---
title: How to Manage Vultr API Access Control for Users
url: https://docs.vultr.com/platform/iam/organizations/manage-user-api-access/how-to-manage-vultr-api-access-control-for-users
description: Restrict which IP addresses and subnets can authenticate to the Vultr API for a user by editing their IP allowlist.
publish_date: 2026-08-18T20:18:32.624897Z
last_updated: 2026-10-23T20:28:21.086886Z
---

Access control restricts which IP addresses and subnets can authenticate to the Vultr API on a user's behalf. Every user's allowlist includes two default entries, **Any IPv4** (`0.0.0.0/0`) and **Any IPv6**, that permit all addresses. Disable these default entries and add specific subnets to restrict API access to trusted networks only.

Follow this guide to manage API access control for a user using the Vultr Console or the Vultr API.

> [!NOTE]
> Use a root user account or a user with the **Manage Users** permission on the organization.

=== "Vultr Console"

    1. Log in to the [Vultr Console](https://console.vultr.com).
    1. Click the organization name in the top navigation bar.
    1. Click **Manage Organization**.
    1. Click **Users**.
    1. Click the user you want to manage access control for.
    1. Under **API Access**, locate the **Access Control List** section.
    1. Click **Add IP to Allowlist**.
    1. Enter the **Subnet Address** and **Prefix** you want to permit. The subnet address accepts an IPv4 or IPv6 address.
    1. Click **Add Subnet**.

        The subnet appears in the **Access Control List** table.

    To remove a custom entry, click the **Delete** icon next to the entry and click **Remove** to confirm. To disable the default **Any IPv4** or **Any IPv6** entries, click the toggle icon next to the entry.

    > [!NOTE]
    > Disabling both default entries without adding a replacement subnet blocks all API access for the user. Add at least one trusted subnet before disabling the default entries.

=== "Vultr API"

    1. Send a `GET` request to the [**List Users** endpoint](https://www.vultr.com/api/#tag/users/operation/list-users) to retrieve all users and note the target user's `id`.

        ```console
        $ curl "https://api.vultr.com/v2/users" \
            -X GET \
            -H "Authorization: Bearer ${VULTR_API_KEY}"
        ```

    1. Send a `POST` request to the [**Add IP to User Allowlist** endpoint](https://www.vultr.com/api/#tag/users/operation/add-user-ip-whitelist) to add a subnet to the user's allowlist. Replace `{user-id}` with the id from the previous step, `SUBNET-ADDRESS` with the IPv4 or IPv6 address, and `SUBNET-SIZE` with the subnet prefix size.

        ```console
        $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
            -X POST \
            -H "Authorization: Bearer ${VULTR_API_KEY}" \
            -H "Content-Type: application/json" \
            -d '{
                "subnet": "SUBNET-ADDRESS",
                "subnet_size": SUBNET-SIZE
            }'
        ```

    1. Send a `GET` request to the [**List User Allowlist** endpoint](https://www.vultr.com/api/#tag/users/operation/list-user-ip-whitelist) to retrieve the user's allowlist entries. Replace `{user-id}` with the user id.

        ```console
        $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
            -X GET \
            -H "Authorization: Bearer ${VULTR_API_KEY}"
        ```

        Verify that the new subnet appears in the response.

    1. Send a `DELETE` request to the [**Remove IP from User Allowlist** endpoint](https://www.vultr.com/api/#tag/users/operation/remove-user-ip-whitelist) to remove a subnet from the user's allowlist. Replace `{user-id}` with the user id, `SUBNET-ADDRESS` with the subnet address, and `SUBNET-SIZE` with the subnet prefix size to remove.

        ```console
        $ curl "https://api.vultr.com/v2/users/{user-id}/ip-whitelist" \
            -X DELETE \
            -H "Authorization: Bearer ${VULTR_API_KEY}" \
            -H "Content-Type: application/json" \
            -d '{
                "subnet": "SUBNET-ADDRESS",
                "subnet_size": SUBNET-SIZE
            }'
        ```

    > [!NOTE]
    > The **Any IPv4** and **Any IPv6** default entries shown in the Vultr Console represent the implicit allow-all state when no restrictive subnets exist. They are not returned as individual entries by the Vultr API.