Skip to content

Commit 66913d5

Browse files
Vapi Taskerclaude
Vapi Tasker
and
claude
committed
docs: enhance static IP addresses documentation page
Expand the static IP addresses documentation with: - Comprehensive overview and use cases - Code examples for TypeScript SDK, Python SDK, and cURL - Configuration examples for Assistant, Phone Number, and Tool servers - Firewall configuration guides for AWS, GCP, Azure, and nginx - FAQ section addressing common questions - Next steps with related documentation links Resolves VAP-11353 Co-Authored-By: Claude <noreply@anthropic.com>
1 parent a79813e commit 66913d5

1 file changed

Lines changed: 326 additions & 20 deletions

File tree

‎fern/security-and-privacy/static-ip-addresses.mdx‎

Lines changed: 326 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,352 @@
11
---
22
title: Static IP addresses
3-
subtitle: Whitelist Vapi IP addresses
3+
subtitle: Configure Vapi to send requests from a fixed IP range for firewall whitelisting
44
slug: security-and-privacy/static-ip-addresses
55
---
66

7-
8-
## Introduction to Vapi static IP addresses
7+
## Overview
98

109
Vapi supports static IP addresses for outbound HTTP requests. When enabled, all HTTP requests from Vapi to your server will originate from a fixed set of IP addresses, allowing you to configure strict firewall rules and network security policies.
1110

12-
## Why use static IP addresses
11+
**Static IP addressing allows you to:**
12+
13+
- Whitelist specific IPs in your firewall configuration
14+
- Meet enterprise security and compliance requirements
15+
- Audit and verify that requests genuinely originate from Vapi
16+
- Integrate with corporate networks that restrict inbound traffic
1317

14-
Static IP addresses provide an additional layer of security for your infrastructure by allowing you to:
18+
<Info>
19+
Static IP addresses apply to **outbound HTTP requests** from Vapi to your servers, including webhook events, tool calls, and custom transcriber requests.
20+
</Info>
1521

16-
- **Control network access** - Restrict incoming traffic to only trusted sources
17-
- **Simplify firewall rules** - Define precise IP based access controls
18-
- **Meet compliance requirements** - Satisfy security policies that mandate IP whitelisting
19-
- **Audit traffic sources** - Verify that requests are genuinely from Vapi's infrastructure
22+
## Vapi's static IP range
2023

21-
## Vapi's static IP addresses
24+
When static IP addressing is enabled, all requests from Vapi will originate from the following CIDR block:
2225

23-
When static IP addressing is enabled, all webhook requests from Vapi will originate from the following CIDR block:
26+
```txt title="Static IP CIDR Range"
27+
167.150.224.0/23
28+
```
2429

25-
- `167.150.224.0/23`
30+
This CIDR range includes IP addresses from `167.150.224.0` to `167.150.225.255` (512 addresses total).
31+
32+
<Tip>
33+
Add this CIDR range to your firewall's allowlist to permit traffic from Vapi's static IP infrastructure.
34+
</Tip>
2635

2736
## Enabling static IP addresses
2837

29-
You can enable static IP addressing through the server object
38+
You can enable static IP addressing through the `server` configuration object. Set `staticIpAddressesEnabled` to `true` in any server configuration.
39+
40+
### Assistant server configuration
3041

31-
### Example
42+
Enable static IPs for webhook requests sent to your assistant's server URL:
3243

