Grafana Cloud folds its IP allowlists into one API; legacy formats expire January 31, 2027

Grafana Labs has replaced the collection of per-product source-IP lists for Grafana Cloud with a single Allowlist API that serves current addresses as structured JSON over HTTPS ^[1]. The legacy formats keep working and stay up to date until January 31, 2027 ^[2], which is the only detail that matters for planning: this is a dated ticket, not an announcement.

If you do not use IP allowlisting, or you reach Grafana Cloud over private connectivity such as AWS PrivateLink, Grafana says nothing changes and no action is needed ^[3].

For everyone else, the old arrangement was one JSON list, one plain-text list and one DNS record per product, for example https://grafana.com/api/hosted-metrics/source-ips, its .txt twin, and the src-ips.hosted-metrics.grafana.net lookup ^[4]. Keeping firewalls current meant polling several lists and stitching them together yourself ^[5]. The replacement is three shapes of one endpoint: global at https://allowlists.grafana.net/v1/ ^[6], per region at https://allowlists.<your-region>.grafana.net/v1/ ^[7], and per service at https://allowlists.<your-region>.grafana.net/v1/<service> ^[8]. Each service entry carries a traffic direction, either ingress-to-grafana or egress-from-grafana, plus IPv4 CIDR ranges, under a metadata block naming the schema version and region ^[9]. Valid service names are grafana, metrics, logs, traces, profiles, otlp, alerts and fleet-management ^[10], eight in total ^[11].

Grafana is explicit that this is not a drop-in URL change ^[12]. The legacy endpoints return flat JSON arrays, plain-text lists or DNS records; the new one returns nested JSON with CIDR ranges and direction metadata, so parsers have to be rewritten rather than repointed ^[12]. Names move too: hosted-metrics becomes metrics, and both hosted-grafana and grafana-assistant collapse into grafana ^[13]. BYOC customers cannot use the global endpoint at all, because BYOC regions are excluded from it, and must call their regional URL ^[14]. Your stack's region is on the instance details pages in the Grafana Cloud stack ^[15].

The migration guidance is unremarkable and therefore worth following. Inventory every reference to grafana.com/api/*/source-ips, the .txt variants and src-ips.*.grafana.net records, including Grafana Assistant records ^[16]. Where you can, allow the union of legacy and new addresses during the overlap, and validate telemetry delivery, queries and alert notifications before cutting over ^[17]. Fetch the API on a schedule instead of pasting addresses into long-lived firewall config, because the addresses change ^[18]. And treat each traffic path separately: private connectivity via AWS PrivateLink, GCP Private Service Connect or Azure Private Link removes the need for an allowlist, but traffic that stays on the public internet, such as Grafana Cloud reaching your external data sources or notification endpoints, still needs one ^[19].

Two things to watch. The published schema exposes a direction field and an ipv4 field ^[9]; there is no IPv6 equivalent in the documented response, so dual-stack estates should ask support what covers the v6 side ^[20]. Second, the metadata declares schemaVersion v1 ^[9], which implies a v2 someday, so whatever you build should fail loudly on an unexpected schema rather than silently emitting an empty ruleset. One scheduling note: January 31, 2027 is a Sunday ^[21], so the practical deadline for a supervised cutover is the working week before it, and the real risk is a firewall config nobody has touched since 2025 quietly going stale in the months before that.