---
title: "Restricting organisation access by IP address"
slug: "org-ip-access-allowlists"
source: "https://app.cloudpe.com/help/org-ip-access-allowlists"
updated: "2026-10-16T18:59:51.711Z"
---

# Restricting organisation access by IP address

## Overview

IP access lets an organization owner restrict which client networks may reach an organization. Two independent lists are stored per organization:

- **Browser sessions** — every request that is not made with an API key: console sign-ins, shared console links, public VDI links, the RDP proxy, the AI gateway playground, and signup through an invitation to the organization.
- **API keys** — requests made with CloudPE API keys, on the platform API and on the AI gateway.

An empty list means no IP restriction for that kind of traffic. A non-empty list means only client IPs inside one of its CIDR ranges can reach the organization. Sign-in itself still works, and the same user keeps full access to every other organization they belong to.

IP access sits next to **Country access** on the same tab and uses the same enforcement points. Country is evaluated first: if an organization refuses a request for both reasons, the country block is reported.

This feature is not yet rolled out to all accounts. If the **IP access** card does not appear on your organization, it is not enabled for you yet.

## Before you start

- You must be the owner of the organization. The card is hidden for other members, and the API is owner-only.
- The organization must already exist and you must be signed in to it; see [Organisations, projects and roles](/help/orgs-projects-rbac).
- Know the public IP ranges you want to allow (office egress, VPN concentrator, CI runners), for example `203.0.113.0/24` for an office, `198.51.100.0/24` for CI runners or `2001:db8::/32` for an IPv6 network. Write ranges with host bits clear: `203.0.113.5/24` is refused, write `203.0.113.0/24`. A bare IPv4 or IPv6 address is stored as a single-host range (`/32` or `/128`).
- Credentials issued before you restrict access keep working until they expire or are rotated: object storage keys and presigned URLs, kubeconfigs and noVNC console URLs. Plan to rotate object storage keys and kubeconfigs after you save a list.
- If you call the API, the key needs the `organizations:read` scope to read the lists and `organizations:update` to replace them.

## Steps

1. Open **Organizations** in the sidebar.

   ![](/kb/getting-started/orgs-projects-rbac-01-organizations.png)

2. Select the organization you want to restrict, then open its **Settings** tab.
3. Find the **IP access** card. It shows the IP you are currently connecting from.

   ![](/kb/getting-started/org-ip-access-allowlists-01-settings-tab.png)

4. Under **Browser sessions**, choose **Add my IP** to insert your current address, or type a CIDR range with an optional label and choose **Add**. Repeat for every network that should be able to sign in.
5. Under **API keys**, add the CIDR ranges your automation calls from. Leave this list empty if you do not want to restrict API-key traffic.
6. Use **Remove** on any row you no longer need.
7. Choose **Save**. Entries are de-duplicated and sorted when stored, and the change is written to the organization audit log in the same transaction. You can review it later on the **Activity** tab.

Changes apply to the platform API, share links, public VDI links and the RDP proxy on the next request or connect. The AI gateway picks up the new lists within about a minute. Open RDP connections are not cut; the next connect is checked.

## API

Two public endpoints manage the lists. Both are bound to the organization in the path.

Read the current lists:

```bash
curl -X GET https://app.cloudpe.com/api/v1/organizations/<org_id>/ip-allowlist \
  -H "Authorization: Bearer <API_KEY>"
```

The response returns `sessions`, `api_keys` and `current_ip` (null when the caller's IP cannot be determined).

Replace both lists:

```bash
curl -X PUT https://app.cloudpe.com/api/v1/organizations/<org_id>/ip-allowlist \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
        "sessions": [{"cidr": "203.0.113.0/24", "label": "Office"}],
        "api_keys": [{"cidr": "198.51.100.10/32", "label": "CI"}]
      }'
```

Both `sessions` and `api_keys` are required and the call replaces both lists in full. Send an empty array to clear a list.

