When IP Restrictions are enabled in a ControlUp organization, they apply not only to user sign-in at app.controlup.com but also to REST API calls that use API keys or tokens for authentication. Initially, there was confusion about this behavior, with one party assuming that IP Restrictions only affected user sign-ins via the web application and would not restrict API calls. However, further investigation clarified that IP Restrictions do indeed apply to API requests.
The key issue encountered was that reporting workflows that fetch machine statistics via the REST API started returning “Unauthorized” errors after IP Restrictions were enabled. Although the API tokens used for authentication were verified as valid and not expired, the requests failed due to the IP restriction settings.
The resolution involves adding the public egress IP addresses of the systems making the API calls (such as those running the reporting workflows) to the organization’s IP Allow List in ControlUp. This setting is accessible under Settings → Security → IP Allow List in the ControlUp management console. Once the calling system’s IP addresses are added to the allow list, API calls from those IPs will be authorized, provided a valid API token is also used.
For more detailed guidance, official ControlUp documentation and references include the API endpoint for managing IP allow lists (https://api.controlup.io/reference/orgipallowlistpubliccontroller_create) and the knowledge base article on IP Allow Lists (https://support.controlup.com/docs/ip-allow-list). These resources offer comprehensive instructions for configuring the IP Allow List to control API access securely.
Read the entire ‘How IP Restrictions Affect REST API Access and How to Configure the IP Allow List in ControlUp’ thread below:
Hi Team,
I have a question. Will IP Restrictions be applied to the API calls as well?
No they won’t apply. Org IP Restrictions apply to user sign-in to app.controlup.com, not to REST API / API-key calls.
We have enabled the IP Restriction feature in our organization and post enabling it the reporting workflows which use the Rest API to fetch the data (Machine Statistics) is being failed with Unauthorized error.
We have checked the token with which it is using for authentication, and it is not expired.
Then I was wrong and we need to update the documentation. Apologies for this. Let me review the logic and come back to you.
Could you please check and share if this is included anywhere your internal documentation.
Yes. When IP Restrictions are enabled, they apply to REST/Public API calls as well — not only to sign-in in the web app. A valid, non-expired API token is still required, but the request must also come from an IP on your organization’s IP Allow List.
Please add the public egress IP address(es) of the system running your reporting workflows to Settings → Security → IP Allow List, then retry the API calls.
For reference:
•
• support.controlup.com/docs/ip-allow-list
Continue reading and comment on the thread ‘How IP Restrictions Affect REST API Access and How to Configure the IP Allow List in ControlUp’. Not a member? Join Here!
Categories: All Archives, ControlUp for VDI, ControlUp Workflows