> ## Documentation Index
> Fetch the complete documentation index at: https://primer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Request requirements

> Send server-side requests to the Primer API from a static egress IP address so they are not blocked before they reach the API.

## Overview

Primer may block API requests based on the IP address they come from.

Many cloud platforms send outbound traffic from shared, dynamically assigned IP addresses by default. Other customers of the platform send traffic from the same addresses, so an address can be blocked because of their traffic rather than yours. When that happens, your requests to Primer are blocked, even though your integration has not changed.

To avoid this, send all server-side requests to Primer from a static egress IP address that only you use.

## Use a static egress IP address

A static egress IP address is a public IP address that you reserve. All outbound traffic from your backend to Primer uses it. This applies to every server-side call, for example:

* creating and updating client sessions with `POST /client-session` and `PATCH /client-session`
* creating, capturing, cancelling and refunding payments
* managing saved payment methods

Serverless and container platforms often use shared outbound addresses unless you configure otherwise. Route their traffic through a NAT service with a reserved IP address:

| Platform | Configuration |
| - | - |
| Google Cloud (Cloud Run, Cloud Functions, GKE) | Route outbound traffic through Cloud NAT with a reserved static external IP address. |
| AWS (Lambda, ECS, EKS, EC2) | Run the workload in a VPC and route outbound traffic through a NAT gateway with an Elastic IP address. |
| Microsoft Azure | Attach a NAT gateway with a static public IP address to the workload's subnet. |

Refer to your cloud provider's documentation for the setup steps.

> [!NOTE]
>
> Configure the static egress IP address in your test environment as well as in production. This lets you confirm that requests use the new address before you go live.

## Identify a blocked request

When a request is blocked, it does not reach the API and you will receive a `403` response with the `SecurityPolicyBlock` error ID:

```json theme={"dark"}
{
  "error": {
    "errorId": "SecurityPolicyBlock",
    "description": "This request has been blocked by a security policy.",
    "validationErrors": []
  }
}
```

Blocks depend on the source IP address at the time of the request, so they can start and stop without any change to your integration.

If you receive this error:

1. Check which public IP address your backend uses for outbound requests to Primer.
2. If it is a shared or dynamically assigned address, configure a static egress IP address as described above.
3. If the errors continue after you move to a static egress IP address, contact [support@primer.io](mailto:support@primer.io). Include the source IP address and the time of the failed requests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.