Security
This page includes security information about Port API and the interactions of your infrastructure with it.
Address allowlisting
Port's REST API and MCP server are both served through a network of Application Load Balancers (ALBs) and as such are not served from a closed list of IP addresses.
For cases where your internal network has strict limitations on the addresses that outbound requests can be made to, you will need to add the following addresses to your network's allowlist:
- For Port's EU tenant:
https://api.port.iohttps://ingest.port.iohttps://mcp.port.io
- For Port's US tenant:
https://api.us.port.iohttps://ingest.us.port.iohttps://mcp.us.port.io
AWS PrivateLink
This feature is part of Port's Enterprise plan.
If you're interested in accessing this feature, please contact Port's sales/customer success team.
Port supports AWS PrivateLink to provide secure connectivity between your AWS VPC and Port's API.
AWS PrivateLink is an AWS service that provides private connectivity between resources in different AWS VPCs.
With AWS PrivateLink you can make requests to Port's API from your AWS VPC, while ensuring that the traffic remains within the AWS data center, and without exposing your data to the internet.
Setup
To setup an AWS PrivateLink between your VPC and Port, you can follow this AWS guide.
In step 5 of the guide, you are required to provide the Service name, which is the address of the PrivateLink endpoint provided by Port.
Current PrivateLink Endpoints (*.port.io)
Use these service names for PrivateLink connections and for traffic that targets Port's public API hostnames on *.port.io.
| Service | Public Address | PrivateLink region | PrivateLink service name |
|---|---|---|---|
| Port API EU | https://api.port.io | eu-west-1 | com.amazonaws.vpce.eu-west-1.vpce-svc-0b140a20a222dc087 |
| Ingest API EU | https://ingest.port.io | eu-west-1 | com.amazonaws.vpce.eu-west-1.vpce-svc-098f3997eec3fe76c |
| Port API US | https://api.us.port.io | us-east-1 | com.amazonaws.vpce.us-east-1.vpce-svc-0450df0a55d2371be |
| Ingest API US | https://ingest.us.port.io | us-east-1 | com.amazonaws.vpce.us-east-1.vpce-svc-0004f6b19936a6430 |
Legacy PrivateLink Endpoints (*.getport.io)
These endpoints follow the legacy *.getport.io hostnames. They remain available for existing connections but we recommend using the *.port.io endpoints.
| Service | Public Address | PrivateLink region | PrivateLink service name |
|---|---|---|---|
| Port API EU | https://api.getport.io | eu-west-1 | com.amazonaws.vpce.eu-west-1.vpce-svc-02addcefd47049d3f |
| Ingest API EU | https://ingest.getport.io | eu-west-1 | com.amazonaws.vpce.eu-west-1.vpce-svc-01c8de843e5776402 |
| Port API US | https://api.us.getport.io | us-east-1 | com.amazonaws.vpce.us-east-1.vpce-svc-047de27e65a0392a7 |
| Ingest API US | https://ingest.us.getport.io | us-east-1 | com.amazonaws.vpce.us-east-1.vpce-svc-052d7ea18ebda9652 |
Port's PrivateLink endpoints support cross-region access from specific AWS Regions.
EU PrivateLinks are hosted in eu-west-1. Cross-region connectivity is supported from:
eu-west-1.eu-west-2.eu-west-3.eu-north-1.eu-central-1.
US PrivateLinks are hosted in us-east-1. Cross-region connectivity is supported from:
us-east-1.us-east-2.us-west-1.us-west-2.
If your workloads run outside these Regions, please contact support.
After following the guide, please contact Port's support team using chat/Slack/mail to support.port.io and we will finalize the setup.
IP address restriction
Port can limit access to your organization to a list of allowed IP addresses, covering both sign-ins to the Port UI and requests to api.port.io (EU) or api.us.port.io (US).
For the supported list formats, what blocked users and requests see, and how to request a change, see IP address restriction.
FAQ
No. Port's REST API and MCP server use Application Load Balancers and do not have a closed list of IP addresses. Allowlist the documented regional API, ingest, and MCP hostnames instead.
Yes. Enterprise customers can use AWS PrivateLink for private connectivity between an AWS VPC and Port's API. Port provides regional endpoint service names for Europe and the United States.
Port rejects UI access and API requests from addresses outside the organization's allowed list. The API returns HTTP 403 with an error that identifies the source IP and organization. See IP address restriction for the full details.