# Restrict API access from ip ranges or countries **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** apis, sailpoint-identity-security\ **Created:** [June 26, 2024, 7:33pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223 "2024-06-26T19:33:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\ **Post date:** [June 26, 2024, 7:33pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/1 "2024-06-26T19:33:21Z")
Hi! I would like to restrict ISC API clients from certain IP address, or by country, as it can be done with identity profiles. If I use PAT generated for some identity, the restrictions configured on identity profile also applies to API access? For example, I add Argentina to the white list countries, then check the identity now identity profiles untrusted geographies. ISC admins from Argentina only will be able to log in to ISC console. If one of these identityes has a PAT which some API client uses, it also is restricted to be used only from Argentina? ---
**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\ **Post date:** [June 26, 2024, 7:47pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/2 "2024-06-26T19:47:17Z")
Hi @jsosa This is a very good use case, thanks for posting. We have not yet implemented this, but I would say PAT should not work for APIs. If it works then there is no point of the restrictions. As we basically perform same operations through UI or API. Some may not be feasible in UI. Anyway, would like to test this. Thanks Krish ---
**Author:** ![arjun\_sengupta](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/arjun_sengupta/32/3594_2.png) [@arjun\_sengupta](https://developer.sailpoint.com/discuss/u/arjun_sengupta)\ **Post date:** [June 27, 2024, 3:06am UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/3 "2024-06-27T03:06:28Z")
I dont think any restrictions apply on PAT. We need to get feedback from Sailpoint. ---
**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\ **Post date:** [June 27, 2024, 12:50pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/4 "2024-06-27T12:50:28Z")
Hi Krishna! I finally could test it with my demo tenant (I think it will work the same with clients tenants). Confirmed, when I restrict by my country (argentina), I can not access to UI, but API still works fine, so restrictinos does not apply. ---
**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\ **Post date:** [June 27, 2024, 4:04pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/5 "2024-06-27T16:04:01Z")
Hi @jsosa, If you configure restriction based on ip adresses or country. This will take effect only if you applied it in chosen Identity profile. This restriction will only apply to identities of identity profiles that you enables the restrictions. And this restriction is applied in all authentication (from ui or api) (message: bad credential / unthorized location). If your api work after applied restriction that mean your token is generated before applying but if you try to generate it doesn’t work. But all identity coming from identity profiles that restrictions are not enabled, restriction is not applied and they can authentificate from anywhere. Also if you configure restriction you must allow also your tenant region country and / or Sailpoint public ip addresses for ISC SaaS connector , Workflow and other Sailpoint SaaS service. [IP Address Allow List | SailPoint Developer Community](https://developer.sailpoint.com/docs/guides/ip-address-allow-list/) ---
**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\ **Post date:** [June 27, 2024, 6:31pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/6 "2024-06-27T18:31:40Z")
Hi @baoussounda you are totally right. I use Postman collection to test, and as the time expiration was not reached yet, it was using a token at the moment on which user was not in black list. Now I forced to bypass expiration times, and when script sends the authentication call, it receives: ```auto {"error":"invalid_client","error_description":"Bad client credentials"} ``` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [August 26, 2024, 6:31pm UTC](https://developer.sailpoint.com/discuss/t/restrict-api-access-from-ip-ranges-or-countries/69223/7 "2024-08-26T18:31:53Z")
Closed on August 26, 2024, 6:31pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.