--- name: workload-protection-supported-endpoints title: Endpoints for Workload Protection description: A list of supported public and private endpoints for the IBM Cloud Security and Compliance Center Workload Protection service. last-updated: 2026-07-30 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/workload-protection?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Endpoints for Workload Protection {: #supported-endpoints} A list of supported public and private endpoints for the IBM Cloud Security and Compliance Center Workload Protection service. {: shortdesc} ## Web UI endpoints {: #supported-endpoints-web-ui} To access the IBM Cloud Security and Compliance Center Workload Protection web UI, you might need to define a firewall rule in your host. `(*)` Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in the allowlist as well. A notification will be sent before the current IP addresses are deprecated. {: note} The following table lists the endpoints that are available for each region: | Region | Web UI endpoint | Public IP addresses | Ports | |-------------|--------------------------------------------------|-----------------------------------------------------------|-----------------| | Dallas (`US-South`) | `https://us-south.security-compliance-secure.cloud.ibm.com` | 169.60.151.174 \n 169.46.0.70 \n 169.48.214.70 \n 67.18.89.114 `(*)` \n 52.116.136.3 `(*)` | https (TLS) 443 | | Frankfurt (`EU-DE`) | `https://eu-de.security-compliance-secure.cloud.ibm.com` | 149.81.77.78 \n 161.156.102.206 \n 159.122.102.38 \n 149.81.37.2 `(*)` \n 161.156.163.158 `(*)` | https (TLS) 443 | | London (`EU-GB`) | `https://eu-gb.security-compliance-secure.cloud.ibm.com` | 158.175.98.206 \n 141.125.73.118 \n 159.122.210.174 \n 141.125.160.111 `(*)` \n 158.176.193.118 `(*)` | https (TLS) 443 | | Madrid (`EU-ES`) | `https://eu-es.security-compliance-secure.cloud.ibm.com` | 13.120.68.187 \n 13.121.68.91 \n 13.122.68.140 \n 13.120.91.150 `(*)` \n 13.122.87.103 `(*)` | https (TLS) 443 | | Osaka (`JP-OSA`) | `https://jp-osa.security-compliance-secure.cloud.ibm.com` | 163.68.67.98 \n 163.69.66.170 \n 163.73.67.180 \n 163.69.80.155 `(*)` \n 163.73.94.97 `(*)` | https (TLS) 443 | | Sao Paulo (`BR-SAO`) | `https://br-sao.security-compliance-secure.cloud.ibm.com` | 163.107.66.98 \n 163.109.67.242 \n 169.57.141.43 \n 163.107.86.152 `(*)` \n 13.116.91.147 `(*)` | https (TLS) 443 | | Sydney (`AU-SYD`) | `https://au-syd.security-compliance-secure.cloud.ibm.com` | 135.90.73.100 \n 130.198.80.155 \n 168.1.213.78 \n 130.198.13.211 `(*)` \n 135.90.142.144 `(*)` | https (TLS) 443 | | Tokyo (`JP-TOK`) | `https://jp-tok.security-compliance-secure.cloud.ibm.com` | 165.192.84.14 \n 128.168.75.14 \n 169.56.51.238 \n 128.168.129.91 `(*)` \n 162.133.138.52 `(*)` | https (TLS) 443 | | Toronto (`CA-TOR`) | `https://ca-tor.security-compliance-secure.cloud.ibm.com` | 163.74.69.186 \n 158.85.94.130 \n 163.75.65.237 \n 163.74.85.210 `(*)` \n 