> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Organization IP Allowlist

> Returns the IP addresses and CIDR blocks your organization accepts requests from, and which surfaces that restriction is enforced on.

An EMPTY `entries` list means the allowlist is OFF; read it as "not enforcing", never as "locked down".

The organization is resolved from your token. There is no parameter naming another one, so this cannot read someone else's allowlist.

Read-only: nothing changes.

Failures:
- `403` — two different failures share this status, so read the `code`. `AUT-1020` is a permissions problem: your token lacks the `security` resource. With `AUT-0021` it is the LOCKOUT case: your own address is outside the allowlist you are trying to read.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml get /v1/security/ip-allowlist
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/security/ip-allowlist:
    get:
      tags:
        - Security
      summary: Get Organization IP Allowlist
      description: >-
        Returns the IP addresses and CIDR blocks your organization accepts
        requests from, and which surfaces that restriction is enforced on.


        An EMPTY `entries` list means the allowlist is OFF; read it as "not
        enforcing", never as "locked down".


        The organization is resolved from your token. There is no parameter
        naming another one, so this cannot read someone else's allowlist.


        Read-only: nothing changes.


        Failures:

        - `403` — two different failures share this status, so read the `code`.
        `AUT-1020` is a permissions problem: your token lacks the `security`
        resource. With `AUT-0021` it is the LOCKOUT case: your own address is
        outside the allowlist you are trying to read.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: getIPAllowlist
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPAllowlistResponse'
          description: OK
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Forbidden
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    IPAllowlistResponse:
      additionalProperties: false
      properties:
        entries:
          examples:
            - - 203.0.113.0/24
              - 198.51.100.7
          items:
            type: string
          type: array
        labeledEntries:
          description: >-
            The same allowlist as entries, in the same order and with the same
            CIDRs, each paired with the description an administrator gave it.
            The description is empty for an entry saved as a bare string or
            stored before descriptions existed. entries keeps its current shape
            and stays available; it will be retired later in favor of this
            member. The description is display text only and never influences an
            access decision.
          items:
            $ref: '#/components/schemas/IPAllowlistLabeledEntry'
          type: array
        scopes:
          examples:
            - - console
              - api
          items:
            type: string
          type: array
      required:
        - entries
        - scopes
        - labeledEntries
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
    IPAllowlistLabeledEntry:
      additionalProperties: false
      properties:
        cidr:
          description: Canonical CIDR block, exactly as listed in entries.
          examples:
            - 203.0.113.0/24
          type: string
        description:
          description: >-
            Free-text label shown to administrators; empty when none was given.
            Never influences an access decision.
          examples:
            - São Paulo office
          type: string
      required:
        - cidr
        - description
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.