Authentication
Send an API key as a bearer token. This endpoint does not state a specific permission in the specification, so give your key the least it needs and check the response rather than assuming.
Where your organisation id goes
This endpoint takes org_id as a query parameter. Leave it out and the call covers your whole tenancy subtree; send it to narrow the call to one organisation.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/ip-allow \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "cidr": <string>, "label": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Adds one entry. A bare address is normalised to a host network (`203.0.113.7` becomes `203.0.113.7/32`) so the list holds one shape and you cannot add the same fact twice in two spellings. `0.0.0.0/0` and `::/0` are refused, and so is any prefix broader than /8 (IPv4) or /32 (IPv6): an entry that admits the whole internet is the same as having no allow-list, while reading on screen as though something is protected.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
org_id (query) | string | No | The organization to act on. Omitted (or empty) means your own. A reseller managing a client org must name it - defaulting silently would edit the reseller's own list while the s… |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
cidr | string | Yes | An address or a CIDR range. `0.0.0.0/0` and `::/0` are refused, as is anything broader than /8 (IPv4) or /32 (IPv6). Both families are checked - rejecting only the IPv4 literal… |
label | string | Yes | — |
expires_at | string | No | — |
enabled | boolean | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | string | Yes | — |
scope | string<staff_infra, staff_site, customer_site> | Yes | — |
cidr | string | Yes | Canonical CIDR. A bare address is stored as a host network (`/32`, or `/128` for IPv6) so one column answers both "is this a range" and "does it contain X". |
label | string | Yes | Required. An unlabelled range is one nobody dares remove, which is how a list grows until it stops being a control. |
expires_at | string | No | null = permanent. An expired entry is NOT deleted - it stays visible and greyed so an operator can see what lapsed and re-add it. |
enabled | boolean | Yes | — |
expired | boolean | Yes | Computed server-side. Two surfaces deriving "is this still in force?" from a raw timestamp is two implementations of one decision, and they disagree on the boundary second. |
in_force | boolean | Yes | enabled AND not expired - the only field that decides anything. |
created_by | string | Yes | Audit ref of whoever added it (`user:<id>` / `apikey:<id>`). |
created_at | string | Yes | — |