Skip to main content
Two operations on the Identity API manage the IP allowlist: one reads it, one replaces it. Use them when you manage security settings from your own tooling instead of the Console. The API reference documents both operations: Get Organization IP Allowlist and Set Organization IP Allowlist.

​
The two operations

Both operations live on the Identity API base URL and need a bearer token. The platform resolves your workspace from the token. There is no organization identifier in the path or in the body.

​
The body

The request body of PUT and the response body of both operations have the same shape:
Rules that apply to the fields:
  • entries is a full replacement. To add one address, send the current list plus the new address.
  • An entry broader than /24 for IPv4 or /48 for IPv6 is rejected with 400, and nothing changes.
  • The response echoes the entries as the platform stored them. A single address comes back with its prefix: 198.51.100.7 becomes 198.51.100.7/32.
  • entries: [] deactivates the list. The operation returns 200.
  • An empty stored list serializes as [], never as null.
  • When you omit scopes, the stored scopes stay as they are.
  • scopes: [] keeps the entries but stops enforcement everywhere.
  • When you omit entries, the operation returns 400 with code IDE-0001 and nothing changes.

​
Examples

Replace the placeholders with your Identity API base URL and a bearer token that holds the security permission.
A successful PUT returns 200 with the stored list:
1

Register the addresses with only the console scope

Send the full list with "scopes": ["console"]. Include the address you call from.
2

Make sure you can still sign in

Sign in to the Console from a listed address. Then try from an unlisted address and expect a refusal.
3

List every integration's outgoing address

Collect the address each ERP, webhook sender, scheduled job, and application calls from. Add each one to entries.
4

Add the api scope

Send the full list again with "scopes": ["console", "api"]. Watch your integrations for 403 responses.

​
Errors

Every error uses the Access Manager envelope with the fields code, title, and message. The allowlist shares its 200-character budget with the platform ranges; a refusal names the characters that remain.
Inspect the code field, not only the status. A 403 with code AUT-0021 can come back from any protected endpoint, including these two, when your own address is outside an active list. In that case the list did not change and you must call from a listed address.

IP allowlist

What the feature protects, how it decides, and what it does not cover.

Access Manager error list

Every Auth and Identity error code, with title and message.