IP allowlisting

An IP allowlist restricts where your organization can be reached from. When your organization has one, env zero accepts the following only from an IP address on the list:

UI logins, including SSO users who belong to several organizations
Requests made with an API key, including personal API keys
Requests from your self-hosted agents to the Agent API

An organization without an allowlist accepts requests from any IP address. This is the default.

This page covers traffic coming into env zero. To let env zero’s outbound traffic reach your VCS or cloud resources, see IP addresses.

How the allowlist is enforced

Access	When env zero checks the IP
UI login	When the user logs in. Users who are already logged in stay logged in when you change the list.
API key	On every request. The key is checked against the allowlist of every organization it has access to.
Self-hosted agent	On every request to the Agent API.

A user who belongs to several organizations can’t log in from an IP address that any of those organizations’ allowlists excludes. This applies even if their other organizations have no allowlist. Requests env zero makes during a deployment aren’t checked, such as OIDC token requests and module downloads from the private registry. SaaS agents aren’t checked either. Deployments on env zero-hosted runners keep working when your organization has an allowlist. If env zero can’t read your organization’s allowlist, it denies the request. Changes apply to the next login or request. An API key or self-hosted agent that already connected from an IP address you remove can keep working from that address for up to one hour.

Rule format

The allowlist is the ipAllowlist organization policy, a list of rules. A request is allowed if its IP address matches any rule.

`type`	Required fields	Matches
`address`	`address`	A single IP address
`subnet`	`network`, `prefix`	A CIDR block, for example `network` `198.51.100.0` with `prefix` `24`
`range`	`start`, `end`	Every address from `start` to `end`, inclusive

Every rule also takes family, either ipv4 or ipv6. It defaults to ipv4, so set "family": "ipv6" on every IPv6 rule. env zero rejects a rule that is missing a required field or has a field that doesn’t belong to its type.

Set the allowlist

You need the Edit Organization Settings permission, for example an Admin API key.

Include every address you log in and call the API from. If the list excludes them, you lose access to the organization and need to contact support to restore it.

You also need your Organization ID.

Send the allowlist

Call the Update Policy API with your rules:

curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "ipAllowlist": [
      {"type": "address", "family": "ipv4", "address": "203.0.113.10"},
      {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24},
      {"type": "range", "family": "ipv4", "start": "192.0.2.10", "end": "192.0.2.20"},
      {"type": "subnet", "family": "ipv6", "network": "2001:db8::", "prefix": 32}
    ]
  }'

The request replaces the whole list. Other organization policies you leave out of the request don’t change.

Check the saved list

The Get Organization API returns the current rules, or null if the organization has no allowlist:

curl -s -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  "https://api.env0.com/organizations/<ORGANIZATION_ID>" \
  | jq '.ipAllowlist'

If you’d rather have env zero configure the allowlist, contact your account team or support.

Remove the allowlist

Send an empty list. The organization accepts requests from any IP address again.

curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"ipAllowlist": []}'

Next steps

Security overview - Review env zero’s security architecture.
API keys - Create the keys the allowlist applies to.
Self-hosted Kubernetes agent overview - Run deployments from within your own network.

GET STARTED

ENVIRONMENTS & DEPLOYMENTS

TEMPLATES & IaC TOOLS

PLATFORM CONFIGURATION

SELF-HOSTED AGENTS

CLOUD MANAGEMENT

GOVERNANCE & POLICIES

ACCESS & IDENTITY

SECURITY & COMPLIANCE

INTEGRATIONS & DEVELOPER TOOLS

BILLING & SUPPORT

How the allowlist is enforced

Rule format

Set the allowlist

Remove the allowlist

Next steps

​How the allowlist is enforced

​Rule format

​Set the allowlist

​Remove the allowlist

​Next steps

How the allowlist is enforced

Rule format

Set the allowlist

Remove the allowlist

Next steps