Skip to main content
Two operations on the Identity API manage the IP allowlist: one reads it, one replaces it. Use them when you manage security settings from your own tooling instead of the Console.
The reference pages for these two operations are not yet in the API reference. Their parent is Identity APIs. This page is the contract until the reference pages land.

​
The two operations

Both operations live on the Identity API base URL and need a bearer token. The platform resolves your workspace from the token. There is no organization identifier in the path or in the body.

​
The body

The request body of PUT and the response body of both operations have the same shape:
Rules that apply to the fields:
  • entries is a full replacement. To add one address, send the current list plus the new address.
  • The response echoes the entries as the platform stored them. A single address comes back with its prefix: 198.51.100.7 becomes 198.51.100.7/32.
  • entries: [] deactivates the list. The operation returns 200.
  • An empty stored list serializes as [], never as null.
  • When you omit scopes, the stored scopes stay as they are.
  • scopes: [] keeps the entries but stops enforcement everywhere.
  • When you omit entries, the operation returns 400 with code IDE-0001 and nothing changes.

​
Examples

Replace the placeholders with your Identity API base URL and a bearer token that holds the security permission.
A successful PUT returns 200 with the stored list:
1

Register the addresses with only the console scope

Send the full list with "scopes": ["console"]. Include the address you call from.
2

Make sure you can still sign in

Sign in to the Console from a listed address. Then try from an unlisted address and expect a refusal.
3

List every integration's outgoing address

Collect the address each ERP, webhook sender, scheduled job, and application calls from. Add each one to entries.
4

Add the api scope

Send the full list again with "scopes": ["console", "api"]. Watch your integrations for 403 responses.

​
Errors

Every error uses the Access Manager envelope with the fields code, title, and message.
Inspect the code field, not only the status. A 403 with code AUT-0021 can come back from any protected endpoint, including these two, when your own address is outside an active list. In that case the list did not change and you must call from a listed address.

IP allowlist

What the feature protects, how it decides, and what it does not cover.

Access Manager error list

Every Auth and Identity error code, with title and message.