---
title: "Update Security Settings"
method: PATCH
path: "/admin/settings/security"
tags: ["admin", "admin:settings"]
---

# Update Security Settings

`PATCH /admin/settings/security`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/admin/settings/security`
- Auth: API key in cookie `fastapiusersauth`

Update the platform admin IP allowlist.

Enabling a non-empty allowlist that excludes the caller's own IP is
rejected so a platform admin cannot lock themselves out.

## Request body

- PlatformSecuritySettingsUpdate: Update the platform admin IP allowlist. Applies only to the platform admin API, not to organizations.
  - `ip_allowlist_enabled` boolean: Restrict organization API access to the configured IP allowlists. Has no effect while no allowlists exist.
  - `ip_allowlists` IPAllowlist[]: Named groups of allowed IP addresses or CIDR ranges.
    - `name` string, required: Human-readable name, e.g. 'Corporate VPN'.
    - `description` string, nullable: Optional note on what this allowlist covers and who owns it.
    - `cidrs` string[], required: IPv4 or IPv6 addresses or CIDR ranges.

## Response `200`

Successful Response

- PlatformSecuritySettingsRead: Platform admin IP allowlist settings response.
  - `ip_allowlist_enabled` boolean, required
  - `ip_allowlists` IPAllowlist[], required
    - `name` string, required: Human-readable name, e.g. 'Corporate VPN'.
    - `description` string, nullable: Optional note on what this allowlist covers and who owns it.
    - `cidrs` string[], required: IPv4 or IPv6 addresses or CIDR ranges.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)