# uip admin ip-restriction

> Syntax and options for `uip admin ip-restriction`, which manages IP-range allowlisting, enforcement, and bypass rules for an organization via the Access Policy Management Service.

`uip admin ip-restriction` manages UiPath IP-restriction policies for the caller's organization, backed by the Access Policy Management Service (APMS). Four subcommand groups: `ip-ranges` (the allowlist of trusted CIDRs/IP ranges), `enforcement` (the on/off switch that actually gates access by that allowlist), `bypass-rules` (URL-pattern exceptions to allowlisting), and `my-ip` (shows the public IP the platform sees for the caller — the tool a reader uses before touching either of the other two).

:::note
**Lockout risk.** Enabling enforcement (`enforcement enable`) or removing an IP range entry (`ip-ranges delete`) while enforcement is on can lock the caller — or the entire organization — out of UiPath if the wrong IP ends up excluded. Both commands require `--confirm`, and the CLI runs its own pre-flight safety checks (below) before making the call — but the checks are best-effort, not a substitute for double-checking with `my-ip` and `ip-ranges list` first.
:::

## Synopsis

```text
uip admin ip-restriction ip-ranges list [--filter <fragment>]
uip admin ip-restriction ip-ranges get [<id>] [--cidr <cidr>]
uip admin ip-restriction ip-ranges create [--name <name> --cidr <cidr>... | --name <name> --start-ip <ip> --end-ip <ip> | --file <path>] [--expires <duration>]
uip admin ip-restriction ip-ranges update <id> [--name <name>] [--cidr <cidr>] [--start-ip <ip>] [--end-ip <ip>] [--file <path>]
uip admin ip-restriction ip-ranges delete [<id>] [--cidr <cidr>] --confirm

uip admin ip-restriction enforcement get
uip admin ip-restriction enforcement enable --confirm
uip admin ip-restriction enforcement disable

uip admin ip-restriction bypass-rules list [--filter <fragment>]
uip admin ip-restriction bypass-rules get <id>
uip admin ip-restriction bypass-rules create --file <path>
uip admin ip-restriction bypass-rules update <id> [--regex-entry <pattern> | --file <path>]
uip admin ip-restriction bypass-rules delete <id>

uip admin ip-restriction my-ip
```

Every verb accepts `--login-validity <minutes>` (override the interactive-login token lifetime for that one call; rarely needed).

## Concepts

- **Idempotent upsert on `ip-ranges create`** — the call is a PUT keyed on CIDR: running it twice with the same `--cidr` is a safe no-op, not a duplicate-entry error.
- **Two ways to identify an entry** — `ip-ranges get`/`delete` accept either the entry's UUID positionally, or `--cidr <cidr>` to look it up by value (the CLI lists entries and matches). Passing both, or neither, is a client-side error. If `--cidr` matches more than one entry, the command refuses and asks you to use the UUID instead.
- **Lockout-safety pre-flights** — `enforcement enable` first calls `my-ip` and checks the result against every CIDR in `ip-ranges list`; if the caller's IP isn't covered, the call is rejected before it reaches the platform. `ip-ranges delete` runs a similar check only when enforcement is already on: it refuses to delete the org's only remaining entry, and refuses to delete an entry that uniquely covers the caller's own IP (unless another entry also covers it). Both checks are CIDR-only — a start/end-IP-range-only entry isn't matched by the caller-IP check, so the "last entry" check is the real backstop for those.
- **`--file` vs. inline** — `ip-ranges create`/`update` and `bypass-rules create`/`update` all accept either a full JSON request body via `--file <path>`, or a narrower set of inline flags. The two are mutually exclusive; passing neither (or an incomplete inline set) is a client-side error before any network call.

## uip admin ip-restriction ip-ranges

Manage the organization's IP allowlist. An entry is a CIDR block, a start/end IP range, or a list of CIDRs.

### uip admin ip-restriction ip-ranges list

#### Options

| Long | Value | Description |
|---|---|---|
| `--filter <fragment>` | string | Case-insensitive substring filter on the entry's `name`, applied client-side. |

#### Example

```bash
uip admin ip-restriction ip-ranges list --filter office
```

#### Data shape (--output json)

```json
{
  "Code": "ApmsIpRangesList",
  "Data": [
    { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Office VPN", "ipNetwork": "10.0.0.0/16" }
  ]
}
```

### uip admin ip-restriction ip-ranges get

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `[id]` | conditionally | Entry UUID. Omit only when `--cidr` is passed instead. |

#### Options

| Long | Value | Description |
|---|---|---|
| `--cidr <cidr>` | string | Look up the entry by CIDR instead of id. Mutually exclusive with the positional id; exactly one of the two is required. |

