---
title: "Update the IP allowlist"
method: PATCH
path: "/v1/ip-allowlist"
tags: ["IP Allowlist"]
---

# Update the IP allowlist

`PATCH /v1/ip-allowlist`

## Request

- Base URL: `https://blobsrus.omniapp.co/api`
- URL: `https://blobsrus.omniapp.co/api/v1/ip-allowlist`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

<Note>
  **Organization Admin** permissions are required for this endpoint.
</Note>

Update the organization's IP allowlist. Every field is optional, but at least one must be provided; omit a field to leave it unchanged. `entries` replaces the whole list, notes included.

## Request body

- object
  - `allowsSupport` boolean: Whether Omni support staff, signing in through Omni's own support login, can reach the organization from outside the list.
  - `enabled` boolean: Whether the allowlist is enforced. While false the entries are kept, but no address is blocked.
  - `entries` object[]: Replaces the whole list, notes included. Each address may appear only once.
    - `address` string, required: A public IPv4 or IPv6 address or CIDR range. A bare address allows only that address.
    - `note` string: What the entry is for, up to 200 characters.
  - `exemptsScim` boolean: Whether SCIM provisioning requests (everything under `/api/scim/`) are accepted from any address. They still need an organization API key.

## Response `200`

Settings updated. Returns the stored settings.

- IpAllowlist
  - `allowsSupport` boolean, required: Whether Omni support staff, signing in through Omni's own support login, can reach the organization from outside the list.
  - `enabled` boolean, required: Whether the allowlist is enforced. While false the entries are kept, but no address is blocked.
  - `entries` object[], required: The allowed addresses and ranges, in the order given.
    - `address` string, required: A public IPv4 or IPv6 address or CIDR range, as stored: always network/prefix, so a single address reads 198.51.100.7/32.
    - `note` string, nullable, required: What the entry is for, or null when it has no note.
  - `exemptsScim` boolean, required: Whether SCIM provisioning requests (everything under /api/scim/) are accepted from any address. They still need an organization API key.

## Other responses

- `400`: Invalid request. Common causes: - A missing or malformed `Authorization` header - Invalid JSON body - An empty body - An unknown field - A blank address - An address that isn't a public IP address or CIDR range - An address listed twice - A note over 200 characters - An enabled list with no entries - An enabled list that doesn't cover the address this request came from
- `403`: Invalid API key, or the caller is not an organization admin.
- `409`: The allowlist changed while this request was being handled. Nothing was written; retry.
- `429`: Too Many Requests - Rate limit exceeded (60 requests/minute)
- `500`: Internal Server Error

## Changes

- **2026-11-03** `43290040f88f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/omni/apis/omni-api/changes/v1/ip-allowlist/patch.md)

---

[API](https://skmtc.dev/omni/apis/omni-api.md) - [All operations](https://skmtc.dev/omni/apis/omni-api/llms.txt) - [OpenAPI document](https://skmtc.dev/omni/apis/omni-api/revisions/43290040f88f?raw)