33-
```json
44+
<CodeBlocks>
45+
```json title="API Request"
3446
{
35-
"serverUrl": "https://your-server.example.com/webhook",
36-
"staticIpAddressesEnabled": true
47+
"name": "Support Assistant",
48+
"server": {
49+
"url": "https://api.yourcompany.com/webhook",
50+
"staticIpAddressesEnabled": true
51+
},
52+
"model": {
53+
"provider": "openai",
54+
"model": "gpt-4"
55+
}
3756
}
3857
```
3958

59+
```typescript title="TypeScript SDK"
60+
import { VapiClient } from "@vapi-ai/server-sdk";
61+
62+
const client = new VapiClient({ token: process.env.VAPI_API_KEY });
63+
64+
const assistant = await client.assistants.create({
65+
name: "Support Assistant",
66+
server: {
67+
url: "https://api.yourcompany.com/webhook",
68+
staticIpAddressesEnabled: true
69+
},
70+
model: {
71+
provider: "openai",
72+
model: "gpt-4"
73+
}
74+
});
75+
```
76+
77+
```python title="Python SDK"
78+
from vapi import Vapi
79+
import os
80+
81+
client = Vapi(token=os.getenv("VAPI_API_KEY"))
82+
83+
assistant = client.assistants.create(
84+
name="Support Assistant",
85+
server={
86+
"url": "https://api.yourcompany.com/webhook",
87+
"staticIpAddressesEnabled": True
88+
},
89+
model={
90+
"provider": "openai",
91+
"model": "gpt-4"
92+
}
93+
)
94+
```
95+
96+
```bash title="cURL"
97+
curl -X POST "https://api.vapi.ai/assistant" \
98+
-H "Authorization: Bearer $VAPI_API_KEY" \
99+
-H "Content-Type: application/json" \
100+
-d '{
101+
"name": "Support Assistant",
102+
"server": {
103+
"url": "https://api.yourcompany.com/webhook",
104+
"staticIpAddressesEnabled": true
105+
},
106+
"model": {
107+
"provider": "openai",
108+
"model": "gpt-4"
109+
}
110+
}'
111+
```
112+
</CodeBlocks>
113+
114+
### Phone number server configuration
115+
116+
Enable static IPs for incoming call webhooks on a phone number:
117+
118+
<CodeBlocks>
119+
```json title="API Request"
120+
{
121+
"number": "+14155551234",
122+
"server": {
123+
"url": "https://api.yourcompany.com/calls",
124+
"staticIpAddressesEnabled": true
125+
}
126+
}
127+
```
128+
129+
```typescript title="TypeScript SDK"
130+
const phoneNumber = await client.phoneNumbers.update("phone-number-id", {
131+
server: {
132+
url: "https://api.yourcompany.com/calls",
133+
staticIpAddressesEnabled: true
134+
}
135+
});
136+
```
137+
138+
```python title="Python SDK"
139+
phone_number = client.phone_numbers.update(
140+
"phone-number-id",
141+
server={
142+
"url": "https://api.yourcompany.com/calls",
143+
"staticIpAddressesEnabled": True
144+
}
145+
)
146+
```
147+
</CodeBlocks>
148+
149+
### Tool server configuration
150+
151+
Enable static IPs for custom tool endpoints:
152+
153+
<CodeBlocks>
154+
```json title="API Request"
155+
{
156+
"type": "function",
157+
"function": {
158+
"name": "get_customer_data",
159+
"description": "Retrieve customer information from CRM",
160+
"parameters": {
161+
"type": "object",
162+
"properties": {
163+
"customerId": { "type": "string" }
164+
},
165+
"required": ["customerId"]
166+
}
167+
},
168+
"server": {
169+
"url": "https://api.yourcompany.com/crm/customer",
170+
"staticIpAddressesEnabled": true
171+
}
172+
}
173+
```
174+
175+
```typescript title="TypeScript SDK"
176+
const tool = await client.tools.create({
177+
type: "function",
178+
function: {
179+
name: "get_customer_data",
180+
description: "Retrieve customer information from CRM",
181+
parameters: {
182+
type: "object",
183+
properties: {
184+
customerId: { type: "string" }
185+
},
186+
required: ["customerId"]
187+
}
188+
},
189+
server: {
190+
url: "https://api.yourcompany.com/crm/customer",
191+
staticIpAddressesEnabled: true
192+
}
193+
});
194+
```
195+
196+
```python title="Python SDK"
197+
tool = client.tools.create(
198+
type="function",
199+
function={
200+
"name": "get_customer_data",
201+
"description": "Retrieve customer information from CRM",
202+
"parameters": {
203+
"type": "object",
204+
"properties": {
205+
"customerId": {"type": "string"}
206+
},
207+
"required": ["customerId"]
208+
}
209+
},
210+
server={
211+
"url": "https://api.yourcompany.com/crm/customer",
212+
"staticIpAddressesEnabled": True
213+
}
214+
)
215+
```
216+
</CodeBlocks>
217+
218+
## Firewall configuration
219+
220+
To allow traffic from Vapi's static IP range, add the CIDR block to your firewall's allowlist.
221+
222+
### Common firewall configurations
223+
224+
<Tabs>
225+
<Tab title="AWS Security Groups">
226+
Add an inbound rule to your security group:
227+
228+
```txt
229+
Type: HTTPS
230+
Protocol: TCP
231+
Port: 443
232+
Source: 167.150.224.0/23
233+
Description: Vapi Static IPs
234+
```
235+
</Tab>
236+
<Tab title="GCP Firewall Rules">
