapids-egress-ips-v4.txt
```

One address per line, plain text, nothing else — so you can poll and diff it from a script:

```bash
curl -s https://docs.danubedata.ro/rapids-egress-ips-v4.txt
```

Always read the file rather than hard-coding a copy of it.

## How we announce changes

- **New addresses are published at least 14 days before they carry customer traffic.** Poll it more often than that and you'll see planned additions before they carry traffic.
- **Removed addresses get no advance notice.** A stale allow-rule for a retired address cannot break you, so removals are safe to pick up whenever you next poll.
- **Emergency capacity may go live sooner than 14 days.** This is rare. The file is updated immediately when it happens.

In short: additions are the only change you need to react to, and you get 14 days.

## Two things to know before you rely on this

**These addresses are shared.** Every Rapids container on the platform egresses through the same set, not just yours. An IP allow-rule therefore admits other customers' containers too. That is fine for cutting down noise and drive-by scanning, but it is not an authorization control.

**If you need "only my containers can reach this endpoint,"** use a secret your container holds and your origin verifies — an injected environment variable checked as a custom header, a Cloudflare service token, or mTLS. You can keep the IP rule on top for defense in depth.

## IPv6

Rapids containers egress over IPv4 only, so there is no IPv6 list to allowlist.