How to allow IP addresses for API access
To keep your environment secure, the COS Business Engine API only accepts requests from approved IP addresses. Operators can now manage this list directly in Admin, and changes take effect within about a minute.
Who can manage the list
Users with the CO SuperAdmin or CO Administrator role at the operator. Service providers can’t edit the list themselves.
If you are a service provider
Send the public IP addresses your integration will call from to your operator, and say whether they’re for test, production or both. Your operator adds them for you. You also need an API user, which your operator creates for you.
If you are an operator
- In Admin, go to System > Partner API.
- In the IP allowlist section, click Add.
- Under IP address or range, enter a single address or a range.
- Under Label, enter who calls from it, for example the service provider’s name.
- Click Add. The address can call the API within about a minute.
Addresses you remove from the list lose access within about a minute.
Rules for addresses
• Public addresses only. Private and CGNAT ranges are not accepted.
• Ranges can be at most /24 for IPv4 and /48 for IPv6.
• Test and production are separate environments, so add the addresses in each one you need.
Good to know
The list applies to your whole environment. An approved IP address alone doesn’t give access to data, because every request also needs valid API user credentials.
Still getting “access denied”?
Check that the request comes from the exact public IP that was added, in the right environment, and that a minute has passed. If it still fails, contact support.