Can I restrict access to my Endor tenant to specific IP addresses (e.g., corporate VPN)?

Last updated: March 7, 2026

Context

Some organizations require that access to security platforms be limited to trusted network locations such as corporate VPNs or internal IP ranges.

Answer

Yes. Endor supports this through a tenant-level IP allowlist that restricts access based on the request’s source IP address. This applies generally and affects, for example, running scans, using the API, or using the Endor Labs web app.

The resource which controls this is IPAddressPolicy.

An IPAddressPolicy defines a set of allowed IP addresses or subnets. Requests originating from other IP addresses will be denied. The policy is enforced at the tenant level.

Configuring an IPAddressPolicy

Proceed with caution. The nature of this change is that an incorrect configuration will block your access to the tenant and will require Endor Labs support involvement to restore access.

Create an IPAddressPolicy using the Endor API. Example:

endorctl api create -r IPAddressPolicy n <tenant-name> \
  --data='{
        "meta": {
          "name": "corporate-vpn-policy"
        },
        "spec": {
          "allowed_ip_subnets": [
            "192.0.2.123",
            "203.0.113.0/24"
          ]
        }
      }'

Parameters

Field

Description

meta.name

Name of the policy

spec.allowed_ip_subnets

List of allowed IPv4 or IPv6 addresses or CIDR subnets

User-Facing Behavior

If a request originates from an IP address not included in the allowlist, the request will be denied .

Example CLI response:

endorctl api list -r Project -n my-tenant

ERROR endor-auth-failure: rpc error: code = PermissionDenied
desc = Access to this IP address 192.0.2.123 is not allowed

Users may still authenticate to the Web UI, but tenant resources will not be visible if the request originates from a blocked IP address. In other words, they can authenticate but will not be authorized to access any content.

Additional Notes

  • Policies apply at the tenant level and are not configurable per namespace.

  • Both individual IP addresses and CIDR subnets are supported.

  • The current limit is 64 entries.

  • Policy changes may take up to ~10 minutes to take effect.

  • The IP restriction also applies to scan execution. If a scan is triggered from an IP address that is not allowlisted, the request will be denied.