> ## Documentation Index
> Fetch the complete documentation index at: https://novita.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get API Key IP Access Policy

Retrieve the current IP access policy of a single API key, that is, the list of source IPs allowed to use the key. If the key has never been configured, an empty list is returned, meaning the source IP is not restricted.

<Info>
  The IP access policy applies to model invocation endpoints only. When the source IP of a request is not in the allowed list, the model call is rejected; management endpoints (including these IP access policy read/write endpoints, billing queries, Sandbox, etc.) are not restricted by source IP.
</Info>

## Permissions

| Role          | Access                                                     |
| :------------ | :--------------------------------------------------------- |
| Owner / Admin | Can query the IP access policy of any API key in the team. |
| Developer     | Can query only keys they own.                              |
| Basic         | Can query only keys they own.                              |
| Billing       | Can query the IP access policy of any API key in the team. |

The target API key must belong to the caller's team. When querying a key that the caller has no permission for or that does not belong to the team, the endpoint does not reveal whether the target key exists and returns a permission error uniformly.

## Request Headers

<ParamField header="Authorization" type="string" required={true}>
  Bearer authentication format, for example: Bearer \{\{API Key}}.
</ParamField>

## Path Parameters

<ParamField path="stringId" type="string" required={true}>
  The stringId of the target API key.
</ParamField>

## Response Parameters

<ResponseField name="stringId" type="string" required={true}>
  The stringId of the API key.
</ResponseField>

<ResponseField name="policy" type="object" required={true}>
  The IP access policy object.

  <Expandable title="properties" defaultOpen={true}>
    <ResponseField name="allowedIps" type="string[]" required={true}>
      The list of allowed source IPs. Each entry is an IPv4 address or an IPv4 CIDR range. An empty list means the source IP is not restricted.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="policyStatus" type="string" required={true}>
  Policy status. Value: `active`.
</ResponseField>

<ResponseField name="allowedIpCount" type="int" required={true}>
  The number of allowed IP entries. `0` means the source IP is not restricted.
</ResponseField>

<ResponseField name="updatedAt" type="string" required={true}>
  The last update time, in ISO 8601 format. Empty string if never configured.
</ResponseField>

<ResponseField name="updatedBy" type="string" required={true}>
  The user UUID of the last operator. Empty string if never configured.
</ResponseField>

<RequestExample>
  ```bash theme={"system"}
  curl --request GET \
    --url https://api.novita.ai/openapi/v2/user/key/<stringId>/ip-access-policy \
    --header 'Authorization: Bearer <API_KEY>'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 (with allowed IPs configured) theme={"system"}
  {
    "stringId": "key_xxx",
    "policy": {
      "allowedIps": ["203.0.113.5", "198.51.100.0/24"]
    },
    "policyStatus": "active",
    "allowedIpCount": 2,
    "updatedAt": "2026-08-13T10:20:30Z",
    "updatedBy": "a3f1c9e2-5b7d-4e81-9c34-2f6a8d0b1e57"
  }
  ```

  ```json 200 (not configured, source IP not restricted) theme={"system"}
  {
    "stringId": "key_xxx",
    "policy": {
      "allowedIps": []
    },
    "policyStatus": "active",
    "allowedIpCount": 0,
    "updatedAt": "",
    "updatedBy": ""
  }
  ```
</ResponseExample>