Network Policies
Network policies are named IP allow and deny lists that control where API tokens, MCP servers, and users may connect from. A policy takes effect only once it is assigned — through _networkPolicyId on an API token or MCP server, or in account settings for workspace-user and end-user sign-in — and each environment (production or sandbox) keeps its own library of policies. Network policies must be enabled for the account, and only the account owner and administrators can manage them.
Network policy schema
Returns the policies of the caller's environment, most recently modified first. Policies in the recycle bin are not included. The include and exclude projection parameters used by other list endpoints are not supported here.
Maximum number of policies to return per page.
100Field to order the page by. lastModified lists the most recently changed
policy first; name lists alphabetically.
namePossible values: Opaque cursor for forward pagination. Pass the value from the Link
response header (rel="next") to fetch the next page.
Array of network policies.
No network policies exist in this environment.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/networkpolicies HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "6ab1f501b9e454749402c749",
"_userId": "624cb0346309dc3a543733a2",
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5/32",
"2001:db8::/32"
],
"ipDenyList": [
"198.51.100.0/24"
],
"createdAt": "2026-09-22T03:24:49.115Z",
"lastModified": "2026-09-22T03:27:28.318Z"
},
{
"_id": "6ab1ebbfb9e4547494ff7558",
"_userId": "624cb0346309dc3a543733a2",
"name": "Block known scanners",
"ipAllowList": [],
"ipDenyList": [
"198.51.100.7/32",
"192.0.2.0/24"
],
"createdAt": "2026-09-22T02:45:19.304Z",
"lastModified": "2026-09-22T02:45:19.304Z"
}
]Creates a policy in the caller's environment. Entries in both lists are validated and stored in normalized form — a bare address becomes /32 or /128, IPv6 is compressed — and the response shows the stored values. The new policy restricts nothing until it is assigned to an API token, an MCP server, or account sign-in.
Request body for creating or replacing a network policy.
Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
Corporate VPN egressExplains what the policy is for and where its ranges come from. Omit on PUT to clear it.
Office and VPN egress ranges. Deny beats allow.Source addresses permitted to connect. Each entry is an IPv4 or IPv6 address
or CIDR range; bare addresses are stored as /32 or /128. Leave empty to
permit every address that ipDenyList does not block. Omitting the field on
PUT empties the list.
["10.0.0.0/8","203.0.113.5","2001:db8::/32"]Source addresses refused even when ipAllowList permits them. Same entry
format as ipAllowList; deny always wins over allow. Omitting the field on
PUT empties the list.
["198.51.100.0/24"]Created network policy, with entries in stored form.
Network policy as returned by the API.
Unique identifier for the network policy.
6ab1f501b9e454749402c749Environment that owns the policy — the account user for production, or the sandbox user for a policy created there. A policy is visible and assignable only within its own environment.
624cb0346309dc3a543733a2Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
Corporate VPN egressExplains what the policy is for. Absent when the policy has no description.
Office and VPN egress ranges. Deny beats allow.Source addresses permitted to connect, each an IPv4 or IPv6 address or CIDR
range in stored form (bare addresses carry /32 or /128). An empty list
permits every address that ipDenyList does not block.
["10.0.0.0/8","203.0.113.5/32","2001:db8::/32"]Source addresses refused even when ipAllowList permits them. Same entry
format and stored form as ipAllowList; deny always wins over allow.
["198.51.100.0/24"]Timestamp when the policy was created.
2026-09-22T03:24:49.115ZTimestamp when the policy was last modified. Updated on every PUT and PATCH that changes a field.
2026-09-22T03:27:28.318ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Conflict. Another policy in this environment that is not in the recycle bin
already uses the requested name.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/networkpolicies HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 187
{
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5",
"2001:db8::/32"
],
"ipDenyList": [
"198.51.100.0/24"
]
}{
"_id": "6ab1f501b9e454749402c749",
"_userId": "624cb0346309dc3a543733a2",
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5/32",
"2001:db8::/32"
],
"ipDenyList": [
"198.51.100.0/24"
],
"createdAt": "2026-09-22T03:24:49.115Z",
"lastModified": "2026-09-22T03:24:49.115Z"
}Returns a single policy from the caller's environment. A policy that has been moved to the recycle bin, or that belongs to another environment, returns 404.
Network policy ID.
6ab1f501b9e454749402c749Network policy.
Network policy as returned by the API.
Unique identifier for the network policy.
6ab1f501b9e454749402c749Environment that owns the policy — the account user for production, or the sandbox user for a policy created there. A policy is visible and assignable only within its own environment.
624cb0346309dc3a543733a2Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
Corporate VPN egressExplains what the policy is for. Absent when the policy has no description.