163.75.89.127 `(*)` | https (TLS) 443 | | Washington (`US-East`) | `https://us-east.security-compliance-secure.cloud.ibm.com` | 169.60.112.74 \n 169.55.109.114 \n 169.62.3.82 \n 169.63.183.79 `(*)` \n 52.117.125.244 `(*)` | https (TLS) 443 | {: caption="Web UI endpoints" caption-side="bottom"} ## REST API endpoints {: #supported-endpoints-rest-api} To make API calls, you might need to define a firewall rule in your host. `(*)` Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in the allowlist as well. A notification will be sent before the current IP addresses are deprecated. {: note} ### Private REST API endpoints {: #supported-endpoints-rest-api-private} The following table lists the private REST API endpoints that are available for each region: | Region | Private REST API endpoint | Private IP addresses | |-------------|----------------------------------|----------------------------| | Dallas (`US-South`) | `https://private.us-south.security-compliance-secure.cloud.ibm.com/api` | 166.9.228.45 \n 166.9.229.45 \n 166.9.230.44 \n 166.9.228.235 `(*)` \n 166.9.229.31 `(*)` \n 166.9.251.30 `(*)` | | Frankfurt (`EU-DE`) | `https://private.eu-de.security-compliance-secure.cloud.ibm.com/api` | 166.9.248.88 \n 166.9.248.120 \n 166.9.248.152 \n 166.9.209.205 `(*)` \n 166.9.209.227 `(*)` \n 166.9.210.13 `(*)` | | London (`EU-GB`) | `https://private.eu-gb.security-compliance-secure.cloud.ibm.com/api` | 166.9.244.29 \n 166.9.244.59 \n 166.9.245.189 `(*)` \n 166.9.245.221 `(*)` \n 166.9.245.253 `(*)` | | Madrid (`EU-ES`) | `https://private.eu-es.security-compliance-secure.cloud.ibm.com/api` | 166.9.226.17 \n 166.9.227.16 \n 166.9.225.16 \n 166.9.226.56 `(*)` \n 166.9.227.143 `(*)` \n 166.9.225.35 `(*)` | | Osaka (`JP-OSA`) | `https://private.jp-osa.security-compliance-secure.cloud.ibm.com/api` | 166.9.247.44 \n 166.9.247.77 \n 166.9.247.109 \n 166.9.247.59 `(*)` \n 166.9.247.89 `(*)` \n 166.9.247.123 `(*)` | | Sao Paulo (`BR-SAO`) | `https://private.br-sao.security-compliance-secure.cloud.ibm.com/api` | 166.9.246.77 \n 166.9.246.108 \n 166.9.246.133 \n 166.9.246.87 `(*)` \n 166.9.246.120 `(*)` \n 166.9.246.144 `(*)` | | Sydney (`AU-SYD`) | `https://private.au-syd.security-compliance-secure.cloud.ibm.com/api` | 166.9.244.114 \n 166.9.244.144 \n 166.9.244.177 \n 166.9.244.121 `(*)` \n 166.9.244.153 `(*)` \n 166.9.244.185 `(*)` | | Tokyo (`JP-TOK`) | `https://private.jp-tok.security-compliance-secure.cloud.ibm.com/api` | 166.9.249.112 \n 166.9.249.141 \n 166.9.249.177 \n 166.9.212.4 `(*)` \n 166.9.214.5 `(*)` \n 166.9.216.14 `(*)` | | Toronto (`CA-TOR`) | `https://private.ca-tor.security-compliance-secure.cloud.ibm.com/api` | 166.9.247.153 \n 166.9.247.185 \n 166.9.247.205 \n 166.9.209.13 `(*)` \n 166.9.209.42 `(*)` \n 166.9.209.72 `(*)` | | Washington (`US-East`) | `https://private.us-east.security-compliance-secure.cloud.ibm.com/api` | 166.9.231.240 \n 166.9.232.28 \n 166.9.233.17 \n 166.9.231.19 `(*)` \n 166.9.232.40 `(*)` \n 166.9.233.36 `(*)` | {: caption="Private REST API endpoints" caption-side="bottom"} ### Public REST API endpoints {: #supported-endpoints-rest-api-public} The following table lists the public REST API endpoints that are available for each region: | Region | Public REST API endpoint | |-------------|---------------------------------------------------------------| | Dallas (`US-South`) | `https://us-south.security-compliance-secure.cloud.ibm.com/api` | | Frankfurt (`EU-DE`) | `https://eu-de.security-compliance-secure.cloud.ibm.com/api` | | London (`EU-GB`) | `https://eu-gb.security-compliance-secure.cloud.ibm.com/api` | | Madrid (`EU-ES`) | `https://eu-es.security-compliance-secure.cloud.ibm.com/api` | | Osaka (`JP-OSA`) | `https://jp-osa.security-compliance-secure.cloud.ibm.com/api` | | Sao Paulo (`BR-SAO`) | `https://br-sao.security-compliance-secure.cloud.ibm.com/api` | | Sydney (`AU-SYD`) | `https://au-syd.security-compliance-secure.cloud.ibm.com/api` | | Tokyo (`JP-TOK`) | `https://jp-tok.security-compliance-secure.cloud.ibm.com/api` | | Toronto (`CA-TOR`) | `https://ca-tor.security-compliance-secure.cloud.ibm.com/api` | | Washington (`US-East`) | `https://us-east.security-compliance-secure.cloud.ibm.com/api` | {: caption="Public REST API endpoints" caption-side="bottom"} ## Collector endpoints {: #supported-endpoints-collector} Collector endpoints are ingestion endpoints that you can use to send data. ### Private Collector endpoints {: #supported-endpoints-collector-private} To send metrics by using a private endpoint, you must [enable virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown) for your account. {: note} The following table lists the *Private Collector endpoints* that are available for each region: `(*)` Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in the allowlist as well. A notification will be sent before the current IP addresses are deprecated. {: note} To successfully connect your infrastructure to your Workload Protection instance, ensure that it has network connectivity to the Workload Protection region IPs on ports `6443` and `443`. {: note} | Region | Private ingestion endpoint | Private IP addresses | Workload Protection \n agent collector ports | Workload Protection \n agent api ports| |-------------|----------------------------------|----------------------------|-----------|---------| | Dallas (`US-South`) | `ingest.private.us-south.security-compliance-secure.cloud.ibm.com` | 166.9.14.170 \n 166.9.48.41 \n 166.9.17.11 \n \n 166.9.228.45 `(*)` \n 166.9.229.45 `(*)` \n 166.9.230.44 `(*)` \n 166.9.228.235 `(*)` \n 166.9.229.31 `(*)` \n 166.9.251.30 `(*)` | TCP 6443 | TCP 443 | | Frankfurt (`EU-DE`) | `ingest.private.eu-de.security-compliance-secure.cloud.ibm.com` | 166.9.32.51 \n 166.9.30.53 \n 166.9.28.71 \n \n 166.9.248.88 `(*)` \n 166.9.248.120 `(*)` \n 166.9.248.152 `(*)` \n 166.9.209.205 `(*)` \n 166.9.209.227 `(*)` \n 166.9.210.13 `(*)` | TCP 6443 | TCP 443 | | London (`EU-GB`) | `ingest.private.eu-gb.security-compliance-secure.cloud.ibm.com` | 166.9.34.56 \n 166.9.36.71 \n \n 166.9.244.29 `(*)` \n 166.9.244.59 `(*)` \n 166.9.245.221 `(*)` \n 166.9.245.253 `(*)` | TCP 6443 | TCP 443 | | Madrid (`EU-ES`) | `ingest.private.eu-es.security-compliance-secure.cloud.ibm.com` | 166.9.96.31 \n 166.9.95.31 \n 166.9.94.31 \n \n 166.9.226.17 `(*)` \n 166.9.227.16 `(*)` \n 166.9.225.16 `(*)` \n 166.9.226.56 `(*)` \n 166.9.227.143 `(*)` \n 166.9.225.35 `(*)` | TCP 6443 | TCP 443 | | Osaka (`JP-OSA`) | `ingest.private.jp-osa.security-compliance-secure.cloud.ibm.com` | 166.9.72.14 \n 166.9.71.15 \n 166.9.70.14 \n \n 166.9.247.44 `(*)` \n 166.9.247.77 `(*)` \n 166.9.247.109 `(*)` \n 166.9.247.59 `(*)` \n 166.9.247.89 `(*)` \n 166.9.247.123 `(*)` | TCP 6443 | TCP 443 | | Sao Paulo (`BR-SAO`) | `ingest.private.br-sao.security-compliance-secure.cloud.ibm.com` | 166.9.84.19 \n 166.9.83.18 \n 166.9.82.19 \n \n 166.9.246.77 `(*)` \n 166.9.246.108 `(*)` \n 166.9.246.133 `(*)` \n 166.9.246.87 `(*)` \n 166.9.246.120 `(*)` \n 166.9.246.144 `(*)` | TCP 6443 | TCP 443 | | Sydney (`AU-SYD`) | `ingest.private.au-syd.security-compliance-secure.cloud.ibm.com` | 166.9.56.32 \n 166.9.52.27 \n 166.9.54.27 \n \n 166.9.244.114 `(*)` \n 166.9.244.144 `(*)` \n 166.9.244.177 `(*)` \n 166.9.244.121 `(*)` \n 166.9.244.153 `(*)` \n 166.9.244.185 `(*)` | TCP 6443 | TCP 443 | | Tokyo (`JP-TOK`) | `ingest.private.jp-tok.security-compliance-secure.cloud.ibm.com` | 166.9.44.38 \n 166.9.40.35 \n 166.9.42.48 \n \n 166.9.249.112 `(*)` \n 166.9.249.141 `(*)` \n 166.9.249.177 `(*)` \n 166.9.212.4 `(*)` \n 166.9.214.5 `(*)` \n 166.9.216.14 `(*)` | TCP 6443 | TCP 443 | | Toronto (`CA-TOR`) | `ingest.private.ca-tor.security-compliance-secure.cloud.ibm.com` | 166.9.77.20 \n 166.9.76.23 \n 166.9.78.21 \n \n 166.9.247.153 `(*)` \n 166.9.247.185 `(*)` \n 166.9.247.205 `(*)` \n 166.9.209.13 `(*)` \n 166.9.209.42 `(*)` \n 166.9.209.72 `(*)` | TCP 6443 | TCP 443 | | Washington (`US-East`) | `ingest.private.us-east.security-compliance-secure.cloud.ibm.com` | 166.9.22.50 \n 166.9.24.43 \n 166.9.20.53 \n \n 166.9.231.240 `(*)` \n 166.9.232.28 `(*)` \n 166.9.233.17 `(*)` \n 166.9.231.19 `(*)` \n 166.9.232.40 `(*)` \n 166.9.233.36 `(*)` | TCP 6443 | TCP 443 | {: caption="Private collector endpoints and IP addresses" caption-side="bottom"} ### Public Collector endpoints {: #supported-endpoints-collector-public} The following table lists the public collector endpoints that are available for each region. `(*)` Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in the allowlist as well. A notification will be sent before the current IP addresses are deprecated. {: note} | Region | Public ingestion endpoint | Public IP addresses | IBM Cloud Security and Compliance Center Workload Protection agent ports | |-------------|-------------------------------|-------------------------|---------| | Dallas (`US-South`) | `ingest.us-south.security-compliance-secure.cloud.ibm.com` | 