IP Filtering (Optional)

Before you start

Make sure you have the following:

• The appropriate permissions to access the Developer Workbench in the RiskOS™ Dashboard.
• The IP addresses or domain names you want to allowlist.

How it works

RiskOS™ supports optional IP allowlisting to provide an extra layer of network-level security. Allowlisting restricts access to trusted network ranges — even if valid credentials are presented.

📘
Note:
IP allowlisting is an optional security control, not a requirement for API or Dashboard access. It defines where requests are allowed from, while your API key defines who is making the request.

RiskOS™ allows you to define an allowlist for the following:

• API Key IPs
  Define the IP addresses and domains that can call the RiskOS™ APIs.
  Only API requests from IP addresses added to the list will be allowed.

• Dashboard IPs
  Control access to the RiskOS™ Dashboard, including any components loaded from external services.
  Only IPs added to the list will be allowed access.

Configure your allowlist

To configure which IPs or domains can access the APIs:

1. Go to the Developer Workbench > IP Filterings section in the RiskOS™ Dashboard.
   • Manage Sandbox IP allowlist.
   • Manage Production IP allowlist.
2. In the API Keys IPs tab, click Add IP/CIDR filter.
3. Enter the IP addresses or domains, separated by commas, into the Domain Name field.
4. Click Save.

To configure IP or domain access to the RiskOS™ Dashboard:

1. Go to the Developer Workbench > IP Filterings section in the RiskOS™ Dashboard.
   • Manage Sandbox IP allowlist.
   • Manage Production IP allowlist.
2. In the Dashboard IPs tab, click Add Domain Filter.
3. Enter the IP addresses or domains, separated by commas, into the IP/Domains field.
4. Click Create.

📘
Note:
IP addresses or domains added to the Dashboard IPs list apply across all environments. Make sure to add your own IP or domain first to avoid being locked out of the RiskOS™ Dashboard.

Supported formats

Allowed

You can allowlist the following types of entries:

• Valid IPv4 addresses (e.g., 203.0.113.42)
• Valid IPv4 addresses with CIDR masks (e.g., 203.0.113.0/24)
• Internet-routable IP addresses only (i.e., no private or loopback IPs)
• Valid domain names including:
  • www.example-domain.com
  • https://www.example-domain.com
  • https://example-domain.com
  • example-domain.com

Not allowed

The following entry types are not allowed:

• Private or loopback IPs:
  • 192.168.1.*
  • localhost
  • 127.0.0.1
  • ::1/128
• Empty strings

Remove an IP address or domain

To remove an entry from the allowlist:

1. Click the trash can icon next to the entry.
2. In the confirmation dialog, click Yes.

RiskOS™ removes the IP address or domain from the allowlist immediately.

Updated about 2 months ago