Book a demo

check_ip_allowlist

Check my address against an org's IP allowlist

read scalar tenant-private since 2026-10-01

Answers the address this request came from, as the org's IP allowlist reads it, whether the allowlist allows it and which range does, the allowlist's mode and who it applies to, and whether enforce mode is available on this deployment.

Contract

shape
scalar
authority
read
evidence
none
subscription
false
permission
any one of: org.member (carried by the caller's role template in the org `org_id`); a deactivated caller is refused first
idempotency
safe
emits
none
MCP tool
check_ip_allowlist
REST
POST https://api.containertradehq.com/v1/cap/check_ip_allowlist

Idempotency: a read: calling again changes nothing

Inputs

nametyperequiredvalidation
org_idorg_idrequiredtradehq-org-id; 1 to 20 characters
The org whose IP allowlist to check this request's address against.

Response

  • org_id · string · The org.
  • address · stringnull · This request's client address, IPv4-mapped IPv6 read as IPv4; null when none could be read.
  • via · string · cloudflare: Cloudflare's CF-Connecting-IP, from Cloudflare with the origin-auth header. edge: the address the request reached front-door from.
  • in_list · boolean · Whether a range of the allowlist covers the address.
  • entry · objectnull · The range that covers the address, {cidr, label}; null when none does.
  • mode · string · The allowlist's mode.
  • applies_to · string · Who the allowlist checks.
  • enforce_available · boolean · Whether enforce mode can be set on this deployment: front-door's ingress self-check.
  • ingress · object · The self-check's parts: ingress_authenticated, origin_auth_configured, generated_domain (unknown, absent, refuses or serves) and cloudflare_seen.
Full JSON Schema 
{
  "type": "object",
  "properties": {
    "org_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 20,
      "pattern": "^[A-Za-z0-9_-]{1,20}$",
      "format": "tradehq-org-id",
      "description": "The org.",
      "x-data-class": "operational"
    },
    "address": {
      "type": [
        "string",
        "null"
      ],
      "description": "This request's client address, IPv4-mapped IPv6 read as IPv4; null when none could be read.",
      "x-data-class": "operational"
    },
    "via": {
      "type": "string",
      "enum": [
        "cloudflare",
        "edge"
      ],
      "description": "cloudflare: Cloudflare's CF-Connecting-IP, from Cloudflare with the origin-auth header. edge: the address the request reached front-door from.",
      "x-data-class": "operational"
    },
    "in_list": {
      "type": "boolean",
      "description": "Whether a range of the allowlist covers the address.",
      "x-data-class": "operational"
    },
    "entry": {
      "type": [
        "object",
        "null"
      ],
      "description": "The range that covers the address, {cidr, label}; null when none does.",
      "x-data-class": "operational"
    },
    "mode": {
      "type": "string",
      "enum": [
        "off",
        "monitor",
        "enforce"
      ],
      "description": "The allowlist's mode.",
      "x-data-class": "operational"
    },
    "applies_to": {
      "type": "string",
      "enum": [
        "members",
        "api_keys",
        "both"
      ],
      "description": "Who the allowlist checks.",
      "x-data-class": "operational"
    },
    "enforce_available": {
      "type": "boolean",
      "description": "Whether enforce mode can be set on this deployment: front-door's ingress self-check.",
      "x-data-class": "operational"
    },
    "ingress": {
      "type": "object",
      "description": "The self-check's parts: ingress_authenticated, origin_auth_configured, generated_domain (unknown, absent, refuses or serves) and cloudflare_seen.",
      "x-data-class": "operational"
    }
  },
  "required": [
    "org_id",
    "address",
    "via",
    "in_list",
    "entry",
    "mode",
    "applies_to",
    "enforce_available",
    "ingress"
  ],
  "additionalProperties": false
}

Refusals

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
  • Voice: degraded: visualization
  • Push: emits nothing
  • OneBox: no document originates a network check
  • Outbound: crosses to no counterparty

Events

None emitted.

Related

None.