Restricting access to Zendesk using IP restrictions

<body>
<p id="docs-hc-snippet" style="display: none;">You can restrict access to Zendesk to users within a specified IP address range. You can also restrict access to users with specific IP addresses. This means that any attempt to make API calls, sign in, or access pages in any Zendesk product will fail from outside your allowed IP addresses. For example, to restrict access to users in your company, only allow access from your company's IP addresses.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">You can restrict access to your account by allowing only specific IP addresses or ranges, blocking sign-ins, API calls, and page access from outside these IPs. Customers can be allowed to bypass restrictions while agents and admins cannot. Be sure to include all external IPs for integrations. Some undocumented endpoints remain accessible regardless of restrictions, so review their security implications carefully.</p>
</div>

<div class="body">

<div class="note fastpath">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Security &gt;
Advanced</span>
</div>
<p class="p">You can restrict access to Zendesk to users within a specified IP address range. You can
also restrict access to users with specific IP addresses. This means that any attempt to
make API calls, sign in, or access pages in any Zendesk product will fail from outside
your allowed IP addresses. For example, to restrict access to users in your company,
only allow access from your company's IP addresses.</p>
<p class="p">You can also allow customers (but not agents and administrators) to bypass IP
restrictions. IP restrictions you manage in Admin Center apply to all Zendesk products
and Zendesk mobile applications. The restrictions may also affect how other products,
such as Gmail attachments, work.</p>
<div class="p">
<div class="note" id="topic-1__note_k3d_wk1_s3c">
<span class="notetitle">Note:</span> Enabling IP-based access restrictions can break third-party
integrations. Be sure to include all external IPs that need access to your account
via the Zendesk API.</div>
</div>
<div class="p">
<strong class="ph b">To set IP restrictions</strong>
<ol class="ol" id="topic-1__ol_wkm_lnb_ad">
<li class="li" dir="ltr"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic-1__d9e369" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Advanced</strong>.</span></li>
<li class="li">Click the <strong class="ph b">IP Restrictions</strong> tab.</li>
<li class="li">Select <strong class="ph b">Enable IP restrictions</strong>, then enter the <strong class="ph b">Allowed IP Ranges</strong>,
which can include ranges or individual IP addresses. <p class="p">When specifying IP
addresses, separate each address or range with a space. </p>
<div class="p">Two methods
are available to specify a range:<ul class="ul" id="topic-1__ul_m2d_tcb_s3c">
<li class="li">Use asterisk (*) wildcards. An IP address consists of four numbers
separated by periods, such as <strong class="ph b">192.168.0.1</strong>. You can substitute
a single asterisk character (*) for any number group to let Zendesk
know that it should accept any value in that space. For example,
<strong class="ph b">192.*.*.*</strong> allows any IP address whose first number is
192. </li>
<li class="li">Use <a class="xref" href="https://mxtoolbox.com/subnetcalculator.aspx" target="_blank">IP subnet mask syntax</a>. For
example, <strong class="ph b">192.168.1.0/25</strong> specifies all the IP addresses
between 192.168.1.0 and 192.168.1.127.</li>
</ul>
</div>
<p class="p">You can't specify IP ranges where the CIDR (Classless
Inter-Domain Routing) value is 0. For example, if you specify <strong class="ph b">
10.0.0.0/0</strong>, the <strong class="ph b">/0</strong> is invalid.</p>
</li>
<li class="li">(Optional) Select <strong class="ph b">Allow customers to bypass IP restrictions</strong>.<p class="p">This
option ensures that your customers can access your help center and messaging
channels regardless of their IP address, even if it falls outside the
allowed IP addresses.</p>
<p class="p">Agents and administrators cannot bypass IP
address restrictions.</p>
</li>
<li class="li">(Optional) If your implementation involves any third-party services, such as
external bots, make sure their IPs are included in your allowlist.</li>
<li class="li">Click <strong class="ph b">Save</strong>. </li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_yt4_tsc_qgc">
<h2 class="title topictitle2" id="ariaid-title2">Undocumented endpoints</h2>
<div class="body">
<p class="p">Certain <a class="xref" href="https://developer.zendesk.com/api-reference/introduction/undocumented_apis" target="_blank">undocumented endpoints</a> are not in scope
for IP restrictions and may be accessible from any network location, regardless of
the IP restrictions in place. Review these endpoints carefully and consider any
related security implications before using them. </p>
<div class="note" id="topic_yt4_tsc_qgc__note_wyx_ctc_qgc">
<span class="notetitle">Note:</span>
<p class="p">These endpoints are considered unsupported. Zendesk is not responsible for any
issues or losses arising from their use. See <a class="xref" href="https://developer.zendesk.com/api-reference/introduction/undocumented_apis/" target="_blank">Undocumented APIs</a>.</p>
</div>
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_yt4_tsc_qgc__table_rxk_qq2_rgc" rules="all" summary="">
<colgroup>
<col style="width:50%">
<col style="width:50%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry cellrowborder" id="d89e171" style="vertical-align:top;">Endpoint</th>
