Project IP Access

Set a project's IP access policy

Changed on

Replaces the whole project-wide policy. An allow list must name at least one CIDR. A save that would lock out the caller's own address is refused with 409 unless acknowledge_lockout is true.

put/projects/{project_id}/ip-access

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/projects/{project_id}/ip-access
  • Auth: HTTP bearer

Path parameters

project_idinteger required

Project ID

Request body

acknowledge_lockoutboolean

Apply an allow list that excludes (or a deny list that includes) the address this request came from. Without it such a save is refused with 409 so an operator cannot lock themselves out by accident.

mode'disabled' | 'allow' | 'deny' required

How a scope's CIDR list is applied.

Example request

{
  "cidrs": [
    {
      "cidr": "100.64.0.0/10",
      "description": "Tailscale"
    }
  ]
}

Response

Policy saved

configuredboolean required

false when nothing is stored for this scope. For an environment that means it inherits the project-wide policy.

environment_idinteger nullable

null for the project-wide policy.

max_cidrsinteger required

Maximum number of CIDRs a policy may hold.

mode'disabled' | 'allow' | 'deny' required

How a scope's CIDR list is applied.

project_idinteger required
updated_atstring date-time nullable
your_ipstring nullable

The address this request arrived from, as the console resolved it. It is the address the project will see only if the console and the project are reached over the same network path.

Example response

{
  "cidrs": [
    {
      "cidr": "100.64.0.0/10",
      "description": "Tailscale"
    }
  ],
  "updated_at": "2026-10-13T09:30:00Z",
  "your_ip": "203.0.113.9"
}

Changes