IP Allowlist

Restrict API access to specific IP addresses or CIDR ranges. Enterprise tier. Enforcement is applied on every authenticated request. Calls from unlisted IPs return 403 Forbidden.

Concept

An organization has a list of allowed IPs. The allowlist is inactive while empty (all IPs allowed). As soon as you add one entry, enforcement switches on and only listed IPs can authenticate. Both IPv4 and IPv6, single addresses or CIDR networks, are accepted.

Lock-out risk

Adding your first IP turns enforcement on immediately. If you add an address you are not calling from, you will lose access. Always add the IP you are on before anything else, or configure from the dashboard where the current IP is pre-filled.

Add an IP

bash

curl -X POST https://api.asqav.com/api/v1/ip-allowlist \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ip_address":"203.0.113.0/24","description":"Office VPN"}'

Valid formats:

Example	Meaning
`203.0.113.1`	Single IPv4
`203.0.113.0/24`	IPv4 CIDR range
`2001:db8::1`	Single IPv6
`2001:db8::/32`	IPv6 CIDR range

List and remove

bash

GET    /api/v1/ip-allowlist
DELETE /api/v1/ip-allowlist/{ip_id}

The list response includes enforcement_enabled, which reflects whether the allowlist blocks anything. Deleting the last entry disables enforcement again.

Dashboard

Same controls live under Settings > Security > IP Allowlist. The dashboard pre-fills your current IP and warns before you enable enforcement.

Verification

Call the API from an unlisted IP. You should receive:

json

{"detail": "IP address not allowed"}

with HTTP status 403. Calls from allowed IPs continue to succeed. Enforcement is wired into the authentication middleware so it applies uniformly to API key, Bearer token, and session cookie requests.