Network Requirements
The IPs, hostnames and ports to allow when your network is restricted
This page is usually only needed by companies with restricted network access to their systems, such as egress allowlists or private endpoints.
TL;DR
Use the IPs for the region your account was created in. All traffic uses TLS on port 443.
| If you... | Allow | US | EU |
|---|---|---|---|
| Send traces, use the SDK or API, or run the Confident Agent | Outbound from your network to the inbound IPs | 54.215.186.73, 52.52.0.142 | 18.159.251.13, 52.57.182.62, 3.123.216.41 |
| Have an AI Connection call your HTTPS endpoint | Inbound to your endpoint from the outbound IPs | 184.169.218.139, 184.169.150.222 | 63.188.243.95, 3.122.5.12, 63.189.129.176 |
Inbound IPs
Traffic from your network to Confident AI goes to these IPs: tracing, the SDK and API, the Confident Agent, and the dashboard. Allow outbound HTTPS/WSS on port 443 to them.
| Region | IPs |
|---|---|
| US | 54.215.186.73, 52.52.0.142 |
| EU | 18.159.251.13, 52.57.182.62, 3.123.216.41 |
Outbound IPs
Traffic from Confident AI to your network comes from these IPs: AI Connections calling your HTTPS endpoint. Allow inbound HTTPS from them to your endpoint.
| Region | IPs |
|---|---|
| US | 184.169.218.139, 184.169.150.222 |
| EU | 63.188.243.95, 3.122.5.12, 63.189.129.176 |
Hostnames
| Used by | US | EU |
|---|---|---|
Tracing (confident-trace, OpenTelemetry exporters) | otel.confident-ai.com | eu.otel.confident-ai.com |
| The Confident AI SDK and the API | api.confident-ai.com | eu.api.confident-ai.com |
| Confident Agent relay (WSS) | offline-evals.confident-ai.com | eu.offline-evals.confident-ai.com |
| MCP server | mcp.confident-ai.com | eu.mcp.confident-ai.com |
| Dashboard | cloud.confident-ai.com | cloud.confident-ai.com |
Requirements by Feature
Tracing
Allow: outbound to the inbound IPs (or the OTEL hostname).
confident-trace and any OpenTelemetry exporter send spans to the OTEL endpoint. Nothing calls back into your app.
- If your app sends traffic through an HTTP proxy, make sure the exporter uses it (the standard
HTTPS_PROXYenvironment variable). - On the EU region, also set
CONFIDENT_OTEL_ENDPOINT, as described in Setup and Installation.
Confident AI SDK and API
Allow: outbound to the inbound IPs (or the API hostname).
The Confident AI SDK and direct API calls only make outbound requests to the API host, for example to run evals and pull datasets and prompts.
AI Connections
What an AI Connection needs depends on how Confident AI reaches your app:
| How your app is connected | Allow |
|---|---|
| HTTPS endpoint (HTTP Response, HTTP Streaming, SSE Streaming, WebSocket) | Inbound to your endpoint from the outbound IPs |
| Internal endpoint through the Confident Agent | Outbound from the agent to the inbound IPs (or the relay hostname) |
| Agent Handler (no endpoint) | Outbound from the agent to the inbound IPs (or the relay hostname) |
For an HTTPS endpoint, Confident AI's evaluation servers call it directly with a POST request for every golden:
- Serve it over HTTPS with a certificate from a public certificate authority. Self-signed certificates aren't trusted.
- Requests arrive with the headers and authorization you configured on the connection, so you can authenticate them on top of the IP allowlist.
With the Confident Agent or Agent Handler, the agent dials out over a single WSS tunnel, so no inbound ports need to be opened. In forwarding mode, the agent also needs to reach your internal endpoint, and the connection needs Internal switched on. For networks that can't pull from Docker Hub, see Air-Gapped Confident Agent.
Dashboard
Allow: outbound from team members' browsers to cloud.confident-ai.com and the API hostname for your region.
Last updated on