To find the organization id, list your organizations:

```bash
curl -X GET https://app.cloudpe.com/api/v1/organizations \
  -H "Authorization: Bearer <API_KEY>"
```

The generic `PATCH /api/v1/organizations/{org_id}` endpoint cannot change IP access; it rejects the attempt and keeps the stored value.

## Limits & billing

- IP access is a configuration control on the organization record. There is no charge for using it and it consumes no quota.
- Entries are IPv4 or IPv6 addresses or CIDR ranges; an IPv4-mapped IPv6 address is matched as IPv4. A range with host bits set is refused. Each list holds up to 100 entries and each label up to 64 characters; a save that exceeds either is refused as a validation error.
- Enforcement fails closed: when the applicable list is not empty and the client IP cannot be determined, the request is refused. Country blocking behaves the opposite way, so an unresolved country is allowed.
- Platform administrators and admin impersonation sessions bypass the lists so that support can always reach the organization. Reseller impersonation does not bypass; the reseller is treated as the customer. Background jobs and webhooks are not evaluated.
- For organizations you are not a member of, the organization's own lists apply to your traffic: its **Browser sessions** list for a session, its **API keys** list for an API key.
- In-cluster callers that reach the AI gateway directly, bypassing the public edge, have no resolvable client IP and are refused while a list is in place.

## Troubleshooting

| Error | What it means | What to do |
|---|---|---|
| `This change would block your own current connection.` | The save you attempted would exclude the IP you are connecting from. A session caller is checked against the new **Browser sessions** list, an API-key caller against the new **API keys** list. | Add your current IP (use **Add my IP**) before saving, or widen the range. The same error appears if your IP cannot be determined and the relevant list is not empty. |
| `Could not record the audit entry; no change was saved.` | The audit record for the change could not be written, so the whole save was rolled back. | Retry the save. If it keeps failing, raise a support ticket. |
| `This organization does not allow access from your network.` | Your client IP is outside the applicable list. The organization still appears in your organization list, marked as unavailable, with no data. | Connect from an allowed network, or ask the owner to add your IP. If every organization refuses you, the dashboard shows a full-page unavailable screen whose only action is to sign out. |
| `This organization does not allow access from your location.` | The organization also blocks your country, and country is checked first. | See [Restricting organisation access by country](/help/org-country-access-geofencing). |
| `Use PUT /organizations/{org_id}/ip-allowlist to change IP access` | You tried to change the IP access settings through the generic organization update endpoint. | Call the dedicated endpoint shown above. |
| `Organization not found` | The organization id in the path does not exist or is not visible to you. | Re-check the id returned by the organization list endpoint. |

## FAQ

**Does restricting IPs lock me out of my other organizations?**
No. The lists apply only to the organization that holds them. Sign-in still works and your other organizations remain fully usable.

**What happens if my own IP changes later — new ISP, travel?**
The self-lockout guard only protects the save itself. If your address changes afterwards you cannot reach the organization, including the **IP access** card. Contact support: an admin impersonation session bypasses the lists and can clear the list or add your new address.

**Do existing API keys and downloaded credentials stop working immediately?**
Requests made with CloudPE API keys are checked on the next call against the **API keys** list. Credentials that do not pass through the platform — object storage keys and presigned URLs, kubeconfigs, noVNC URLs — keep working until they expire or are rotated. Rotate them after restricting access.

**Can I restrict only automation and leave browser access open?**
Yes. Fill in the **API keys** list and leave **Browser sessions** empty, or the other way round. The lists are independent.

**Where can I see who changed the lists?**
Every save is recorded in the organization audit log with the lists before and after the change; open the **Activity** tab.

## Related

- [Restricting organisation access by country](/help/org-country-access-geofencing)
- [Organisations, projects and roles](/help/orgs-projects-rbac)
- [Managing API keys](/help/api-keys-management)
- [AI gateway API keys](/help/ai-api-keys)