Hi @yamada,
Unfortunately we don’t have a static list of IP addresses configured for our API (servers regularly spin up and go down via AWS). You can have IP Tables configured for our domain (app.asana.com), and we suggest that you verify the webhook signature as the means to verify that they events are authentic. We may consider having a static IP in the long run, but given it’s a cross-team effort and the relative priority of doing so, we’re unlikely to do this any time in the foreseeable future.
Let me know if you have any further questions.