---
title: "Update the IP allowlist"
method: PATCH
path: "/api/v1/ip-allowlist"
tags: ["IP Allowlist"]
---

# Update the IP allowlist

`PATCH /api/v1/ip-allowlist`

## Request

- Base URL: `https://omniapp.co` (the document declares no server; this is the origin it was published from)
- URL: `https://omniapp.co/api/v1/ip-allowlist`
- Auth: HTTP bearer

Update the organization's IP allowlist. Every field is optional: omit one to leave it unchanged. `entries` replaces the whole list. The update is refused if it would leave the allowlist enabled with no entries, or enabled with a list that blocks the address this request came from. Requires organization admin access. Returns the stored settings, the same shape as GET.

## Request body

- IpAllowlistUpdateBody
  - `allowsSupport` boolean: Whether Omni support staff, signing in through Omni's own support login, can reach the organization from outside the list.
  - `enabled` boolean: Whether the allowlist is enforced. While false the entries are kept, but no address is blocked.
  - `entries` IpAllowlistEntryInput[]: Replaces the whole list, notes included. Each address may appear only once.
    - `address` string, required: A public IPv4 or IPv6 address or CIDR range. A bare address allows only that address.
    - `note` string: What the entry is for, up to 200 characters.
  - `exemptsScim` boolean: Whether SCIM provisioning requests (everything under /api/scim/) are accepted from any address. They still need an organization API key.

## Response `200`

Settings updated. Returns the stored settings.

- IpAllowlist
  - `allowsSupport` boolean, required: Whether Omni support staff, signing in through Omni's own support login, can reach the organization from outside the list.
  - `enabled` boolean, required: Whether the allowlist is enforced. While false the entries are kept, but no address is blocked.
  - `entries` IpAllowlistEntry[], required: The allowed addresses and ranges, in the order given.
    - `address` string, required: A public IPv4 or IPv6 address or CIDR range, as stored: always network/prefix, so a single address reads 198.51.100.7/32.
    - `note` string, nullable, required: What the entry is for, or null when it has no note.
  - `exemptsScim` boolean, required: Whether SCIM provisioning requests (everything under /api/scim/) are accepted from any address. They still need an organization API key.

## Other responses

- `400`: Invalid request. Common causes: a missing or malformed Authorization header, an empty body, an unknown field, an address that is not a public IP address or CIDR range, an address listed twice, a note over 200 characters, an enabled list with no entries, or a list that would block the calling address.
- `403`: Invalid API key, or the caller is not an organization admin.
- `409`: The allowlist changed while this request was being handled. Nothing was written; retry.

## Changes

- **2026-10-10** `6f3dfc5c9610`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/omniapp/apis/omni-api/changes/api/v1/ip-allowlist/patch.md)

---

[API](https://skmtc.dev/omniapp/apis/omni-api.md) - [All operations](https://skmtc.dev/omniapp/apis/omni-api/llms.txt) - [OpenAPI document](https://skmtc.dev/omniapp/apis/omni-api/revisions/76b40ebc2292?raw)