Need HubSpot forms API IP addresses


#1

The company I work at, North American Bancard, has custom forms that have to submit data to a couple systems, including our own systems -AND- also to HubSpot forms.

We have our own API that is submitting to our systems we need to submit the form data to -AND- we have our API communicating with your forms API to push data into our HubSpot forms.

We have a firewall and we need to ensure our firewall doesn’t block communications with HubSpot’s forms API.

What is your IP address or range of IP addresses? We need this, again, so our firewall don’t block the form submissions and communications we are doing with HubSpot’s forms API?


#2

Hi @BrianBell

Whitelisting by IPs isn’t something that our APIs would support, as the IPs used by our services can vary based on location, and are subject to change without notice. Is there any other way that you can whitelist by, such as domain or URL? All of our APIs also support SSL/TLS so you should be able to verify the connection by validating the SSL certificate.


#3

Hello dadams,

I am looking for that URL list you are talking about. We are coding for the API, but in the interim, we will be using the hubspot.com web page to upload contacts via a CSV file. We will need a URL list for both upload methods.

The problem is our contact file has only PII, it comes from a very secure area and we need to document what sessions we are allowing to where to comply with multiple regulatory authorities. Our firewall filters on URLs and applications. We have a partial URL list we figured out, but are missing several still. Even if we figure those out, there could be more calls to other URLs. We are looking for an official list of all URLs we need to apply to our firewall.

To make this quicker, I will supply all the information I know. First are all the URLs we put in place, some might be too broad due to adding some wild cards. I will then paste the IPs left over from that attempt. I will then paste a list of all IPs when I left the firewall wide open. Also as a heads up, there was an auto windows update check in the middle

Thanks in advance.

(I just ran into a 2 link limit for new users error, so I am trying to bypass it by removing last two letters of the domain. I will see if that works.)

That didn’t work, so I will try to remove the URLs and see if it still errors out on the IPs.

Residuals:

Destination address, Application
74.125.28.156, google-base
54.210.49.150, ssl
216.58.193.206, google-base
72.21.81.200, ssl
23.217.103.186, hubspot
199.59.148.84, twitter-base
93.184.216.182, ssl
199.59.148.12, ssl
31.13.70.7, facebook-base
216.58.193.202, google-base
204.79.197.200, web-browsing
216.58.219.46, google-base
199.59.150.42, twitter-base
31.13.77.12, facebook-base

Successful Transfer with duplicates removed, which means there could be more applications used at the same destination address:

Destination address Application
23.217.103.186 hubspot
65.55.252.93 ssl
52.70.223.69 ssl
72.21.81.200 windows-azure-base
162.247.242.20 new-relic
54.241.191.232 pubnub
54.219.189.241 pubnub
216.58.193.200 google-analytics
23.64.191.205 ssl
52.0.34.38 ssl
54.208.72.104 ssl
31.13.77.12 facebook-base
172.217.4.168 google-analytics
52.216.1.32 ssl
52.9.63.129 pubnub
104.244.43.48 ssl
151.101.128.207 ssl
192.0.73.2 ssl
52.85.77.83 ssl
54.89.16.95 ssl
216.58.193.196 google-base
199.96.57.6 twitter-base
104.244.43.176 ssl
93.184.216.182 ssl
216.58.219.36 google-base
216.58.193.202 google-base
52.54.199.4 ssl
204.79.197.200 web-browsing


#4

Will try adding the URLs replacing the dots with hash tags:

app#hubspot#com
www#google#com
static#hsappstatic#net
platform#twitter#com
*#googletagmanager#com
js#hubspot#com
connect#facebook#net
js-agent#newrelic#com
js#leadin#com
api#usemessages#com
js#hs-scripts#com
bam#nr-data#net
js#hscta#net
*#google-analytics#com
app#gettally#com
js#hs-analytics#net
www#fullstory#com
ssl#google-analytics#com
www#gstatic#com
static#ads-twitter#com


#5

Hi @ccfalkner

We don’t keep a documented list of URLs that your browser may hit when uploading a file in the app, as that can change whenever we modify or update the app. Anything in the app will use the app.hubspot.com domain (and our app also uses our APIs at api.hubapi.com), but if you’re already able to access the import tool in your browser, you’d be able to use the import tool, as that would only be supported from a browser and not from an automated upload directly from a server.

If you’re automating the upload through the APIs, the two endpoints you’d be most likely to use are these:


If you’re doing a large upload, I’d recommend using the batch endpoint to save on API calls.

Also, our systems are not intended to store sensitive information, so you may need to review the data you’re storing in HubSpot. More details on our policies and our definition for sensitive information can be found in our Terms of Service:
http://legal.hubspot.com/terms-of-service


#6

I will paste the URL list I created below, but if that list becomes stale, here is how I figured it out:

In a place that was more open to the Internet, I had my user upload a file using windows explorer while recording it in debug mode, went to the networking tab, then exported the results. We couldn’t figure out how to export in chrome or firefox. It then left me with a decent sized XML file. The easiest way for me to filter out what I wanted was to upload it to a linux box and did the following: grep ‘’ SourceFile.xml | cut -d’/’ -f3 | uniq > DestinationFile.txt

It did a pretty good job, but still had some duplicates which were easy to remove. Perhaps pasting the results in a spreadsheet and filtering out the rest would have also worked. I came up with the list I will paste in the next post. If it doesn’t let me post all the URLs because I am a newer user, then I will put the hash tags in again.

In the end, this URL list worked successfully for our Palo Alto. I will also add the application list I came up with.

Regards,

Craig


#7

facebook-base
hubspot
twitter-base
pubnub
ssl
new-relic
google-analytics
google-base
web-browsing
oscp


#8

*.hubspot.com
fonts.googleapis.com
static.hsappstatic.net
www.google.com

platform.twitter.com
static.ads-twitter.com
fast.fonts.net
connect.facebook.net
www.googletagmanager.com

www.gstatic.com

www.facebook.com

analytics.twitter.com
t.co
www.google-analytics.com


js-agent.newrelic.com
api.usemessages.com
js.leadin.com
js.hs-scripts.com
bam.nr-data.net
app.gettally.com
js.hsleadflows.net

js.hscta.net
ssl.google-analytics.com
hubspot-avatars.s3.amazonaws.com
js.hs-analytics.net
ps7.pubnub.com
cdn2.hubspot.net


#9

The command line above didn’t come out right. It is:

grep ‘’ SourceFile.xml | cut -d’/’ -f3 | uniq > DestinationFile.txt


#10

Sorry about all the posts. I don’t contribute to forums much so don’t know the nuances.