Ingress filtering
Accept webhook traffic only when the caller IP matches an expected provider.
Security API
Check if a source IP matches Syndaq-maintained ranges for major webhook senders. Returns matched status and provider IDs—built for ingress filtering and abuse defense.
At a glance
Use cases
Accept webhook traffic only when the caller IP matches an expected provider.
Reject spoofed webhook POSTs from IPs outside known ranges.
Route and validate Stripe, GitHub, Slack, and more from one endpoint.
Record which provider range matched for compliance and incident review.
Integration
Subscribe to a Webhook IP plan and copy your wk_sec_ secret key from the client area.
Pass the caller IP by path or query; optionally filter with ?provider=.
Allow when matched is true for an expected provider; otherwise reject or challenge.
Example
Every response includes a request_id for support correlation.
Rate limit and quota headers are returned on authenticated routes so you can backoff gracefully.
Authenticated with your Syndaq secret key over HTTPS. Range coverage is maintained by Syndaq and may expand over time. Pair with signature verification when the provider supports it.
curl -s "https://api.syndaq.com/v1/webhookip/lookup/140.82.112.1" \
-H "Authorization: Bearer wk_sec_YOUR_SECRET_KEY"{
"success": true,
"ip": "140.82.112.1",
"cached": true,
"matched": true,
"providers": [
{ "id": "github", "name": "GitHub" }
],
"request_id": "e6f7890123456789012345678901fa"
}Reference
Included with your Syndaq Webhook IP plan.
| Method | Path | Description |
|---|---|---|
| GET | /v1/webhookip/lookup |
Verify an IP via ?ip= query parameter. |
| GET | /v1/webhookip/lookup/{ip} |
Verify an IP in the URL path. |
| GET | /v1/webhookip/status |
Returns plan limits and quota for the authenticated key. |
Pricing
Transparent limits. Upgrade when your traffic grows—no surprise overages without a plan change.
Development and light production lookups.
Higher throughput for production apps.
High-volume lookups with priority limits.
FAQ
Pick a plan, create your keys in the client area, and start calling the API in minutes.
Choose a plan Ask a question