IP Allowlisting

IP allowlisting lets you restrict API access to your workspace to a defined set of trusted IP addresses or CIDR ranges. When enabled, requests from any IP not on the allowlist are rejected with 403 Forbidden.

Enabling IP Allowlisting

IP allowlisting is managed via Guard policies or directly in Guard → Settings → IP Allowlist in the dashboard.

Via API

POST /v1/guard/ip-allowlist/rules
{
  "name": "Corporate Office",
  "cidr": "203.0.113.0/24",
  "description": "Main office network in London"
}

{
  "id": "ipr_01HXYZ_IP1",
  "name": "Corporate Office",
  "cidr": "203.0.113.0/24",
  "status": "active",
  "created_at": "2026-07-01T08:00:00Z"
}

Listing Allowlist Rules

GET /v1/guard/ip-allowlist/rules

Updating a Rule

PATCH /v1/guard/ip-allowlist/rules/ipr_01HXYZ_IP1
{ "cidr": "203.0.113.0/23", "description": "Expanded to include new office subnet" }

Removing a Rule

DELETE /v1/guard/ip-allowlist/rules/ipr_01HXYZ_IP1

If all allowlist rules are removed, the allowlist feature is automatically disabled and all IPs regain access. To block all access from unlisted IPs, you must maintain at least one active rule.

Scope

IP allowlisting applies to all API requests workspace-wide, including requests from integrations and SDK clients. It does not apply to the SSO login flow — IdP redirects are always permitted.

Temporary Bypass

You can temporarily exempt a specific API key from IP allowlisting (e.g. for emergency access from an unlisted IP):

PATCH /v1/access/api-keys/{key_id}
{ "bypass_ip_allowlist": true, "bypass_expires_at": "2026-07-11T08:00:00Z" }

All bypass events are recorded in the Guard audit log with a guard.ip_allowlist.bypassed action.

All allowlist changes and bypass events are recorded in the Guard audit log and can trigger alert rules if configured.

Getting Started

Platform Concepts

App Guides — Office

App Guides — Access

App Guides — Sales

App Guides — Careers

App Guides — Project

App Guides — Guard

Integrations

Security & Compliance

Enabling IP Allowlisting

Via API

Listing Allowlist Rules

Updating a Rule

Removing a Rule

Scope

Temporary Bypass

​Enabling IP Allowlisting

​Via API

​Listing Allowlist Rules

​Updating a Rule

​Removing a Rule

​Scope

​Temporary Bypass

Enabling IP Allowlisting

Via API

Listing Allowlist Rules

Updating a Rule

Removing a Rule

Scope

Temporary Bypass