> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Organization IP Allowlist

> Replaces the IP allowlist and, when the scopes field is present, the enforcement scopes for the caller's organization (resolved from the JWT). Both land in a single atomic write. Entries is mandatory: it is the full replacement list, and an explicit empty array is the only way to deactivate the allowlist. A body that omits entries (including {}) is rejected with 400 IDE-0001 instead of being read as a request to clear every CIDR. Scopes selects the enforced surfaces ("console", "api", both or neither): omitting the field leaves the stored scopes untouched, while an explicit empty array stops enforcing every surface. Admin-only.



## OpenAPI

````yaml /es/openapi/v3-current/AM-identity.yaml put /v1/security/ip-allowlist
openapi: 3.0.1
info:
  contact: {}
  description: This is a swagger documentation for the Identity API
  termsOfService: http://swagger.io/terms/
  title: Identity API
  version: 1.0.0
servers:
  - url: //localhost:4001/
security: []
paths:
  /v1/security/ip-allowlist:
    put:
      tags:
        - Security
      summary: Set Organization IP Allowlist
      description: >-
        Replaces the IP allowlist and, when the scopes field is present, the
        enforcement scopes for the caller's organization (resolved from the
        JWT). Both land in a single atomic write. Entries is mandatory: it is
        the full replacement list, and an explicit empty array is the only way
        to deactivate the allowlist. A body that omits entries (including {}) is
        rejected with 400 IDE-0001 instead of being read as a request to clear
        every CIDR. Scopes selects the enforced surfaces ("console", "api", both
        or neither): omitting the field leaves the stored scopes untouched,
        while an explicit empty array stops enforcing every surface. Admin-only.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPAllowlistInput'
        description: IP Allowlist Input
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPAllowlistResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: >-
            Missing entries field (IDE-0001), invalid entry (IDE-0036), invalid
            enforcement scope (IDE-0037) or allowlist too large (IDE-0035)
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: >-
            Two different failures share this status - inspect the code field.
            Permission denied: the caller lacks the security:put permission, so
            an administrator must grant it. AUT-0021 (IP Not Allowed): the
            caller IP is outside this organization's allowlist and the
            authorization hook forwarded the deny verbatim - the caller must
            reach the API from an allowed IP. Do not surface an IP deny as a
            permissions problem: it is the lockout case where the admin has to
            fix the allowlist.
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Internal Server Error
      security:
        - BearerAuth: []
components:
  schemas:
    IPAllowlistInput:
      description: IPAllowlistInput payload
      example:
        entries:
          - 203.0.113.0/24
          - 198.51.100.7
        scopes:
          - console
          - api
      properties:
        entries:
          description: >-
            Entries is the desired allowlist expressed as IP addresses or CIDR
            blocks.

            Bare addresses are widened to host routes (/32 or /128) and CIDRs
            are

            canonicalized on persist. The key is required and an explicit empty
            list

            deactivates the allowlist; an omitted key is a 400, never a wipe.
          example:
            - 203.0.113.0/24
            - 198.51.100.7
          items:
            type: string
          type: array
        scopes:
          example:
            - console
            - api
          items:
            type: string
          type: array
      required:
        - entries
      type: object
    IPAllowlistResponse:
      description: IPAllowlistResponse payload
      example:
        entries:
          - 203.0.113.0/24
          - 198.51.100.7
        scopes:
          - console
          - api
      properties:
        entries:
          example:
            - 203.0.113.0/24
            - 198.51.100.7
          items:
            type: string
          type: array
        scopes:
          example:
            - console
            - api
          items:
            type: string
          type: array
      type: object
    pkg.HTTPError:
      properties:
        code:
          type: string
        entityType:
          type: string
        err:
          type: object
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      description: 'Bearer authentication. Send Authorization: Bearer <token>.'
      in: header
      name: Authorization
      type: apiKey

````