Set Organization IP Allowlist

Replaces the addresses your organization accepts requests from.

⚠️ THIS IS THE CALL THAT CAN LOCK YOU OUT. Read GET /v1/security/ip-allowlist first, and keep your own address in the list.

entries is REQUIRED and replaces the stored list wholesale — there is no per-entry merge. Bare addresses are widened to host routes (/32, /128) and CIDRs are canonicalized on save, so what you read back may be spelled differently from what you sent. An explicit EMPTY list turns the allowlist OFF; omitting the member is a 400, never a silent wipe.

Each entry is either a bare string ("203.0.113.0/24") or a labeled object ({"cidr": "203.0.113.0/24", "description": "São Paulo office"}), and the two forms can be mixed. A string is stored with an empty description. Only cidr is validated and only cidr decides whether a request is allowed; description is free text for your administrators and is stored as sent. When the same network appears twice, the first entry — and its description — is kept.

scopes is the member to be careful with, because it has THREE meanings:

• OMIT it — the surfaces currently enforced are left exactly as they are.
• Send [] — enforcement is turned off on every surface, while the entries stay stored.
• Send values — enforcement applies to exactly those surfaces.

So an entries-only update must OMIT scopes.

Failures:

• 400 IDE-0036 — an entry is not a valid IP or CIDR, or a labeled entry has no cidr. The message names the offending value.
• 400 — a scope is not one this deployment enforces, or entries was omitted.
• 403 — as on the read: AUT-1020, a permissions problem, or AUT-0021, the lockout case.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

PUT /v1/security/ip-allowlist

Set Organization IP Allowlist

cURL

curl --request PUT \
  --url https://identity.sandbox.lerian.net/v1/security/ip-allowlist \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "entries": [
    "203.0.113.0/24"
  ],
  "scopes": [
    "console",
    "api"
  ]
}
'

200

{
  "entries": [
    "203.0.113.0/24",
    "198.51.100.7"
  ],
  "labeledEntries": [
    {
      "cidr": "203.0.113.0/24",
      "description": "São Paulo office"
    }
  ],
  "scopes": [
    "console",
    "api"
  ]
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Body

application/json

The allowlist to store. entries is required; omitting scopes leaves the enforcement surfaces unchanged.

entries · (string | object)[] · required

One allowlist entry: a bare IP address or CIDR block (the original form), or a labeled {cidr, description} object. A bare string is stored with an empty description.

Example:

"203.0.113.0/24"

scopes · string[] | null

Example:

["console", "api"]

Response

200

application/json

OK

entries · string[] · required

Example:

["203.0.113.0/24", "198.51.100.7"]

labeledEntries · object[] · required

The same allowlist as entries, in the same order and with the same CIDRs, each paired with the description an administrator gave it. The description is empty for an entry saved as a bare string or stored before descriptions existed. entries keeps its current shape and stays available; it will be retired later in favor of this member. The description is display text only and never influences an access decision.

Show child attributes

scopes · string[] · required

Example:

["console", "api"]