> ## Documentation Index
> Fetch the complete documentation index at: https://developers.essal.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Allowlisting

> Restrict API access to trusted IP addresses and CIDR ranges using Essal Guard's IP allowlist.

IP allowlisting lets you restrict API access to your workspace to a defined set of trusted IP addresses or CIDR ranges. When enabled, requests from any IP not on the allowlist are rejected with `403 Forbidden`.

## Enabling IP Allowlisting

IP allowlisting is managed via Guard policies or directly in **Guard → Settings → IP Allowlist** in the dashboard.

### Via API

```bash theme={null}
POST /v1/guard/ip-allowlist/rules
{
  "name": "Corporate Office",
  "cidr": "203.0.113.0/24",
  "description": "Main office network in London"
}
```

```json theme={null}
{
  "id": "ipr_01HXYZ_IP1",
  "name": "Corporate Office",
  "cidr": "203.0.113.0/24",
  "status": "active",
  "created_at": "2026-07-01T08:00:00Z"
}
```

## Listing Allowlist Rules

```bash theme={null}
GET /v1/guard/ip-allowlist/rules
```

## Updating a Rule

```bash theme={null}
PATCH /v1/guard/ip-allowlist/rules/ipr_01HXYZ_IP1
{ "cidr": "203.0.113.0/23", "description": "Expanded to include new office subnet" }
```

## Removing a Rule

```bash theme={null}
DELETE /v1/guard/ip-allowlist/rules/ipr_01HXYZ_IP1
```

<Warning>
  If all allowlist rules are removed, the allowlist feature is automatically disabled and all IPs regain access. To block all access from unlisted IPs, you must maintain at least one active rule.
</Warning>

## Scope

IP allowlisting applies to all API requests workspace-wide, including requests from integrations and SDK clients. It does not apply to the SSO login flow — IdP redirects are always permitted.

## Temporary Bypass

You can temporarily exempt a specific API key from IP allowlisting (e.g. for emergency access from an unlisted IP):

```bash theme={null}
PATCH /v1/access/api-keys/{key_id}
{ "bypass_ip_allowlist": true, "bypass_expires_at": "2026-07-11T08:00:00Z" }
```

All bypass events are recorded in the Guard audit log with a `guard.ip_allowlist.bypassed` action.

<Note>
  All allowlist changes and bypass events are recorded in the Guard audit log and can trigger alert rules if configured.
</Note>