237+
Create a firewall rule:
238+
239+
```bash
240+
gcloud compute firewall-rules create allow-vapi-static-ips \
241+
--direction=INGRESS \
242+
--priority=1000 \
243+
--network=your-vpc-network \
244+
--action=ALLOW \
245+
--rules=tcp:443 \
246+
--source-ranges=167.150.224.0/23 \
247+
--description="Allow Vapi Static IP traffic"
248+
```
249+
</Tab>
250+
<Tab title="Azure NSG">
251+
Add an inbound security rule:
252+
253+
```txt
254+
Name: AllowVapiStaticIPs
255+
Priority: 100
256+
Source: 167.150.224.0/23
257+
Destination: Any
258+
Port: 443
259+
Protocol: TCP
260+
Action: Allow
261+
```
262+
</Tab>
263+
<Tab title="nginx">
264+
Configure IP-based access control:
265+
266+
```nginx
267+
# Allow Vapi static IP range
268+
allow 167.150.224.0/23;
269+
270+
# Deny all other traffic (optional)
271+
deny all;
272+
```
273+
</Tab>
274+
</Tabs>
275+
40276
<Warning>
41-
Always test static IP configuration in a staging environment before deploying to production to avoid service disruptions.
277+
Always test your firewall configuration in a staging environment before deploying to production to avoid service disruptions.
42278
</Warning>
43279

44-
## Need help?
280+
## Use cases
281+
282+
### Enterprise security requirements
283+
284+
Many enterprise environments require strict network access controls. Static IP addresses enable you to:
285+
286+
- Comply with corporate security policies that mandate IP whitelisting
287+
- Integrate with on-premise systems behind corporate firewalls
288+
- Meet regulatory requirements for controlled network access
289+
290+
### Audit and compliance
291+
292+
Static IPs provide a verifiable source for request origin:
293+
294+
- Log and audit all incoming requests from the known IP range
295+
- Verify that webhook requests genuinely originate from Vapi
296+
- Support compliance audits with clear network traffic documentation
297+
298+
### Multi-layer security
299+
300+
Combine static IP whitelisting with other security measures:
301+
302+
- **IP whitelisting** + **[Server authentication](/server-url/server-authentication)** for defense in depth
303+
- **IP whitelisting** + **TLS/HTTPS** for encrypted, verified traffic
304+
- **IP whitelisting** + **Request signing** for tamper-proof webhooks
305+
306+
## FAQ
307+
308+
<AccordionGroup>
309+
<Accordion title="What requests use static IP addresses?">
310+
When enabled, static IP addresses apply to all outbound HTTP requests from Vapi to your servers, including:
311+
312+
- Webhook events (call status, transcripts, end-of-call reports)
313+
- Custom tool calls
314+
- Assistant request callbacks
315+
- Custom transcriber requests
316+
317+
Static IPs do **not** apply to:
318+
- SIP/RTP media traffic
319+
- WebSocket connections initiated by your client SDKs
320+
</Accordion>
321+
322+
<Accordion title="Is there additional cost for static IP addresses?">
323+
Contact our sales team for pricing information about static IP addresses. This feature may be included in certain enterprise plans.
324+
</Accordion>
325+
326+
<Accordion title="Can I use static IPs with existing authentication?">
327+
Yes. Static IP addresses work alongside all authentication methods:
328+
329+
- Bearer token authentication
330+
- OAuth 2.0
331+
- HMAC signatures
332+
- Custom headers
333+
334+
We recommend using static IPs **in addition to** authentication for defense in depth.
335+
</Accordion>
336+
337+
<Accordion title="What happens if I enable static IPs for some configurations but not others?">
338+
Static IP addressing is configured per server object. You can enable it for specific assistants, phone numbers, or tools while leaving others on dynamic IPs. Each configuration is independent.
339+
</Accordion>
340+
341+
<Accordion title="Will the static IP range change?">
342+
Vapi's static IP range (`167.150.224.0/23`) is stable and changes are rare. If changes are necessary, we will provide advance notice to affected customers. Subscribe to our status page for infrastructure updates.
343+
</Accordion>
344+
</AccordionGroup>
345+
346+
## Next steps
347+
348+
Now that you've configured static IP addresses:
45349

46-
If you have questions about static IP addressing, contact our support team at support@vapi.ai.
350+
- **[Server authentication](/server-url/server-authentication):** Add authentication to your webhook endpoints
351+
- **[Server events](/server-url/events):** Learn about the webhook events Vapi sends
352+
- **[Proxy server guide](/security-and-privacy/proxy-server):** Route requests through your own proxy

0 commit comments

Comments
 (0)