Within the scope of a single workspace, you can limit access to a pool of IP addresses. Users trying to access the profile from other addresses are denied.

## Checking IP policy

Method reference available [here](https://developers.synerise.com/IdentityandAccessManagement/IdentityandAccessManagement.html#operation/getUserBpIpPolicyUsingGET).

**Request:**

<pre><code class="language-plaintext">curl --location --request \
GET 'https://{SYNERISE_API_BASE_PATH}/uauth/settings/user-bp-ip-policy' \
--header 'Authorization: Bearer eyJhbGc..._tNS0B28LLHc'</code></pre>


The following response shows that IP access control is disabled.


<pre><code class="language-json">{
    "enabled": false,
    "enableSupportSubnets": true,
    "ipPolicy": []
}</code></pre>


## Updating IP policy

Method reference available [here](https://developers.synerise.com/IdentityandAccessManagement/IdentityandAccessManagement.html#operation/updateUserBpIpPolicyUsingPOST).

The following request enables IP allowlisting, with two addresses allowed. It also allows access from Synerise support subnets. The subnet IPs depend on the configuration.  

<div class="admonition admonition-important"><div class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2.5"><path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" /></svg></div><div class="admonition-body"><div class="admonition-content">

You must send a complete list of allowed IPs every time - if a list already exists, it is overwritten by the request.

</div></div></div>


<pre><code class="language-plaintext">curl --location --request \
POST 'https://{SYNERISE_API_BASE_PATH}/uauth/settings/user-bp-ip-policy' \
--header 'Authorization: Bearer eyJhbGc..._tNS0B28LLHc' \
--header 'Content-Type: application/json' \
--data-raw '{
    "enabled": true,
    "enableSupportSubnets": true,
    "ipPolicy": [
        "192.0.2.12",
        "192.0.2.15"
    ]
}'</code></pre>


The response includes the new settings:

<pre><code class="language-json">{
    "enabled": true,
    "enableSupportSubnets": true,
    "ipPolicy": [
        "192.0.2.12",
        "192.0.2.15"
    ]
}</code></pre>