Office and VPN egress ranges. Deny beats allow.Source addresses permitted to connect, each an IPv4 or IPv6 address or CIDR
range in stored form (bare addresses carry /32 or /128). An empty list
permits every address that ipDenyList does not block.
["10.0.0.0/8","203.0.113.5/32","2001:db8::/32"]Source addresses refused even when ipAllowList permits them. Same entry
format and stored form as ipAllowList; deny always wins over allow.
["198.51.100.0/24"]Timestamp when the policy was created.
2026-09-22T03:24:49.115ZTimestamp when the policy was last modified. Updated on every PUT and PATCH that changes a field.
2026-09-22T03:27:28.318ZUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/networkpolicies/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"_id": "6ab1f501b9e454749402c749",
"_userId": "624cb0346309dc3a543733a2",
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5/32",
"2001:db8::/32"
],
"ipDenyList": [
"198.51.100.0/24"
],
"createdAt": "2026-09-22T03:24:49.115Z",
"lastModified": "2026-09-22T03:27:28.318Z"
}Replaces the policy with the request body. Fields left out are cleared: an omitted description is removed and an omitted ipAllowList or ipDenyList becomes empty, which lifts every restriction that list imposed. Entries are validated and normalized exactly as on create. The change applies to every token, MCP server, and sign-in setting the policy is assigned to.
Network policy ID.
6ab1f501b9e454749402c749Request body for creating or replacing a network policy.
Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
Corporate VPN egressExplains what the policy is for and where its ranges come from. Omit on PUT to clear it.
Office and VPN egress ranges. Deny beats allow.Source addresses permitted to connect. Each entry is an IPv4 or IPv6 address
or CIDR range; bare addresses are stored as /32 or /128. Leave empty to
permit every address that ipDenyList does not block. Omitting the field on
PUT empties the list.
["10.0.0.0/8","203.0.113.5","2001:db8::/32"]Source addresses refused even when ipAllowList permits them. Same entry
format as ipAllowList; deny always wins over allow. Omitting the field on
PUT empties the list.
["198.51.100.0/24"]Updated network policy, with entries in stored form.
Network policy as returned by the API.
Unique identifier for the network policy.
6ab1f501b9e454749402c749Environment that owns the policy — the account user for production, or the sandbox user for a policy created there. A policy is visible and assignable only within its own environment.
624cb0346309dc3a543733a2Display name shown wherever a policy is picked or listed. Unique among the environment's policies that are not in the recycle bin.
Corporate VPN egressExplains what the policy is for. Absent when the policy has no description.
Office and VPN egress ranges. Deny beats allow.Source addresses permitted to connect, each an IPv4 or IPv6 address or CIDR
range in stored form (bare addresses carry /32 or /128). An empty list
permits every address that ipDenyList does not block.
["10.0.0.0/8","203.0.113.5/32","2001:db8::/32"]Source addresses refused even when ipAllowList permits them. Same entry
format and stored form as ipAllowList; deny always wins over allow.
["198.51.100.0/24"]Timestamp when the policy was created.
2026-09-22T03:24:49.115ZTimestamp when the policy was last modified. Updated on every PUT and PATCH that changes a field.
2026-09-22T03:27:28.318ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Conflict. Another policy in this environment that is not in the recycle bin
already uses the requested name.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PUT /v1/networkpolicies/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 203
{
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5",
"2001:db8::/32",
"172.16.0.0/12"
],
"ipDenyList": [
"198.51.100.0/24"
]
}{
"_id": "6ab1f501b9e454749402c749",
"_userId": "624cb0346309dc3a543733a2",
"name": "Corporate VPN egress",
"description": "Office and VPN egress ranges. Deny beats allow.",
"ipAllowList": [
"10.0.0.0/8",
"203.0.113.5/32",
"2001:db8::/32",
"172.16.0.0/12"
],
"ipDenyList": [
"198.51.100.0/24"
],
"createdAt": "2026-09-22T03:24:49.115Z",
"lastModified": "2026-09-22T03:30:21.527Z"
}Moves the policy to the recycle bin, where it is retained for 30 days and can be restored. A policy that is still assigned to an API token, MCP server, or account sign-in setting is not deleted: the request fails with 409 network_policy_in_use and info lists every assignment. Repeat with force=true to clear those assignments and delete the policy — every principal it was assigned to loses the restriction. Use GET /v1/networkpolicies/{_id}/dependencies to review the assignments first.
Network policy ID.
6ab1f501b9e454749402c749When true, clears the policy from every API token, MCP server, and account sign-in setting it is assigned to, then deletes it. Without it, an assigned policy returns 409 and nothing changes.
falseExample: trueNetwork policy moved to the recycle bin.
