Veracode access requirements
Organizations that block internet addresses must allow Veracode domains and, in some cases, IP addresses to ensure uninterrupted access to Veracode products and features.
Use the following sections to find the domains or IP addresses required for each product you deploy. The sections are organized by Veracode regions, and your Veracode user accounts are in one of these regions.
For help with any information in this section, please contact Veracode Support.
If your organization uses an allowlist, contact your IT team to confirm that your organization's allowlist includes the correct domains or IP addresses for your region.
We send anonymized user data to a third-party telemetry service. See Telemetry data we collect.
All regions
| Product | Domains and IP addresses |
|---|---|
| Authentication with external identity providers (IdP) |
|
| Veracode Repository Workflow Integrations |
|
| Veracode CLI |
|
| Documentation and Community resources |
|
Commercial region
Important
- The Veracode APIs and any products that use the APIs, specifically Veracode integrations, require one-way communication on port 443 to the Veracode API domain
api.veracode.com. - If your organization requires IP-based firewall rules, instead of domain-based, some domains resolve to default IP addresses that you can add to your allowlist. Depending on your location and environment, these domains might resolve to different IP addresses, and these addresses could change over time.
| Product | Domains and IP addresses |
|---|---|
| Veracode Platform user interfaces |
162.159.128.36 and 162.159.129.36. |
| Veracode APIs and integrations |
*.veracode.* domains resolve to 104.18.6.60 and 104.18.7.60. |
| Veracode Dynamic Analysis | 34.195.146.191 |
| Veracode DAST |
/28 when adding CIDR-notation addresses. |
| Veracode Software Composition Analysis (SCA) |
18.239.168.10, 18.239.168.94, 18.239.168.118, and 18.239.168.128.For SCA agent-based scans using Maven or Gradle, also add:
|
| Veracode Integration for Jira Cloud | jira-cloud-addon.integrations.veracode.com |
| Veracode eLearning | elearning.veracode.com |
| Veracode Manual Penetration Testing (MPT) |
|
| Veracode Security Labs |
|
| Veracode Risk Manager (VRM) | VRM connectors require the following IP addresses to connect to your SaaS services.
|
European region
Important
- The Veracode APIs and any products that use the APIs, specifically Veracode integrations, require one-way communication on port 443 to the Veracode API domain
api.veracode.eu. - If your organization requires IP-based firewall rules, instead of domain-based, some domains resolve to default IP addresses that you can add to your allowlist. Depending on your location and environment, these domains might resolve to different IP addresses, and these addresses could change over time.
| Product | Domains and IP addresses |
|---|---|
| Veracode Platform user interfaces |
*.analysiscenter.veracode.* domains resolve to 104.18.29.248 and 104.18.28.248. The eu-prod-lookout.analytics.veracode.eu domain resolves to 3.69.89.217 and 3.70.78.140. |
| Veracode APIs and integrations |
api.veracode.eu domain resolves to 104.18.29.248 and 104.18.28.248. The other *.veracode.* domains resolve to 104.18.6.60 and 104.18.7.60. |
| Veracode Dynamic Analysis | 35.156.203.105 |
| Veracode DAST |
/28 when adding CIDR-notation addresses. |
| Veracode Software Composition Analysis (SCA) |
18.239.168.10, 18.239.168.94, 18.239.168.118, 18.239.168.128, 104.18.29.248, and 104.18.28.248.For SCA agent-based scans using Maven or Gradle, also allow:
|
| Veracode Integration for Jira Cloud | Not supported |
| Veracode eLearning | elearning.veracode.eu |
| Veracode Manual Penetration Testing (MPT) |
|
| Veracode Security Labs | Not supported |
| Veracode Risk Manager (VRM) | Not supported |
United States Federal region
Important
- The Veracode APIs and any products that use the APIs, specifically Veracode integrations, require one-way communication on port 443 to the Veracode API domain
api.veracode.us. - Compared to the Commercial and European regions, the domains for the United States Federal region don't resolve to default IP addresses.
| Product | Domains and IP addresses |
|---|---|
| Veracode Platform user interfaces |
|
| Veracode APIs and integrations |
|
| Veracode Dynamic Analysis | 3.32.105.199 |
| Veracode DAST | Not supported |
| Veracode Software Composition Analysis (SCA) |
|
| Veracode Integration for Jira Cloud | Not supported |
| Veracode eLearning | elearning.veracode.us |
| Veracode Manual Penetration Testing (MPT) | Not supported |
| Veracode Security Labs | Not supported |
| Veracode Risk Manager (VRM) | Not supported |
Telemetry data we collect
We collect the following anonymized user data to improve our products and support services.
- A synthetic, unique user identifier
- A synthetic, unique identifier for the user organization
- Browser name and version
- The last login date before the current session
- User roles
note
We don't collect personal data such as names, email addresses, or organization names.