API Internet BankingSecurity

Replace a credential's IP allowlist

Takes the whole set. **Removals apply immediately; additions wait 18h** (`pendingUntil`). If every entry is new, the old list keeps applying during the grace period — the intent there is changing IPs, not being locked out. Rejects an empty list, more than 20 entries, `0.0.0.0/0` and any prefix wider than `/24` (`422 ip_allowlist_required`).

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Path parameters

tenantIdstringRequired

Tenant identifier (same value as X-Tenant-Id).

clientIdstringRequired

Credential (client_id) the subresource belongs to.

Headers

X-Tenant-IdstringRequired
Tenant context used for authorization and routing.
Idempotency-KeystringOptional

Optional client-generated idempotency token (recommended for safe retries).

X-Request-TimestampstringRequired

Unix seconds. Required on the signed host; tolerance is 300s either way (403 request_timestamp_skew).

X-Content-SHA256stringRequired

Lowercase hex SHA-256 of the body. An empty body hashes the empty string, so the header is always present. Mismatch returns 400 body_hash_mismatch.

X-Request-SignaturestringRequired

Detached JWS (<protected>..<signature>, ES256 or PS256) over METHOD\nPATH?QUERY\nTIMESTAMP\nIDEMPOTENCY_KEY_OR_EMPTY\nX_CONTENT_SHA256.

Request

This endpoint expects an object.
ipslist of stringsRequired

Response

Allowlist stored.
clientIdstring
ipslist of strings
The set in force right now.
pendingIpslist of stringsOptional

Complete set that takes over at pendingUntil (additions wait 18h).

pendingUntildatetimeOptional

Errors

403
Forbidden Error
422
Unprocessable Entity Error