IP Filtering (Optional)

Before you start

Make sure you have the following:

How it works

RiskOS™ supports optional IP allowlisting to provide an extra layer of network-level security. Allowlisting restricts access to trusted network ranges — even if valid credentials are presented.

📘

Note:

IP allowlisting is an optional security control, not a requirement for API or Dashboard access. It defines where requests are allowed from, while your API key defines who is making the request.

RiskOS™ allows you to define an allowlist for the following:

Configure your allowlist

To configure which IPs or domains can access the APIs:

1. Go to the Developer Workbench > IP Filterings section in the RiskOS™ Dashboard.
   • 🔗 Manage Sandbox IP allowlist.
   • 🔗 Manage Production IP allowlist.
2. In the API Keys IPs tab, click Add IP/CIDR filter.
3. Enter the IP addresses or domains, separated by commas, into the Domain Name field.
4. Click Save.

Supported formats

Allowed

You can allowlist the following types of entries:

• Valid IPv4 addresses (e.g., 203.0.113.42)

• Valid IPv4 addresses with CIDR masks (e.g., 203.0.113.0/24)

• Internet-routable IP addresses only (i.e., no private or loopback IPs)

• Valid domain names including:

  • www.example-domain.com
  • https://www.example-domain.com
  • https://example-domain.com
  • example-domain.com

Not allowed

The following entry types are not allowed:

• Private or loopback IPs:

  • 192.168.1.*
  • localhost
  • 127.0.0.1
  • ::1/128

• Empty strings

Remove an IP address or domain

To remove an entry from the allowlist:

1. Click the trash can icon next to the entry.
2. In the confirmation dialog, click Yes.

The IP address or domain will be immediately removed from the allowlist.