Support an API Endpoint to Get IP Ranges

[bmertens-datum]

Proposal: Create an API Endpoint that Lists IP Ranges for Datum Cloud or a specific Tenant

Customers may need to get an up-to-date list of IP ranges being used by Datum Cloud (or a specific Tenant with their own address space) for a variety of needs, including whitelisting or allowing specific IPs, for audit purposes, etc.

Right now, there isn’t a clear, machine-readable source of truth for IP Ranges, which makes automation and ongoing maintenance harder.

What problem are we solving?

• Customers want to allow traffic to/from Datum in endpoint firewalls.
• IPs can change as we add PoPs/regions or rotate infrastructure.
• Manual lists in docs or emails don’t scale and are easy to get out of date.

We should provide a machine-readable feed that can be consumed by scripts and firewall platforms. This API request should provide generic Datum Cloud details and support specific tenant or organization parameters to obtain more accurate information for a particular tenant.

Requirements (high level)

• Single source of truth for all public edge IPs / ranges (ingress + egress where applicable).
• Machine-readable formats (e.g. JSON, possibly CSV or plain text).
• Stable, documented URL(s).
• Metadata such as last_updated or version.
• Coverage for:
  • IPv4 and IPv6
  • All active regions/PoPs
  • (Optional) Labels for type: proxy, DNS, API, etc.

Possible approaches

1. HTTPS endpoint (primary)

   • Public endpoint such as:
     https://edge.datum.net/ip-ranges.json
   • JSON structure may include:
     • ipv4_ranges, ipv6_ranges
     • Optional region, service, purpose
     • last_updated, version

2. Plain-text / CSV vari

• Additional endpoints:
  • .../ip-ranges.txt (one CIDR per line)
  • .../ip-ranges.csv
• Useful for platforms that don’t handle JSON well.

3. Status / docs integration
   • Link the feed from:
     • Public documentation (“Firewall / allowlist configuration”)
     • Status page (if appropriate)
   • Include examples for Linux, Windows, MDM systems, and common firewall vendors.

Security / correctness considerations

• Define how quickly feeds are updated when:
  • Adding/removing PoPs
  • Scaling or reallocating IP ranges

Open questions

• What level of granularity is most useful for customers (by region, by service, by purpose)?
• Are there vendor-specific formats we should consider supporting?
• What should we do about Datum Provider tier customers that bring their own IP space?

[zsmithnyc]

• Cloudflare has a useful example here
• AWS has JSON format support here
• There is some open source work to bring all cloud provider ranges together here.