API Key Network Access
Set API Key IP Access Policy
PUT
Set or update the IP access policy of a single API key. This is a full replacement: after submission, the key’s allowed IPs are exactly the list you submit. To add a single IP, query the current list first, then submit it together with the new IP.
The IP access policy applies to model invocation endpoints only and does not affect these IP access policy read/write endpoints themselves. Even if the configured IPs do not include the current request source, you can still call this endpoint or the delete endpoint to change it back, so you cannot lock yourself out.
Permissions
The target API key must belong to the caller’s team. When setting a key that the caller has no permission for or that does not belong to the team, the endpoint does not reveal whether the target key exists and returns a permission error uniformly.
Request Headers
string
required
Enum:
application/jsonstring
required
Bearer authentication format, for example: Bearer {{API Key}}.
Path Parameters
string
required
The stringId of the target API key.
Request Body
string[]
required
The list of allowed source IPs, up to 100 entries. Each entry is an IPv4 address (e.g.
203.0.113.5) or an IPv4 CIDR range (e.g. 198.51.100.0/24). An empty array means the source IP is not restricted.Write validation:
- Each entry must be a valid IPv4 address or IPv4 CIDR range; IPv6, domain names, and wildcards are rejected.
0.0.0.0/0is rejected; use an empty array to express “not restricted”.- More than 100 entries is rejected.
- Duplicate entries are deduplicated by the server; the normalized result is authoritative.
- If any entry fails validation the whole request fails with no partial write. Validation failures return HTTP 400, with
messagedistinguishing the specific cause (invalid format / exceeds limit / all-zero range).
Response
The response has the same structure as Get API Key IP Access Policy, returning the normalized latest policy object.Last modified on September 1, 2026