IP allowlist
The rules for an integration's IP ranges.
An allowlist belongs to one integration. It's optional, and applies to POST /oauth/token and to
every API request.
| Rule | Value |
|---|---|
| Formats | An IPv4 or IPv6 address, or a CIDR range. |
| Ranges per integration | At most 20. |
| Widest IPv4 range | /8 |
| Widest IPv6 range | /32 |
| Refused | 0.0.0.0/0, ::/0, and anything wider than the limits above. |
| An address without a prefix | Stored as /32 for IPv4, or /128 for IPv6. |
| An empty list | No address restriction. |
MyTPE normalizes each range. For example, 203.0.113.77/24 is stored as 203.0.113.0/24.
Responses
| Situation | Response |
|---|---|
| Token request from another address | 403 with access_denied |
| API request from another address | 403 with IP_NOT_ALLOWED |
| The source address can't be established | Refused, as above |
| A change that excludes the address last used, or on an integration never used | 422 with IP_ALLOWLIST_LOCKOUT_RISK, until you confirm |
MyTPE records every change in its audit trail, with who made it, when, and the old and new lists.
An allowlist doesn't replace credentials, scopes or account checks. See CORS and IP restrictions.
Postman collection