---
title: "Replace the allow-list and its switches (owner/admin, session signed in within 5 minutes; at most 100 ranges). Refused with 409 lockout when the list would be on without your current address, unless confirmLockout is true"
method: PUT
path: "/orgs/{orgId}/ip-allowlist"
tags: ["Teams"]
---

# Replace the allow-list and its switches (owner/admin, session signed in within 5 minutes; at most 100 ranges). Refused with 409 lockout when the list would be on without your current address, unless confirmLockout is true

`PUT /orgs/{orgId}/ip-allowlist`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/orgs/{orgId}/ip-allowlist`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orgId` string, uuid, required

## Request body

- object
  - `enabled` boolean, required
  - `scimExempt` boolean: omit to keep the current setting
  - `entries` object[], required
    - `cidr` string, required: IPv4 or IPv6 range in CIDR notation, e.g. 203.0.113.0/24 or 2001:db8::/32; a bare address is a single host. Saved as its network (10.1.2.3/8 → 10.0.0.0/8); an IPv4-mapped IPv6 range as the IPv4 range
    - `label` string: what the range is, e.g. "Office VPN"
  - `confirmLockout` boolean: save even though the list would be on without your current address (you lose access to the team until your address is added)

## Response `200`

Allow-list

- object
  - `role` 'owner' | 'admin' | 'developer' | 'viewer' | 'billing' | 'editor', required: your role in this team (owners and admins manage the list)
  - `enabled` boolean, required: the list is enforced
  - `scimExempt` boolean, required: SCIM provisioning (the identity provider's servers) may call from any address (default true)
  - `entries` object[], required
    - `id` string, uuid, required
    - `cidr` string, required
    - `label` string, required
    - `createdAt` string, required: ISO-8601 timestamp
    - `createdBy` object, required
      - `userId` string, uuid, nullable, required
      - `name` string, nullable, required
      - `email` string, nullable, required
  - `maxEntries` integer, required
  - `updatedAt` string, nullable, required: ISO-8601 timestamp
  - `updatedBy` object, nullable, required
    - `userId` string, uuid, required
    - `name` string, required
    - `email` string, required
  - `you` object, required
    - `address` string, nullable, required: your address as the platform sees it (null: it cannot tell, and an enabled list refuses you)
    - `allowed` boolean, required: one of the saved ranges contains your address
    - `breakGlass` boolean, required: you are an owner outside the list: you may change the list and nothing else of the team

## Other responses

- `400`: Invalid request (code invalid_request; details.reason names a policy rule)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Not permitted (code forbidden). details.sessionRequired: changes need a dashboard session; details.reauthenticate: sign in again (changes need a session younger than 5 minutes); details.policy: the team requires mfa/sso. Code ip_not_allowed: the team's IP allow-list does not include your address (details.clientIp)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Code conflict. details.reason lockout: the list would be on without your current address (details.clientIp); send confirmLockout to save it anyway. details.reason client_ip_unknown: the platform cannot see your address, so the list cannot be turned on
- `429`: Too many requests (code rate_limited); see Retry-After

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)