/
IP Allow List Configuration for REST API Access

IP Allow List Configuration for REST API Access

This feature lets Jira admins restrict access to the Tables REST API endpoints to a specific set of IP addresses (or IP ranges). It is designed to reduce the risk of unauthorised access to your table data if an API token is exposed or misused.

What it protects

When configured, the allow list applies to these endpoints:

/rest/stj/1.0/api/table/**

If a request originates from an IP address not on the allow list, the app returns an HTTP 403 (Forbidden).

Default behaviour

  • If the allow list is empty, all IPs are allowed (no restriction).

  • If the allow list has at least one entry, only requests from the listed IPs (or ranges) are allowed.

Why you might use this

Common, sensible use cases:

  • You call the API from a fixed location (for example, your company’s integration server, VPN gateway, or CI runner with a static egress IP).

  • You want API access to work only through an approved network (for example, only via your office NAT, a secure proxy, or a dedicated integration environment).

  • You want an additional safety layer on top of API tokens, especially for enterprise compliance.

How to configure it

  1. Go to Jira settings → Apps → Manage apps.

  2. Find STAGIL Tables and To-do Checklists settings → Go to API tokens.

  3. In the top right corner, select Set IP allow list.

  4. Enter one or more IPv4/IPv6 addresses or ranges, separated by commas.

  5. Select Save.

If you leave the field empty, you are explicitly allowing requests from all IPs.

image-20260216-110350.png

Accepted formats

You can enter:

  • Single IPv4 address. Example: 203.0.113.10

  • Single IPv6 address. Example: 2001:db8::1

  • CIDR ranges (IPv4 or IPv6). Example (IPv4): 192.168.1.0/24. Example (IPv6): 2001:db8::/32

  • Multiple entries separated by commas. Example: 203.0.113.10, 203.0.113.0/24, 2001:db8::/32

We check and validate the format and display an error when any entry is invalid.

REST API endpoints for the allow list

You can also manage the IP allow list via the REST API.

To retrieve the current entries for the active token, use:

GET /rest/stj/1.0/api/allowlist

To add one or more IP addresses or CIDR ranges, use:

POST /rest/stj/1.0/api/allowlist

To remove a specific entry by its ID

DELETE /rest/stj/1.0/api/allowlist/{ipId}