Whitelisted domains and IP addresses in Rival control which external systems and locations can access your data and your scripts can call. They are a security measure to ensure API requests and data access are only allowed from trusted endpoints and IP addresses, reducing the risk of malicious or accidental calls.
Key benefits:
Security – Prevents calls to unauthorized or unsafe domains and restricts data access to approved IP locations.
Control – Only approved domains and IPs can be accessed by scripts in your research domain, and only approved IPs can access export URLs.
Integration readiness – Required for integrations like BHN rewards, CRMs, export automation, and other API-driven workflows.
Use Cases for Whitelisting
Domain Whitelisting — allows your scripts to call external APIs. Use this when you want to integrate with external services like CRMs, rewards platforms, or other APIs using functions like postHttp() and getHttp().
IP Whitelisting — allows access to export URLs from specific locations. Use this when you enable automatic refresh on participant exports and want your internal applications, dashboards, or integrations to pull the export data programmatically.
Where to Manage Whitelisted Domains and IPs
Only Research Domain Admins can manage whitelisted domains and IP addresses.
Go to the Settings tab in the top header.
From the left navigation, select Platforms.
Open the Whitelisted Domains tab.
Adding a Whitelisted Domain or IP
In the Whitelisted Domains tab, click the + (Add) button.
Enter the domain URL (for script calls) or IP address/range (for export access):
Domain examples:
https://api.crm-system.com,https://rewards.platform.ioIP examples:
192.168.1.100,10.0.0.0/24(CIDR notation for ranges)
Select the Purpose from the dropdown:
Scripting — allows your scripts to call this domain
Export download — allows this IP to access export URLs
Click Save.
Editing a Whitelisted Domain or IP
You can update the domain or IP value at any time.
To edit:
Find the entry in the list.
Click the pencil (edit) icon next to it.
Update the domain URL, IP, or purpose.
Click Save.
Deleting a Whitelisted Domain or IP
Find the domain or IP you want to remove.
Click the Delete (trash) icon.
Confirm deletion.
Warning: Removing a whitelisted entry will cause:
Scripts calling that domain to fail (if purpose is Scripting)
External applications unable to access export URLs from that IP (if purpose is Export download)
Update your scripts or integrations before deletion to avoid disruptions.
IP Whitelisting for Export URLs
When you enable automatic refresh on a participant export, you receive an export URL that your applications and dashboards can use to pull fresh data. To access this URL, the IP address making the request must be whitelisted with the Export download purpose.
Steps to whitelist an IP for export access:
Identify the IP address of the server or application that will access the export URL.
In the Whitelisted Domains tab, click + to add a new entry.
Enter the IP address in the Domain URL or IP Range field.
Set Purpose to Export download.
Click Save.
Once saved, that IP can now access your export URLs. All other IP addresses will be denied access to the export URL.
Domain Whitelisting for Script Integrations
When you want your Rival chat scripts to call external APIs (for example, to fetch data from a CRM or send information to a rewards platform), you must whitelist the domain with the Scripting purpose.
Steps to whitelist a domain for script calls:
Identify the domain URL of the external API you want to call.
In the Whitelisted Domains tab, click + to add a new entry.
Enter the full domain URL in the Domain URL or IP Range field (e.g.,
https://api.example.com).Set Purpose to Scripting.
Click Save.
See API functions and Manage secret keys for details on using postHttp() and getHttp() in your scripts.