GetAccessRestrictionConfig

17 Sep 2026

Print
Dark
Light

GetAccessRestrictionConfig

Updated on 17 Sep 2026

Print
Dark
Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Get

/v1/accounts/{accountId}/servicePrincipals/{servicePrincipalId}/accessRestrictionConfig

Availability
Early Access: Planned; date not yet confirmed
Early Access is gated; contact the Backblaze Sales team for access.
Limited Availability: Planned; date not yet confirmed
This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Get the access restriction configuration for a Service Principal

Returns the IP allowlist configured for this Service Principal. If no restrictions have been configured, returns an empty configuration with enforce: false.

Each Service Principal always has an Access Restriction Config resource, even if it contains no entries.

Security

HTTP

Type bearer

Short-lived bearer token obtained from GET /orgs/v1/authorize. Sent as Authorization - Bearer .

Path parameters

accountId

stringRequired

The numeric identifier of the account. Valid account IDs match 9[0-4][0-9]{10}.

Pattern^9[0-4][0-9]{10}$

Example912345678901

servicePrincipalId

stringRequired

The identifier of the service principal.

Pattern^[a-z0-9_-]{8,64}$

Examplesp-control-plane

Responses

200

The request succeeded.

{
  "name": "accounts/942733365851/servicePrincipals/2/accessRestrictionConfig",
  "ipRestriction": {
    "enforce": true,
    "allowedCidrRanges": [
      "192.0.2.0/24",
      "2001:db8::/48"
    ]
  },
  "etag": "BwXk9a2J8p0=",
  "updateTime": "2026-05-15T18:30:00Z"
}

Expand All

object

name

string

Exampleaccounts/942733365851/servicePrincipals/2/accessRestrictionConfig

ipRestriction

object (IpRestriction)

enforce

boolean

When false, the allowlist is stored but not applied during authentication. When true, authentication is allowed only from listed ranges; an empty list denies all authentication requests for the Service Principal.

Exampletrue

allowedCidrRanges

Array of string

Allowed source IP addresses and CIDR ranges. IPv4 and IPv6 are both supported. Maximum 250 entries. CIDR entries are normalized in responses.

Max items250

string

Example192.0.2.0/24

etag

string

ExampleBwXk9a2J8p0=

updateTime

string (date-time)

401

The request was not authenticated.

HTTP Status	Code	Description
401	UNAUTHORIZED	Missing, expired, or invalid bearer token.

Expand All

object

requestId

string

Opaque correlation identifier matching the Request-Id response header. Include in support requests.

Example4bf92f3577b34da6a3ce929d0e0e4736

error

object

code

integer

Numeric error code.

Example10

message

string

Human-readable description of the error.

Exampleetag mismatch

details

object

Reserved for structured, non-sensitive diagnostic information related to the error condition.

403

The caller is not authorized to perform this operation.

HTTP Status	Code	Description
403	FORBIDDEN	The authenticated principal lacks permission for this action.

Expand All

object

requestId

string

Opaque correlation identifier matching the Request-Id response header. Include in support requests.

Example4bf92f3577b34da6a3ce929d0e0e4736

error

object

code

integer

Numeric error code.

Example10

message

string

Human-readable description of the error.

Exampleetag mismatch

details

object

Reserved for structured, non-sensitive diagnostic information related to the error condition.

404

The requested resource was not found.

HTTP Status	Code	Description
404	NOT_FOUND	The resource does not exist or has been purged.

Expand All

object

requestId

string

Opaque correlation identifier matching the Request-Id response header. Include in support requests.

Example4bf92f3577b34da6a3ce929d0e0e4736

error

object

code

integer

Numeric error code.

Example10

message

string

Human-readable description of the error.

Exampleetag mismatch

details

object

Reserved for structured, non-sensitive diagnostic information related to the error condition.

429

The request was rate-limited.

HTTP Status	Code	Description
429	TOO_MANY_REQUESTS	Rate limit exceeded. Use exponential backoff.

Expand All

object

requestId

string

Opaque correlation identifier matching the Request-Id response header. Include in support requests.

Example4bf92f3577b34da6a3ce929d0e0e4736

error

object

code

integer

Numeric error code.

Example10

message

string

Human-readable description of the error.

Exampleetag mismatch

details

object

Reserved for structured, non-sensitive diagnostic information related to the error condition.

500

The server encountered an unexpected condition.

HTTP Status	Code	Description
500	INTERNAL	Unexpected server error. Include the `requestId` when contacting support.

Expand All

object

requestId

string

Opaque correlation identifier matching the Request-Id response header. Include in support requests.

Example4bf92f3577b34da6a3ce929d0e0e4736

error

object

code

integer

Numeric error code.

Example10

message

string

Human-readable description of the error.

Exampleetag mismatch

details

object

Reserved for structured, non-sensitive diagnostic information related to the error condition.

Was this article helpful?

What's Next

CreateOrganizationalUnit