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Conflict. The policy is still assigned to at least one API token, MCP server, or
account sign-in setting, so it was not deleted. info lists every assignment;
repeat the request with force=true to clear them and delete the policy.
DELETE /v1/networkpolicies/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Partially updates a policy with a JSON Patch document (RFC 6902). Fields the document does not touch are preserved, unlike PUT. Whitelisted paths:
/name
add, replace
/description
add, replace, remove
/ipAllowList, /ipDenyList
replace the whole list
/ipAllowList/-, /ipDenyList/-
add one entry at the end
/ipAllowList/{index}, /ipDenyList/{index}
add or replace one entry
Entries are validated and normalized exactly as on create. move, copy, and test on /name or either list return 400 invalid_patch_operation; removing a single list entry by index is not supported (422) — replace the whole list instead. Any other path returns 422.
Network policy ID.
6ab1f501b9e454749402c749A JSON Patch document (RFC 6902). Send an array of patch operations on whitelisted fields — all other paths are rejected with 422.
The operation to perform.
JSON Pointer (RFC 6901) to the field to patch. Only
whitelisted paths are accepted — unlisted paths return
422 with "<path> is not a whitelisted property".
The new value to set. Required for replace and add, omit for remove.
Network policy patched.
No content
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Conflict. Another policy in this environment that is not in the recycle bin
already uses the requested name.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PATCH /v1/networkpolicies/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 71
[
{
"op": "replace",
"path": "/name",
"value": "Corporate VPN egress (2026)"
}
]No content
Returns every API token, MCP server, and account sign-in setting the policy is assigned to within its own environment. Call it before DELETE to see what a force=true delete would clear. Unlike other /dependencies endpoints, the response is a fixed object rather than a map keyed by resource type.
Network policy ID.
6ab1f501b9e454749402c749Assignments of the policy. All keys are present even when the policy is unassigned.
Every place a network policy is assigned within its own environment. All four
keys are always present; an unassigned policy returns empty arrays and false
flags.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/networkpolicies/{_id}/dependencies HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"mcpservers": [
{
"_id": "6ab1f4a95af4c5a3ea6b0a28",
"name": "Order lookup MCP server"
}
],
"accesstokens": [],
"account": {
"workspaceUsers": false,
"workspaceUserEnvironments": [],
"endUsers": false,
"endUserEnvironments": []
}
}Returns the change history for a network policy, newest first. Each entry records one event with who made the change, when, and which fields were affected. Entries survive the policy's deletion and purge; the route itself returns 404 once the policy has been purged, so use GET /v1/audit?resourceType=networkpolicy to read the history of a purged policy.
Network policy ID.
6ab1f501b9e454749402c749Maximum number of audit entries to return per page.
1000Example: 100Opaque pagination cursor for the next page. Take it from the after value in the Link
response header's rel="next" URL rather than constructing it.
W3siJGRhdGUiOiIyMDI2LTA5LTIyVDAzOjI3OjEwLjM5N1oifSwiNmFiMWY1OGU0ZGI1Njg4ZmQ4Y2FjMTc5Il0Only return entries at or after this timestamp.
2026-09-01T00:00:00.000ZOnly return entries at or before this timestamp.
2026-09-30T23:59:59.999ZFilter by the change type. Maps to the event field on each entry.
updatePossible values: Filter by how the change was initiated.
apiPossible values: Filter to changes performed by a single user.
624cb0346309dc3a543733a2Array of audit entries, newest first.
No audit entries exist for this network policy.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/networkpolicies/{_id}/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "6ab1f5a0b9e454749402f002",
"resourceType": "networkpolicy",
"_resourceId": "6ab1f501b9e454749402c749",
"source": "api",
"event": "update",
"time": "2026-09-22T03:27:28.318Z",
"byUser": {
"_id": "624cb0346309dc3a543733a2",
"email": "user@example.com",
"name": "Jane Doe"
},
"fieldChanges": [
{
"fieldPath": "ipAllowList",
"oldValue": [
"10.0.0.0/8"
],
"newValue": [
"10.0.0.0/8",
"172.16.0.0/12"
]
}
]
},
{
"_id": "6ab1f501b9e454749402c752",
"resourceType": "networkpolicy",
"_resourceId": "6ab1f501b9e454749402c749",
"source": "api",
"event": "create",
"time": "2026-09-22T03:24:49.115Z",
"byUser": {
"_id": "624cb0346309dc3a543733a2",
"email": "user@example.com",
"name": "Jane Doe"
},
"fieldChanges": []
}
]Last updated
Was this helpful?