# Network Access for Sonatype IQ Cloud

Sonatype IQ Cloud serves applications from multiple IP address ranges. These addresses may change occasionally as infrastructure evolves, though such changes are infrequent.

- Prefer domain-based allow lists. Because IP addresses can change over time, allow access by domain name (for example, `*.iq.sonatype.app`) wherever possible.
- If you must use IP allow listing, use the `/meta` API described below to identify the current IP ranges for your tenant and monitor that endpoint regularly for updates.
- Required ports: Ensure your systems allow TCP ports 80 and 443 to the IP ranges provided.

## Accessing Tenant Network Metadata (/meta Endpoint)

Each IQ Cloud tenant exposes a `/meta` API resource that lists the IP address ranges used by IQ Cloud services for both API and webhook (hooks) traffic.

This endpoint is modeled after GitHub’s `/meta` API and provides a simple, programmatically accessible way to retrieve your tenant’s active network IPs.

**Endpoint format:**

```
https://<tenant_name>.iq.sonatype.app/meta
```

**Example**

**Request:**

```
GET https://exampletenant.iq.sonatype.app/meta
```

```
curl -s https://exampletenant.iq.sonatype.app/meta
```

**Response:**

```
{
  "api": [\
    "15.197.249.175/32",\
    "3.33.231.117/32"\
  ],
  "hooks": [\
    "13.56.205.139/32",\
    "15.222.84.149/32",\
    "18.222.5.67/32"\
  ]
}
```

**Understanding the Response**

The `/meta` resource returns two lists of CIDR-formatted IP ranges:

| Field | Description |
| --- | --- |
| api | IP ranges used by IQ Cloud APIs and applications. These are the endpoints your systems, plugins, or users connect to (outbound connections from your network). |
| hooks | IP ranges used by IQ Cloud to deliver webhooks or other outbound connections to your infrastructure (inbound connections to your network). |

## Email Notifications

IQ Cloud sends automated notification and verification emails from `noreply@sonatype.com`. Outbound mail is sent via Twilio SendGrid (formerly SendGrid).

The service uses the following SMTP server:

- **Hostname**: `smtp.sendgrid.net`
- **Port**: 465 (TCP)

For environments with strict firewall or mail-gateway policies, ensure traffic to `smtp.sendgrid.net` is allowed and that emails from `noreply@sonatype.com` are not blocked or filtered.