Restricting access to Zendesk using IP restrictions


You can restrict access to Zendesk to users within a specified IP address range. You can also restrict access to users with specific IP addresses. This means that any attempt to make API calls, sign in, or access pages in any Zendesk product will fail from outside your allowed IP addresses. For example, to restrict access to users in your company, only allow access from your company's IP addresses.


What's my plan?







All Suites

Team, Growth, Professional, Enterprise, or Enterprise Plus










Support

Team, Professional, or Enterprise







Summary: ◀▼
You can restrict access to your account by allowing only specific IP addresses or ranges, blocking sign-ins, API calls, and page access from outside these IPs. Customers can be allowed to bypass restrictions while agents and admins cannot. Be sure to include all external IPs for integrations. Some undocumented endpoints remain accessible regardless of restrictions, so review their security implications carefully.





Location: Admin Center > Account > Security >
Advanced

You can restrict access to Zendesk to users within a specified IP address range. You can
also restrict access to users with specific IP addresses. This means that any attempt to
make API calls, sign in, or access pages in any Zendesk product will fail from outside
your allowed IP addresses. For example, to restrict access to users in your company,
only allow access from your company's IP addresses.
You can also allow customers (but not agents and administrators) to bypass IP
restrictions. IP restrictions you manage in Admin Center apply to all Zendesk products
and Zendesk mobile applications. The restrictions may also affect how other products,
such as Gmail attachments, work.


Note: Enabling IP-based access restrictions can break third-party
integrations. Be sure to include all external IPs that need access to your account
via the Zendesk API.


To set IP restrictions

In Admin Center, click
Account in the sidebar, then select Security > Advanced.
Click the IP Restrictions tab.
Select Enable IP restrictions, then enter the Allowed IP Ranges,
which can include ranges or individual IP addresses. When specifying IP
addresses, separate each address or range with a space.
Two methods
are available to specify a range:
Use asterisk (*) wildcards. An IP address consists of four numbers
separated by periods, such as 192.168.0.1. You can substitute
a single asterisk character (*) for any number group to let Zendesk
know that it should accept any value in that space. For example,
192.*.*.* allows any IP address whose first number is
192.
Use IP subnet mask syntax. For
example, 192.168.1.0/25 specifies all the IP addresses
between 192.168.1.0 and 192.168.1.127.


You can't specify IP ranges where the CIDR (Classless
Inter-Domain Routing) value is 0. For example, if you specify
10.0.0.0/0, the /0 is invalid.

(Optional) Select Allow customers to bypass IP restrictions. This
option ensures that your customers can access your help center and messaging
channels regardless of their IP address, even if it falls outside the
allowed IP addresses.
Agents and administrators cannot bypass IP
address restrictions.

(Optional) If your implementation involves any third-party services, such as
external bots, make sure their IPs are included in your allowlist.
Click Save.




Undocumented endpoints

Certain undocumented endpoints are not in scope
for IP restrictions and may be accessible from any network location, regardless of
the IP restrictions in place. Review these endpoints carefully and consider any
related security implications before using them.

Note:
These endpoints are considered unsupported. Zendesk is not responsible for any
issues or losses arising from their use. See Undocumented APIs.









Endpoint
Reason for exemption




/api/v2/pcm/campaign_analytics
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/api/v2/pcm/campaign_list
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/api/v2/pcm/campaign/{campaign-id}
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable_blip
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/accounts/sunco_app
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/admin/brand_config_sets.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/admin/brand_config_sets/default.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/admin/brands
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/admin/brands.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/admin/integrations/{integrations-id}
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/brands.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/config_sets
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/internal/config_sets.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/sdk_channels
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/sdk_channels/{sdk_channels-id}
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/api/sdk_channels/lookup/sunco/{sunco-id}
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/campaigns/{campaigns-id}
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/config
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/messaging/custom_ticket_fields
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/embeddable/preview/config
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/frontendevents/dl
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/frontendevents/pca
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/frontendevents/pv
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/mobile_sdk_api/settings/{settings-id}.json
Public access to this messaging analytics endpoint is required
for data collection and reporting by external systems.


/chat/static/css/style_language.less
This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.


/chat/static/css/style_simulatev2.less
This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.


/chat/static/css/style_variables.less
This endpoint delivers a globally shared static asset required by
all accounts. IP restrictions is not feasible without significant
redesign.


/voice/calls/ivr_keypress/{ivr_keypress-id}
This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.


/voice/calls/ivr_menu/{ivr_menu-id}
This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.


/voice/failover/v3/on_exception
This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.


/voice/verifications/status/{status-id}
This endpoint must be accessible to Twilio’s infrastructure to
support core call flows. Applying IP restrictions would interfere
with integration functionality.


/flow_composer/assets/bot-avatar/{bot-avatar-id}
This endpoint provides avatar images for bots. Centralized asset
delivery must remain openly accessible to ensure compatibility
across multiple Zendesk products and clients.


/ips
The endpoint provides necessary ingress and egress IP information
for customer firewall setup. It must be externally accessible to
enable customer operations and integrations.


/api/v2/rapid_resolve/fetch
This helper endpoint requires both an authentication token and an
article id for access, ensuring unauthorized use is not possible.
Open invocation is necessary to support technical workflows such as
feedback widgets.


/theming/api/internal/s3_upload_tracking
This endpoint receives notifications from Amazon Simple
Notification Service (AWS SNS) regarding theme upload events and
uses SNS signature authentication. Public accessibility is required
to enable integration with AWS services.


/integrations/outlook/finish
This endpoint is necessary to complete the Outlook authentication
process with Microsoft’s cloud service. Public accessibility is
required to support SSO and redirect functionality.


/api/services/talk_recordings/recordings/{recordings-id}
This endpoint supports legacy recording integration during the
migration to the Voice product. It will remain open throughout the
transition period.


/api/v2/zorgtest/zorgheaders
This endpoint is used for integration testing. Applying access
restrictions would prevent automated validation.


/api/v2/zorgtest
This endpoint is used exclusively for internal integration
testing and system health checks. Implementing IP restrictions would
prevent automation and engineering teams from accessing the
endpoint.


/flow_director/smooch/v2/webhook
Public access to the webhook endpoint is necessary for
integration with external messaging services. Authentication is
handled through the use of unique webhook keys.


All logout endpoints
Logout endpoints must remain publicly accessible so users can
securely end their sessions from any network location.






{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions",
"url": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions",
"headline": "Restricting access to Zendesk using IP restrictions",
"description": "You can restrict access to your account by specifying allowed IP address ranges to control user and API access, with options to allow customers to bypass these restrictions and considerations for third-party integrations and certain exempt endpoints.",
"articleSection": "Securing your Zendesk account",
"datePublished": "2021-10-16T17:46:01+00:00",
"dateModified": "2026-03-25T18:50:34.306853+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408894156186-Restricting-access-to-Zendesk-Support-and-your-help-center-using-IP-restrictions"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}
//
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//

//
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//

