Skip to main content
If Send test request (or another outbound request) returns 403 Forbidden and the Response tab is a short HTML page, this article explains why and how to fix it. Paragon does not send requests to IP addresses. Use a hostname. Jump to Fix.

​
Symptoms

  • Send test request (or another outbound request) fails.
  • The Response tab shows a generic error page:
  • The same URL works from curl, Postman, or a browser.
  • Logging out and back in does not change the result.
  • The API Base URL (or request URL) looks like http://203.0.113.10:8000/... or another raw IPv4/IPv6 address, not https://api.example.com/....
You will not see a Paragon error that says “IP addresses are not allowed.” The 403 is the entire signal.

​
Cause

Paragon blocks outbound requests whose host is an IP address. That policy applies across request URLs, not only Custom Integrations. The 403 is returned by Paragon before the request reaches the provider, which is why the same call succeeds from another client. This is easy to misread as an auth failure. A wrong Authorization header or an expired dashboard session can also produce errors, but they are not this HTML 403.

​
Fix

  1. Give the host a DNS name that resolves to that machine (or put a reverse proxy with a hostname in front of it).
  2. Set the Base URL to that hostname, including the scheme and port if needed. Example: https://api.example.com:8000/ or https://api.example.com/.
  3. Set Test Endpoint URL to a path that accepts GET, relative to that base URL.
  4. Click Send test request again.
Do not substitute localhost or another IP. The host in the URL must be a domain name.

​
Prevention

When you configure an API Base URL, Test Endpoint URL, Request step URL, or API Resource base URL, use a hostname. If the provider is only reachable by IP today, add DNS (or a hostname on a load balancer) before wiring it into Paragon.

​
Still having issues?

If the 403 persists after the URL uses a hostname, it is a different failure (provider ACL, TLS, or an allowlisted-host error). Send support:
  • The exact API Base URL and Test Endpoint URL (hostname vs IP)
  • The full Response tab body
  • Whether the same URL succeeds from another client