diff --git a/maestro/templates/ingress-private.yaml b/maestro/templates/ingress-private.yaml
new file mode 100644
index 0000000..4d030b8
--- /dev/null
+++ b/maestro/templates/ingress-private.yaml
@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: "69.49.241.124/32" # hostgator ip 
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/server-snippet: |
+      underscores_in_headers on;
+      ignore_invalid_headers on;
+      
+  generation: 1
+  labels:
+    app: maestro
+  name: maestro
+  namespace: applications
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{ .Values.hostname }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: maestro
+            port:
+              number: {{ .Values.ingress.port }}
+        path: /open-data/sharing-ocean-data
+        pathType: Prefix
diff --git a/src/modules/open-data/open-data.controller.ts b/src/modules/open-data/open-data.controller.ts
index 65172e0..3a6ccff 100644
--- a/src/modules/open-data/open-data.controller.ts
+++ b/src/modules/open-data/open-data.controller.ts
@@ -1,5 +1,5 @@
 import DadosferaLogger from '@dadosfera/dadosfera-logs';
-import { Body, Controller, ForbiddenException, Header, HttpCode, Inject, Param, Post, Query, Req, UseFilters, UseGuards, UseInterceptors } from '@nestjs/common';
+import { Body, Controller, ForbiddenException, Header, HttpCode, HttpException, Inject, Param, Post, Query, Req, UseFilters, UseGuards, UseInterceptors } from '@nestjs/common';
 import { ApiCreatedResponse, ApiHeaders, ApiOkResponse, ApiTags } from '@nestjs/swagger';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
@@ -43,14 +43,20 @@ export class OpenDataController {
   ) {
     this.logger.info('createUser for open data');
 
-    this.logger.info('user-agent', request.headers['user-agent']);
+    this.logger.info('user-agent', request.headers);
+
+    const origin = request.headers['origin'];
+    const corslist = ["https://devsbm.dadosfera.io", "https://sharingoceandata.com"];
+    if (!corslist.includes(origin)) {
+      throw new ForbiddenException();
+    }
 
     const OPENDATA_CUSTOMER_ID = process.env.OPEN_CUSTOMER_ID;
     const OPENDATA_GROUP_ID = process.env.OPEN_GROUP_ID;
     const roles = [process.env.OPEN_GROUP_ID];
     const metadata = PackTheMetadata({
       language: language || 'en-us'
-    });
+    }); 
 
     const data = {}