Latest Content

How to Manage Vultr API Access Control for Users

Updated on 18 August, 2026

Manage the IP allowlist for an organization user in Vultr IAM to restrict which IP addresses and subnets can authenticate to the Vultr API on their behalf.

Access control restricts which IP addresses and subnets can authenticate to the Vultr API on a user's behalf. Every user's allowlist includes two default entries, Any IPv4 (0.0.0.0/0) and Any IPv6, that permit all addresses. Disable these default entries and add specific subnets to restrict API access to trusted networks only.

Follow this guide to manage API access control for a user using the Vultr Console or the Vultr API.

Note
Use a root user account or a user with the Manage Users permission on the organization.
  • Vultr Console
  • Vultr API

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar.

  3. Click Manage Organization.

  4. Click Users.

  5. Click the user you want to manage access control for.

  6. Under API Access, locate the Access Control List section.

  7. Click Add IP to Allowlist.

  8. Enter the Subnet Address and Prefix you want to permit. The subnet address accepts an IPv4 or IPv6 address.

  9. Click Add Subnet.

    The subnet appears in the Access Control List table.

To remove a custom entry, click the Delete icon next to the entry and click Remove to confirm. To disable the default Any IPv4 or Any IPv6 entries, click the toggle icon next to the entry.

Note
Disabling both default entries without adding a replacement subnet blocks all API access for the user. Add at least one trusted subnet before disabling the default entries.

  1. Send a GET request to the List Users endpoint to retrieve all users and note the target user's id.

    console 
    $ curl "https://api.vultr.com/v2/users" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

  2. Send a POST request to the Add IP to User Allowlist endpoint to add a subnet to the user's allowlist. Replace {user-id} with the id from the previous step, SUBNET-ADDRESS with the IPv4 or IPv6 address, and SUBNET-SIZE with the subnet prefix size.

    console 
    $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
    -X POST \
    -H "Authorization: Bearer ${VULTR_API_KEY}" \
    -H "Content-Type: application/json" \
    -d '{
        "subnet": "SUBNET-ADDRESS",
        "subnet_size": SUBNET-SIZE
    }'

  3. Send a GET request to the List User Allowlist endpoint to retrieve the user's allowlist entries. Replace {user-id} with the user id.

    console 
    $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    Verify that the new subnet appears in the response.

  4. Send a DELETE request to the Remove IP from User Allowlist endpoint to remove a subnet from the user's allowlist. Replace {user-id} with the user id, SUBNET-ADDRESS with the subnet address, and SUBNET-SIZE with the subnet prefix size to remove.

    console 
    $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
    -X DELETE \
    -H "Authorization: Bearer ${VULTR_API_KEY}" \
    -H "Content-Type: application/json" \
    -d '{
        "subnet": "SUBNET-ADDRESS",
        "subnet_size": SUBNET-SIZE
    }'
Note
The Any IPv4 and Any IPv6 default entries shown in the Vultr Console represent the implicit allow-all state when no restrictive subnets exist. They are not returned as individual entries by the Vultr API.

Comments