<th class="entry cellrowborder" id="d89e174" style="vertical-align:top;">Reason for exemption</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/pcm/campaign_analytics</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/pcm/campaign_list</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/pcm/campaign/{campaign-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable_blip</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/accounts/sunco_app</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/admin/brand_config_sets.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/admin/brand_config_sets/default.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/admin/brands</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/admin/brands.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/admin/integrations/{integrations-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/brands.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/config_sets</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/internal/config_sets.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/sdk_channels</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/sdk_channels/{sdk_channels-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/api/sdk_channels/lookup/sunco/{sunco-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/campaigns/{campaigns-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/config</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/messaging/custom_ticket_fields</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/embeddable/preview/config</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/frontendevents/dl</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/frontendevents/pca</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/frontendevents/pv</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/mobile_sdk_api/settings/{settings-id}.json</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/chat/static/css/style_language.less</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/chat/static/css/style_simulatev2.less</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/chat/static/css/style_variables.less</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/voice/calls/ivr_keypress/{ivr_keypress-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/voice/calls/ivr_menu/{ivr_menu-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/voice/failover/v3/on_exception</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/voice/verifications/status/{status-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/flow_composer/assets/bot-avatar/{bot-avatar-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint provides avatar images for bots. Centralized asset
delivery must remain openly accessible to ensure compatibility
across multiple Zendesk products and clients.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/ips</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">The endpoint provides necessary ingress and egress IP information
for customer firewall setup. It must be externally accessible to
enable customer operations and integrations.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/rapid_resolve/fetch</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This helper endpoint requires both an authentication token and an
article id for access, ensuring unauthorized use is not possible.
Open invocation is necessary to support technical workflows such as
feedback widgets.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/theming/api/internal/s3_upload_tracking</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint receives notifications from Amazon Simple
Notification Service (AWS SNS) regarding theme upload events and
uses SNS signature authentication. Public accessibility is required
to enable integration with AWS services.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/integrations/outlook/finish</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint is necessary to complete the Outlook authentication
process with Microsoft’s cloud service. Public accessibility is
required to support SSO and redirect functionality.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/services/talk_recordings/recordings/{recordings-id}</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint supports legacy recording integration during the
migration to the Voice product. It will remain open throughout the
transition period.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/zorgtest/zorgheaders</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint is used for integration testing. Applying access
restrictions would prevent automated validation.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/api/v2/zorgtest</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">This endpoint is used exclusively for internal integration
testing and system health checks. Implementing IP restrictions would
prevent automation and engineering teams from accessing the
endpoint.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">/flow_director/smooch/v2/webhook</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Public access to the webhook endpoint is necessary for
integration with external messaging services. Authentication is
handled through the use of unique webhook keys.</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d89e171" style="vertical-align:top;">All logout endpoints</td>
<td class="entry cellrowborder" headers="d89e174" style="vertical-align:top;">Logout endpoints must remain publicly accessible so users can
securely end their sessions from any network location.</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions",
"url": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions",
"headline": "Restricting access to Zendesk using IP restrictions",
"description": "You can restrict access to your account by specifying allowed IP address ranges to control user and API access, with options to allow customers to bypass these restrictions and considerations for third-party integrations and certain exempt endpoints.",
"articleSection": "Securing your Zendesk account",
"datePublished": "2021-10-16T17:46:01+00:00",
"dateModified": "2026-03-25T18:50:34.306853+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>