Request requirements

Overview

Primer may block API requests based on the IP address they come from.

Many cloud platforms send outbound traffic from shared, dynamically assigned IP addresses by default. Other customers of the platform send traffic from the same addresses, so an address can be blocked because of their traffic rather than yours. When that happens, your requests to Primer are blocked, even though your integration has not changed.

To avoid this, send all server-side requests to Primer from a static egress IP address that only you use.

Use a static egress IP address

A static egress IP address is a public IP address that you reserve. All outbound traffic from your backend to Primer uses it. This applies to every server-side call, for example:

creating and updating client sessions with POST /client-session and PATCH /client-session

creating, capturing, cancelling and refunding payments

managing saved payment methods

Serverless and container platforms often use shared outbound addresses unless you configure otherwise. Route their traffic through a NAT service with a reserved IP address:

Platform	Configuration
Google Cloud (Cloud Run, Cloud Functions, GKE)	Route outbound traffic through Cloud NAT with a reserved static external IP address.
AWS (Lambda, ECS, EKS, EC2)	Run the workload in a VPC and route outbound traffic through a NAT gateway with an Elastic IP address.
Microsoft Azure	Attach a NAT gateway with a static public IP address to the workload’s subnet.

Refer to your cloud provider’s documentation for the setup steps.

Configure the static egress IP address in your test environment as well as in production. This lets you confirm that requests use the new address before you go live.

Identify a blocked request

When a request is blocked, it does not reach the API and you will receive a 403 response with the SecurityPolicyBlock error ID:

{
  "error": {
    "errorId": "SecurityPolicyBlock",
    "description": "This request has been blocked by a security policy.",
    "validationErrors": []
  }
}

Blocks depend on the source IP address at the time of the request, so they can start and stop without any change to your integration.

If you receive this error:

Check which public IP address your backend uses for outbound requests to Primer.

If it is a shared or dynamically assigned address, configure a static egress IP address as described above.

If the errors continue after you move to a static egress IP address, contact support@primer.io. Include the source IP address and the time of the failed requests.

​Overview

​Use a static egress IP address

​Identify a blocked request

Overview

Use a static egress IP address

Identify a blocked request