> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP allowlisting

> Restrict UI logins, API keys, and self-hosted agents in your env zero organization to approved IPv4 and IPv6 addresses, subnets, and ranges.

An IP allowlist restricts where your organization can be reached from. When your organization has one, env zero accepts the following only from an IP address on the list:

* UI logins, including SSO users who belong to several organizations
* Requests made with an API key, including personal API keys
* Requests from your self-hosted agents to the Agent API

An organization without an allowlist accepts requests from any IP address. This is the default.

<Note>
  This page covers traffic coming into env zero. To let env zero's outbound traffic reach your VCS or cloud resources, see [IP addresses](/guides/overview/security-overview/ip-addresses).
</Note>

## How the allowlist is enforced

| Access | When env zero checks the IP |
| :- | :- |
| UI login | When the user logs in. Users who are already logged in stay logged in when you change the list. |
| API key | On every request. The key is checked against the allowlist of every organization it has access to. |
| Self-hosted agent | On every request to the Agent API. |

A user who belongs to several organizations can't log in from an IP address that any of those organizations' allowlists excludes. This applies even if their other organizations have no allowlist.

Requests env zero makes during a deployment aren't checked, such as OIDC token requests and module downloads from the [private registry](/guides/admin-guide/private-registry). SaaS agents aren't checked either. Deployments on env zero-hosted runners keep working when your organization has an allowlist.

If env zero can't read your organization's allowlist, it denies the request.

Changes apply to the next login or request. An API key or self-hosted agent that already connected from an IP address you remove can keep working from that address for up to one hour.

## Rule format

The allowlist is the `ipAllowlist` organization policy, a list of rules. A request is allowed if its IP address matches any rule.

| `type` | Required fields | Matches |
| :- | :- | :- |
| `address` | `address` | A single IP address |
| `subnet` | `network`, `prefix` | A CIDR block, for example `network` `198.51.100.0` with `prefix` `24` |
| `range` | `start`, `end` | Every address from `start` to `end`, inclusive |

Every rule also takes `family`, either `ipv4` or `ipv6`. It defaults to `ipv4`, so set `"family": "ipv6"` on every IPv6 rule. env zero rejects a rule that is missing a required field or has a field that doesn't belong to its type.

## Set the allowlist

<Warning>
  You need the **Edit Organization Settings** permission, for example an Admin [API key](/guides/admin-guide/user-role-and-team-management/api-keys).
</Warning>

<Warning>
  Include every address you log in and call the API from. If the list excludes them, you lose access to the organization and need to contact [support](mailto:support@env0.com) to restore it.
</Warning>

You also need your [Organization ID](/guides/admin-guide/organizations#finding-my-organization-id).

<Steps>
  <Step title="Send the allowlist">
    Call the [Update Policy](/api-reference/organization/update-policy) API with your rules:

    ```bash theme={null}
    curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
      -u "<API_KEY_ID>:<API_KEY_SECRET>" \
      -H "Content-Type: application/json" \
      -d '{
        "ipAllowlist": [
          {"type": "address", "family": "ipv4", "address": "203.0.113.10"},
          {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24},
          {"type": "range", "family": "ipv4", "start": "192.0.2.10", "end": "192.0.2.20"},
          {"type": "subnet", "family": "ipv6", "network": "2001:db8::", "prefix": 32}
        ]
      }'
    ```

    The request replaces the whole list. Other organization policies you leave out of the request don't change.
  </Step>

  <Step title="Check the saved list">
    The [Get Organization](/api-reference/organization/get-organization) API returns the current rules, or `null` if the organization has no allowlist:

    ```bash theme={null}
    curl -s -u "<API_KEY_ID>:<API_KEY_SECRET>" \
      "https://api.env0.com/organizations/<ORGANIZATION_ID>" \
      | jq '.ipAllowlist'
    ```
  </Step>
</Steps>

If you'd rather have env zero configure the allowlist, contact your account team or [support](mailto:support@env0.com).

## Remove the allowlist

Send an empty list. The organization accepts requests from any IP address again.

```bash theme={null}
curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"ipAllowlist": []}'
```

## Next steps

* [Security overview](/guides/overview/security-overview) - Review env zero's security architecture.
* [API keys](/guides/admin-guide/user-role-and-team-management/api-keys) - Create the keys the allowlist applies to.
* [Self-hosted Kubernetes agent overview](/guides/admin-guide/self-hosted-kubernetes-agent/overview) - Run deployments from within your own network.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.