> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.flagright.com/framl-api/guides/webhooks/subscribe/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.flagright.com/_mcp/server.

Here are the steps to subscribe to a webhook endpoint.

## Step 1: Identify the events to subscribe

[Browse the list of events](/guides/webhooks/introduction#types-of-events) and identify the events you want to subscribe to. You can subscribe to multiple events in a single webhook endpoint.

## Step 2: Create a webhook endpoint

Set up an HTTP endpoint that can accept unauthenticated webhook requests with a POST method.

## Step 3: Handle requests from Flagright

Your endpoint must be configured to read [event objects](/guides/webhooks/introduction#event-payloads) for the type of events you want to receive. Flagright sends events to your webhook endpoint as part of a POST request with a JSON payload.

### Check event objects

Each event is structured as an event object with a `type`, `id`, `data`, and `createdTimestamp`. Your endpoint must check the event type and parse the payload of each event.

```json
{
  "id": "2fa554d3-1ffa-4361-9af6-5479c2d4847f",
  "type": "USER_STATE_UPDATED",
  "createdTimestamp": 1661522222301,
  "data": {...}
}
```

### Return a 2xx response

Your endpoint must quickly return a successful status code (2xx) prior to any complex logic that could cause a timeout (10 seconds).

### Built-in retries

Flagright webhooks have built-in retry methods for 3xx, 4xx, or 5xx response status codes. We will retry for up to 3 days until we either receive a 2XX or we mark it as failed. If Flagright doesn't quickly receive a 2xx response status code for an event, we mark the event as failed and stop trying to send it to your endpoint.

## Step 4: Secure your webhooks (recommended)

Use webhook signatures to verify that Flagright generated a webhook request and that it didn't come from a server acting like Flagright.

#### Example in Python Flask

```python
@app.route('/flagright_webhooks', methods=['POST'])
def webhook():
    event = request.json
    if event.type == 'USER_STATE_UPDATED':
        latest_user_state = event.data
        # Then define and call a method to handle latest_user_state.
    else:
        print(f'Unhandled event type ${event.type}')

    # Return a response to acknowledge receipt of the event
    return 'OK'

```

For an additional layer of security, lock down your webhook endpoints to only accept the requests coming from the IP addresses listed below:

### Sandbox

| REGION | IP ADDRESSES  |
| ------ | ------------- |
| EU     | 3.124.91.35   |
| EU     | 3.66.58.17    |
| EU     | 3.70.73.47    |
| Asia   | 13.251.166.15 |
| Asia   | 18.143.88.142 |
| Asia   | 46.137.237.47 |

### Production

| REGION             | IP ADDRESSES   |
| ------------------ | -------------- |
| US (Oregon)        | 35.155.123.185 |
| US (Oregon)        | 44.237.56.178  |
| US (Oregon)        | 52.11.98.137   |
| EU (Frankfurt)     | 3.67.28.78     |
| EU (Frankfurt)     | 3.76.95.10     |
| EU (Frankfurt)     | 35.156.181.187 |
| EU (London)        | 18.132.155.115 |
| EU (London)        | 18.134.212.219 |
| EU (London)        | 35.177.249.136 |
| EU (Ireland)       | 52.30.58.105   |
| EU (Ireland)       | 52.48.250.179  |
| EU (Ireland)       | 54.73.79.230   |
| Asia (Singapore)   | 18.139.42.183  |
| Asia (Singapore)   | 3.1.188.28     |
| Asia (Singapore)   | 3.1.234.194    |
| Asia (Hong Kong)   | 18.166.126.7   |
| Asia (Hong Kong)   | 43.198.196.218 |
| Asia (Hong Kong)   | 43.199.165.157 |
| Australia (Sydney) | 18.139.42.183  |
| Australia (Sydney) | 3.104.94.7     |
| Australia (Sydney) | 54.79.45.195   |
| Middle East (UAE)  | 3.28.175.208   |
| Middle East (UAE)  | 3.28.224.220   |
| Middle East (UAE)  | 51.112.26.119  |

```
```