169.60.151.174 \n 169.46.0.70 \n 169.48.214.70 \n 52.118.209.119 `(*)` \n 67.18.94.56 `(*)` \n 52.116.135.250 `(*)` | TCP 6443 | | Frankfurt (`EU-DE`) | `ingest.eu-de.security-compliance-secure.cloud.ibm.com` | 149.81.77.78 \n 161.156.102.206 \n 159.122.102.38 \n 158.177.2.4 `(*)` \n 161.156.87.239 `(*)` \n 149.81.238.82 `(*)` | TCP 6443 | | London (`EU-GB`) | `ingest.eu-gb.security-compliance-secure.cloud.ibm.com` | 158.175.98.206 \n 141.125.73.118 \n 159.122.210.174 \n 141.125.105.98 `(*)` \n 161.156.203.133 `(*)` \n 158.176.179.72 `(*)` | TCP 6443 | | Madrid (`EU-ES`) | `ingest.eu-es.security-compliance-secure.cloud.ibm.com` | 13.122.68.140 \n 13.120.68.187 \n 13.121.68.91 \n 13.121.91.87 `(*)` \n 13.122.87.104 `(*)` \n 13.120.91.152 `(*)` | TCP 6443 | | Sao Paulo (`BR-SAO`) | `ingest.br-sao.security-compliance-secure.cloud.ibm.com` | 163.107.66.98 \n 163.109.67.242 \n 169.57.141.43 \n 13.116.92.185 `(*)` \n 163.107.92.212 `(*)` \n 163.109.84.195 `(*)` | TCP 6443 | | Sydney (`AU-SYD`) | `ingest.au-syd.security-compliance-secure.cloud.ibm.com` | 135.90.73.100 \n 130.198.80.155 \n 168.1.213.78 \n 130.198.10.95 `(*)` \n 135.90.130.246 `(*)` \n 159.23.97.190 `(*)` | TCP 6443 | | Osaka (`JP-OSA`) | `ingest.jp-osa.security-compliance-secure.cloud.ibm.com` | 163.68.67.98 \n 163.69.66.170 \n 163.73.67.180 \n 163.68.83.196 `(*)` \n 163.73.82.218 `(*)` \n 163.69.86.15 `(*)` | TCP 6443 | | Toronto (`CA-TOR`) | `ingest.ca-tor.security-compliance-secure.cloud.ibm.com` | 163.74.69.186 \n 158.85.94.130 \n 163.75.65.237 \n 163.66.86.89 `(*)` \n 163.75.81.213 `(*)` \n 163.74.95.149 `(*)` | TCP 6443 | | Tokyo (`JP-TOK`) | `ingest.jp-tok.security-compliance-secure.cloud.ibm.com` | 165.192.84.14 \n 128.168.75.14 \n 169.56.51.238 \n 162.133.138.54 `(*)` \n 128.168.143.56 `(*)` \n 165.192.128.220 `(*)` | TCP 6443 | | Washington (`US-East`) | `ingest.us-east.security-compliance-secure.cloud.ibm.com` | 169.60.112.74 \n 169.55.109.114 \n 169.62.3.82 \n 169.62.20.11 `(*)` \n 169.63.183.86 `(*)` \n 150.239.110.137 `(*)` | TCP 6443 | {: caption="Public collector endpoints and IP addresses" caption-side="bottom"} ## Subnets for webhook notifications {: #supported-endpoints-subnets} To receive alert notifications by using webhooks from the IBM Cloud Security and Compliance Center Workload Protection service, you might need to define firewall rules for the subnets that are invoking your webhooks. `(*)` Indicates IP addresses that are planned to be supported. These IP addresses must be added to an allowlist, if you use an allowlist, before 1 May 2025 to avoid service interruptions. Be sure to keep the current IP addresses in the allowlist as well. A notification will be sent before the current IP addresses are deprecated. {: note} | Region | Alert notification source Subnets | |------------|------------------------------------------------------------------------------------------------------------| | Dallas (`US-SOUTH`) | 150.239.180.0/25 \n 169.46.0.64/29 \n 169.46.39.48/28 \n 169.46.58.24/29 \n 169.47.115.192/28 \n 169.47.71.24/29 \n 169.48.214.64/29 \n 169.48.235.16/28 \n 169.60.151.168/29 \n 169.62.221.32/28 \n 174.36.68.96/27 \n 50.22.148.64/26 \n 52.116.222.192/27 \n 52.117.187.192/27 \n 52.118.158.0/25 \n 52.118.7.64/26 \n 67.228.207.64/26 \n 67.228.219.0/25 \n 52.118.147.1 `(*)` \n 52.118.250.131 `(*)` \n 67.18.90.54 `(*)` | | Frankfurt (`EU-DE`) | 149.81.151.128/27 \n 149.81.201.192/26 \n 149.81.77.72/29 \n 149.81.99.192/28 \n 158.177.44.192/26 \n 159.122.102.32/29 \n 161.156.1.224/27 \n 161.156.102.200/29 \n 161.156.69.144/28 \n 161.156.77.64/26 \n 169.50.36.64/27 \n 169.50.9.0/28 \n 149.81.10.225 `(*)` \n 161.156.83.162 `(*)` \n 149.81.238.81 `(*)` | | London (`EU-GB`) | 141.125.136.32/27 \n 141.125.73.112/29 \n 141.125.73.80/28 \n 158.175.124.224/27 \n 158.175.98.200/29 \n 159.122.210.168/29 \n 159.8.144.168/29 \n 159.8.149.208/28 \n 159.8.162.0/26 \n 161.156.209.192/26 \n 5.10.120.32/27 \n 161.156.201.6 `(*)` \n 141.125.157.52 `(*)` \n 158.176.191.3 `(*)` | | Madrid (`EU-ES`) | 13.120.68.192/28 \n 13.120.68.224/27 \n 13.121.68.96/28 \n 13.122.68.160/28 \n 13.120.91.148 `(*)` \n 13.121.80.147 `(*)` \n 13.122.87.98 `(*)` | | Osaka (`JP-OSA`) | 163.68.67.128/28 \n 163.68.67.96/29 \n 163.68.79.32/27 \n 163.69.66.168/29 \n 163.69.67.112/28 \n 163.69.70.64/27 \n 163.73.67.176/29 \n 163.73.67.192/28 \n 163.73.69.96/27 \n 163.68.91.237 `(*)` \n 163.69.80.154 `(*)` \n 163.73.86.222 `(*)` | | Sao Paulo (`BR-SAO`) | 163.107.66.96/29 \n 163.107.68.128/28 \n 163.107.71.32/27 \n 163.109.67.240/29 \n 163.109.73.128/27 \n 169.57.141.40/29 \n 169.57.186.0/27 \n 169.57.195.0/28 \n 13.116.91.143 `(*)` \n 163.107.86.146 `(*)` \n 163.109.84.191 `(*)` | | Sydney (`AU-SYD`) | 130.198.66.144/28 \n 130.198.80.152/29 \n 135.90.73.96/29 \n 135.90.78.192/28 \n 135.90.94.96/27 \n 168.1.115.192/27 \n 168.1.213.32/27 \n 168.1.213.72/29 \n 168.1.41.96/28 \n 159.23.99.159 `(*)` \n 130.198.18.13 `(*)` \n 135.90.142.230 `(*)` | | Tokyo (`JP-TOK`) | 128.168.75.32/28 \n 128.168.75.8/29 \n 128.168.98.0/27 \n 161.202.255.64/27 \n 165.192.84.8/29 \n 165.192.97.96/27 \n 169.56.11.208/28 \n 169.56.51.232/29 \n 162.133.130.143 `(*)` \n 128.168.137.83 `(*)` \n 165.192.128.217 `(*)` | | Toronto (`CA-TOR`) | 158.85.78.224/27 \n 158.85.94.128/29 \n 163.74.67.192/28 \n 163.74.69.184/29 \n 163.74.71.96/27 \n 163.75.65.232/29 \n 163.75.72.192/27 \n 169.55.129.208/28 \n 163.66.81.182 `(*)` \n 163.74.95.147 `(*)` \n 163.75.86.200 `(*)` | | Washington (`US-EAST`) | 169.47.20.160/27 \n 169.55.109.112/29 \n 169.55.122.192/28 \n 169.59.131.160/27 \n 169.59.146.192/26 \n 169.60.112.72/29 \n 169.60.82.240/28 \n 169.62.28.160/28 \n 169.62.3.80/29 \n 169.62.46.192/27 \n 52.116.95.64/26 \n 52.117.71.128/26 \n 150.239.82.158 `(*)` \n 169.63.176.251 `(*)` \n 169.62.18.195 `(*)` | {: caption="Source subnets for webhook notifications" caption-side="bottom"}