Network Routing Architecture Update

Cybersource endpoints will be migrated from the current routing model to a new architecture using updated IP subnet ranges.

This enhancement improves the performance, resiliency, and reliability of transaction delivery over the Internet. It will also enable seamless transaction routing across multiple Visa data centers, supporting more consistent and reliable transaction processing.

Current Application and endpoints:

CAS/Test

:

apitest.cybersource.com

(current IP address:

66.185.182.49

)

Production

:

api.cybersource.com

(current IP address:

66.185.182.149

)

Merchants that connect to the REST API endpoints (

apitest.cybersource.com

and

api.cybersource.com

) using Domain Name System (DNS) should not be affected. DNS records will be updated automatically to use the new routing architecture.

Merchants with networks configured to allowlist IP addresses or that have hardcoded IP addresses will likely be impacted. These merchants should update proxy or firewall settings to include the new Visa IP address ranges.

There are no changes to TLS/SSL certificates or supported ciphers as part of this migration. However, Cybersource continues to recommend trusting the root TLS certificates for all secure endpoints.

CAS/Test

: October 15, 2026

Production

: January 31, 2027

This technology is now available in both the test and production environments through these domains:

CAS/Test

:

apitest.visaacceptance.com

Production

:

api.visaacceptance.com

Deploying in the CAS/Test Environment provides a safe environment to test and validate access. When testing is complete, you may migrate production processing anytime thereafter.

To use the new routing architecture, your firewall, or your commerce platform provider's firewall, must be configured to permit outbound traffic to the Visa cloud.

This large, dynamic IP address space represents a significant change from current access configurations. Therefore, it is critically important to test firewall configurations and confirm that connections are successful before migrating production traffic.

Merchants that require IP address allowlists may use one of the options below.

Option 1

: Merchants may add these specific subnet ranges to IP address allowlists:

Option 2

: Merchants may add these generic subnet ranges to IP address allowlists: