Skip to main content

IP Allowlisting

IP allowlisting restricts which computers or servers can communicate with the systems by specifying a list of approved IP addresses. Only traffic from addresses on the list is allowed through; everything else is blocked. This is a common security measure that ensures only known, trusted systems can exchange data with the agency.

Webhook IPs​

eCourtDate sends webhook events from specific IP addresses:

  • Get the current outbound IPs from the Console when creating or editing a webhook
  • Add these IPs to the firewall or application-level allowlist
  • Combine IP allowlisting with HMAC-SHA256 signature verification for defense in depth: IP allowlisting filters traffic at the network layer while signature verification confirms payload authenticity at the application layer

See Webhook Security for the full webhook security model.

SFTP IPs​

There are two SFTP scenarios depending on who hosts the server:

eCourtDate-Managed SFTP (eCourtDate Provides the Server)​

  • The agency connects to an SFTP server hosted by eCourtDate
  • Add the IP addresses of any machines or networks that will connect to the server as IP rules in the Console
  • Only connections from IPs listed in those rules will be accepted

Agency-Managed SFTP (Agency Provides the Server)​

  • eCourtDate connects to the SFTP server from specific IP addresses
  • Retrieve eCourtDate's outbound IPs from the Console and add them to the server's allowlist
  • Only traffic from those IPs needs to be permitted

API Access​

  • Some networks restrict outbound connections. Ensure the servers can reach *.api.ecourtdate.com on port 443 (HTTPS)
  • Configure the API client in the Console to include the IP address(es) the servers use to call the API. Requests from unlisted IPs will be rejected.
  • Check the outbound IP: curl https://checkip.amazonaws.com

CIDR Notation​

When configuring firewalls, IP rules are often expressed in CIDR (Classless Inter-Domain Routing) notation. Here is a quick reference:

NotationMeaningExample
/32Single IP address203.0.113.10/32 = only 203.0.113.10
/24256 addresses203.0.113.0/24 = 203.0.113.0 through 203.0.113.255
/1665,536 addresses203.0.0.0/16 = 203.0.0.0 through 203.0.255.255

When eCourtDate provides specific IPs, use /32 (single IP) entries unless instructed otherwise.

Network Security Recommendations​

  • Layer defenses: Combine IP allowlisting with authentication (API keys, SSH keys, HMAC signatures) rather than relying on either control alone
  • Review on IP changes: When eCourtDate announces IP address changes, update the allowlists promptly to avoid service interruptions
  • Restrict outbound traffic: Where possible, limit the servers' outbound connections to only the endpoints required for the integration (eCourtDate API, SFTP, webhook delivery)
  • Log rejected connections: Configure the firewall to log connection attempts from unlisted IPs for security monitoring
info

For private connectivity options such as VPC peering or AWS PrivateLink, open a support ticket in the Console using the Help button in the bottom-right corner.