Salesforce API Connectivity FAQ — SOAP Endpoints, IP Addresses, and Allowlisting Guidelines

This article addresses the most frequently asked questions about Salesforce API connectivity, SOAP endpoint structure, IP address behavior, and allowlisting best practices.

What Are the Salesforce SOAP API Endpoints?

Salesforce provides two types of SOAP WSDL call endpoints:
Enterprise endpoint — Uses the path '/c'. Example: <REDACTED> Example (sandbox): https://test.salesforce.com/services/Soap/c/40.0
Partner endpoint — Uses the path '/u'. Example: https://login.salesforce.com/services/Soap/u/40.0 Example (sandbox): https://test.salesforce.com/services/Soap/u/40.0
The WSDL document may specify a SOAP endpoint location that references an outbound port. For security reasons, Salesforce restricts outbound ports to the following:

• Port 80: HTTP connections only
• Port 443: HTTPS connections only
• Ports 1024–65535 (inclusive): HTTP or HTTPS connections

For more information on best practices, see Updating Hard-Coded References FAQ.

Does the Salesforce Domain Name Resolve to a Single IP Address?

No. The Salesforce domain name resolves to the entire IP address range, not a single IP. This range may change when a new data center is added or an older data center is removed. Salesforce communicates these changes in release notes or via email to org administrators. There is no defined schedule for IP range changes.

Why Does Salesforce Recommend Allowlisting the Entire IP Range Instead of a Single IP?

Due to the multi-tenant nature of Salesforce, all API connections cannot be guaranteed to originate from a single IP address. In a disaster recovery or failover situation, the IP address used for connections may change. Allowlisting only a single IP address can expose your company to extended downtime during such events. Allowlisting the entire Salesforce IP range is the recommended approach to ensure uninterrupted API connectivity.