## Before you start

Make sure you have the following:

- The appropriate permissions to access the **Developer Workbench** in the RiskOS™ Dashboard.
- The IP addresses or domain names you want to allowlist.

## How it works

RiskOS™ supports **optional** IP allowlisting to provide an extra layer of network-level security. Allowlisting restricts access to trusted network ranges — even if valid credentials are presented.

> 📘  
> **Note**:  
> IP allowlisting is an **optional security control**, not a requirement for API or Dashboard access. It defines **where** requests are allowed from, while your API key defines **who** is making the request.

RiskOS™ allows you to define an allowlist for the following:

- **API Key IPs**  
  Define the IP addresses and domains that can call the RiskOS™ APIs.  
  Only API requests from IP addresses added to the list will be allowed.

- **Dashboard IPs**  
  Control access to the RiskOS™ Dashboard, including any components loaded from external services.  
  Only IPs added to the list will be allowed access.

### Configure your allowlist

To configure which IPs or domains can access the APIs:

1. Go to the **Developer Workbench > IP Filterings** section in the RiskOS™ Dashboard.
   - [Manage Sandbox IP allowlist](https://riskos.sandbox.socure.com/developers/ip-filtering).
   - [Manage Production IP allowlist](https://riskos.socure.com/developers/ip-filtering).
2. In the **API Keys IPs** tab, click **Add IP/CIDR filter**.
3. Enter the IP addresses or domains, separated by commas, into the **Domain Name** field.
4. Click **Save**.

To configure IP or domain access to the RiskOS™ Dashboard:

1. Go to the **Developer Workbench > IP Filterings** section in the RiskOS™ Dashboard.
   - [Manage Sandbox IP allowlist](https://riskos.sandbox.socure.com/developers/ip-filtering).
   - [Manage Production IP allowlist](https://riskos.socure.com/developers/ip-filtering).
2. In the **Dashboard IPs** tab, click **Add Domain Filter**.
3. Enter the IP addresses or domains, separated by commas, into the **IP/Domains** field.
4. Click **Create**.

> 📘  
> **Note**:  
> IP addresses or domains added to the **Dashboard IPs** list apply across all environments. Make sure to add **your own IP or domain first** to avoid being locked out of the RiskOS™ Dashboard.

## Supported formats

**Allowed**

You can allowlist the following types of entries:

- Valid IPv4 addresses (e.g., `203.0.113.42`)
- Valid IPv4 addresses with CIDR masks (e.g., `203.0.113.0/24`)
- Internet-routable IP addresses only (i.e., no private or loopback IPs)
- Valid domain names including:
  - `www.example-domain.com`
  - `https://www.example-domain.com`
  - `https://example-domain.com`
  - `example-domain.com`

**Not allowed**

The following entry types are not allowed:

- Private or loopback IPs:
  - `192.168.1.*`
  - `localhost`
  - `127.0.0.1`
  - `::1/128`
- Empty strings

## Remove an IP address or domain

To remove an entry from the allowlist:

1. Click the trash can icon next to the entry.
2. In the confirmation dialog, click **Yes**.

RiskOS™ removes the IP address or domain from the allowlist immediately.

Updated about 2 months ago