Allow our IP addresses
CLC calls your infrastructure from the IP address listed below. If you filter inbound traffic by source, that is the address to allow.
The address
159.203.148.229Live and sandbox share it. Everywhere else the two are separate stacks, but they call you from the same place, so one rule covers both.
What we call
Your webhook endpoint. Every event delivery, and every simulation you run. See Set up webhooks.
Your portfolio URL. The endpoint you registered with PUT /v1/portfolio-source, which CLC reads on its own so a missed push does not leave collateral stale. See Keep the portfolio in sync.
Both are plain outbound HTTPS on port 443. CLC opens no other connection to you and never asks you to open a port beyond the one already serving those two URLs.
An IP is not authentication
Anyone can send a request from any address they control. What proves a delivery came from CLC is the signature, not where it arrived from, so verify it even on traffic you allowed. Treat this list as noise reduction, not as a security boundary.
Updated about 2 months ago