Connectivity
This page collects the network details other systems need to talk to SuperAPI, and the details your firewall needs to accept traffic from us. It covers the endpoints we publish, the addresses we send from, the TLS and HTTP versions we support, and the limits that apply.
INFO
Everything here is stable and safe to configure against. If you need a broader view of our security posture, see the Security FAQ or our Trust Centre.
Endpoints you connect to
| Host | Port | Protocol | Purpose |
|---|---|---|---|
api.superapi.com.au | 443 | HTTPS | The REST API, and the origin serving our browser embeds |
swagger.superapi.com.au | 443 | HTTPS | Interactive OpenAPI documentation |
partners.superapi.com.au | 443 | HTTPS | The partner dashboard |
superfunds.superapi.com.au | 443 | HTTPS | The super fund dashboard |
services.superapi.com.au | 22 | SFTP | Report delivery for funds. See Reporting |
There is no separate sandbox hostname. Sandbox is a property of your partner record, so sandboxed and live traffic use the same endpoints. See Getting started for how sandbox mode behaves.
Requests to the API carry your key in an x-api-key header. See Product keys and partner keys.
Embedding in a browser
Our employer and onboarding embeds are served from https://api.superapi.com.au. If your application sets a Content Security Policy, that origin needs to be allowed in frame-src.
TLS
Every connection to us is encrypted end to end. TLS is terminated at our edge, and the onward connection to the application is itself TLS with a validated certificate.
| Property | Value |
|---|---|
| Minimum version | TLS 1.2 |
| Preferred version | TLS 1.3 |
| TLS 1.0 and 1.1 | Rejected |
| Plain HTTP | Redirected to HTTPS |
| HSTS | max-age=15638400, including subdomains |
| Certificates | Issued and renewed automatically. Do not pin them |
WARNING
Do not pin our certificates or their intermediates. They rotate automatically and a pinned client will break without warning. If you need to verify who you are talking to beyond the certificate chain, use the HMAC signature we put on webhooks instead.
We run a restricted cipher set with post-quantum key exchange available, and we track the current recommendations rather than pinning a fixed list. If your security review needs the exact ciphers offered, ask us and we will send the current set.
HTTP versions and IPv6
HTTP/1.1, HTTP/2 and HTTP/3 are all supported, and our HTTPS hostnames resolve on both IPv4 and IPv6. services.superapi.com.au is IPv4 only.
Rate limits
Requests to api.superapi.com.au under the /api path are rate limited per source IP address. Normal integration traffic sits comfortably inside the limit. If you are planning a bulk operation or a backfill, talk to us first and we will tell you what headroom you have.
WARNING
Over the limit you will get 429 Too Many Requests, and further requests from that address are then blocked for a sustained period rather than being throttled request by request. Back off when you see a 429 instead of retrying immediately, or you will stay blocked.
Browser embed URLs are not covered by this limit, so an employee working through an onboarding session is never affected by your server-side API traffic.
Addresses we send from
Every outbound connection we make from production leaves from one of two fixed addresses. Allowlist both. We do not control which of the two a given request uses, and it can change between requests.
| Address | Environment | Notes |
|---|---|---|
13.54.143.231 | Production | Sydney, availability zone ap-southeast-2a |
52.65.198.112 | Production | Sydney, availability zone ap-southeast-2b |
54.153.148.172 | UAT | Only relevant if you run a UAT environment we connect to |
These cover everything we originate: webhook delivery, calls to your APIs, calls to super fund APIs, and outbound SuperStream messaging.
They are static addresses reserved to our AWS account, and we treat them as permanent. If one ever has to change, we will contact integrated partners and funds before it does.
WARNING
Treat a source address as a network control, not as authentication. Anyone can claim to be sending from an address. Verify that a webhook genuinely came from us using the HMAC signature.
Webhook delivery
We deliver webhooks by making an HTTPS request to the webhook_url on your product. See the list of webhooks for the events themselves.
| Property | Value |
|---|---|
| Method | POST |
| Content type | application/json |
| Source addresses | The production addresses listed above |
| Signature | x-superapi-signature, a base64 HMAC-SHA256 of the raw request body |
| Response timeout | 15 seconds |
| Attempts | Up to 5, with exponential backoff over roughly 10 minutes |
| Success | Any 2xx status |
| Redirects | Followed, but see the warning below |
Anything that is not a 2xx is treated as a failure and retried.
WARNING
Point webhook_url directly at your handler rather than at something that redirects. We do follow redirects, but a 301, 302 or 303 turns our POST into a GET and drops the payload, which is standard HTTP client behaviour and almost certainly not what you intended. If you cannot avoid a redirect, use 307 or 308, which preserve both the method and the body.
TIP
Acknowledge the webhook first and do your processing afterwards. If your handler takes longer than 15 seconds we will give up on that attempt and retry, which can leave you processing the same event twice. Treat delivery as at-least-once and make your handler idempotent.
Your endpoint must be reachable over HTTPS on port 443 with a publicly valid certificate. We do not accept self-signed certificates, and we do not deliver to plain HTTP.
If deliveries keep failing after all attempts are exhausted, we detect the pattern and get in touch. You do not need to tell us, though it will always be faster if you do.
SFTP
Funds collect reports over SFTP. The connection details, key requirements and folder layout are in Reporting. The parts that matter for a firewall:
| Setting | Value |
|---|---|
| Host | services.superapi.com.au |
| Port | 22 |
| Protocol | SFTP over SSH |
| Auth | SSH key only, no passwords |
WARNING
Resolve services.superapi.com.au rather than hardcoding whatever it resolves to today. Unlike the outbound addresses above, the addresses behind this hostname are not reserved to us and can change. If your firewall needs literal addresses for outbound rules, contact us and we will work through it with you.
Access is provisioned per fund, and connections to your user are restricted to an IP allowlist you give us during setup. Tell us when your egress addresses change so we can keep that list current.
Email
We publish SPF, DKIM and DMARC records for superapi.com.au. Our DMARC policy is p=quarantine for the domain itself and p=reject for its subdomains, and bounces are handled on bounce.superapi.com.au.
If our email is being filtered by your mail gateway, authenticate it with SPF and DKIM rather than allowlisting addresses. We send through several providers and the sending addresses are not fixed.
Telling us about your side
If your systems restrict inbound traffic by address, or you run a UAT environment we need to reach, send us the details and we will confirm what we need from you:
- The hostnames and ports we should connect to.
- Whether you need our addresses allowlisted, and in which environments.
- The addresses you will be connecting from, if you use our SFTP server.
Email support@superapi.com.au, or raise it in your shared Slack or Teams channel if you have one with us.
Getting help
Stuck with something and need help? Please contact us at support@superapi.com.au or by phone on 0405 472 748 (Sam). Have you setup a shared Slack or Teams channel with us? If not, please reach out so we can provide realtime support.