#### Example

```bash
uip admin ip-restriction ip-ranges get --cidr 10.0.0.0/16
```

#### Data shape (--output json)

```json
{
  "Code": "ApmsIpRangeGet",
  "Data": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Office VPN", "ipNetwork": "10.0.0.0/16" }
}
```

### uip admin ip-restriction ip-ranges create

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--file <path>` | path | conditionally | Full `AddIpConfigurationRequest` JSON body. Mutually exclusive with every inline flag below. |
| `--name <name>` | string | inline mode: yes | Display name for the entry. |
| `--cidr <cidr>` | string, repeatable | inline mode: one of `--cidr` or `--start-ip`+`--end-ip` | CIDR block to allow, e.g. `10.0.0.0/16`. Repeat the flag to add several CIDRs in one call. Mutually exclusive with `--start-ip`/`--end-ip`. |
| `--start-ip <ip>` | IP | paired with `--end-ip` | Start of an IP range (legacy shape). |
| `--end-ip <ip>` | IP | paired with `--start-ip` | End of an IP range. Must be given together with `--start-ip`. |
| `--expires <duration>` | `<integer><m\|h\|d\|w>` | no | Optional expiry, e.g. `15m`, `2h`, `30d`, `1w`. Range: 1 minute to 10 years. |

#### Examples

```bash
uip admin ip-restriction ip-ranges create --name 'Office VPN' --cidr 10.0.0.0/16
```

```bash
uip admin ip-restriction ip-ranges create --name 'Datacenter A' \
  --cidr 10.0.0.0/16 --cidr 192.168.0.0/24 --expires 30d
```

```bash
uip admin ip-restriction ip-ranges create --name Office --start-ip 10.0.0.1 --end-ip 10.0.0.50
```

#### Data shape (--output json)

```json
{ "Code": "ApmsIpRangeCreated", "Data": [{ "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Office VPN" }] }
```

### uip admin ip-restriction ip-ranges update

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<id>` | yes | Entry UUID. |

#### Options

| Long | Value | Description |
|---|---|---|
| `--file <path>` | path | Full `UpdateIpConfigurationRequest` JSON body. Mutually exclusive with the inline flags below. |
| `--name <name>` | string | New display name. |
| `--cidr <cidr>` | string | New CIDR to set on the entry. |
| `--start-ip <ip>` | IP | New start of the range. |
| `--end-ip <ip>` | IP | New end of the range. |

At least one field (inline or `--file`) is required.

#### Example

```bash
uip admin ip-restriction ip-ranges update a1b2c3d4-0000-0000-0000-000000000001 --name 'Home VPN'
```

#### Data shape (--output json)

```json
{ "Code": "ApmsIpRangeUpdated", "Data": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Home VPN" } }
```

### uip admin ip-restriction ip-ranges delete

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `[id]` | conditionally | Entry UUID. Omit only when `--cidr` is passed instead. |

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--cidr <cidr>` | string | conditionally | Look up the entry to delete by CIDR instead of id. |
| `--confirm` | flag | **yes** | Acknowledge the lockout risk. Omitting it prints the lockout warning and fails before any lookup. |

#### Example

```bash
uip admin ip-restriction ip-ranges delete a1b2c3d4-0000-0000-0000-000000000001 --confirm
```

#### Data shape (--output json)

```json
{ "Code": "ApmsIpRangeDeleted", "Data": {} }
```

## uip admin ip-restriction enforcement

Manage the organization's singleton IP-range enforcement switch. When on, only the IPs covered by `ip-ranges list` can reach the org; when off, the platform default applies.

### uip admin ip-restriction enforcement get

#### Example

```bash
uip admin ip-restriction enforcement get
```

#### Data shape (--output json)

```json
{ "Code": "ApmsEnforcementGet", "Data": { "organizationId": "<org-guid>", "status": "Disabled" } }
```

### uip admin ip-restriction enforcement enable

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--confirm` | flag | **yes** | Acknowledge the lockout risk. Without it, the CLI prints the warning and fails immediately, before the pre-flight check. |

Pre-flight (runs after `--confirm` is given): calls `my-ip`, then compares the result against every CIDR from `ip-ranges list`. If the caller's IP isn't covered, the command fails with instructions to add it first — no network call to enable enforcement is made.

#### Example

```bash
uip admin ip-restriction enforcement enable --confirm
```

#### Data shape (--output json)

```json
{ "Code": "ApmsEnforcementEnabled", "Data": {} }
```

### uip admin ip-restriction enforcement disable

Idempotent — safe to call when already disabled.

#### Example

```bash
uip admin ip-restriction enforcement disable
```

#### Data shape (--output json)

```json
{ "Code": "ApmsEnforcementDisabled", "Data": {} }
```

## uip admin ip-restriction bypass-rules

Manage URL-pattern exceptions to IP allowlisting — a narrowly-scoped bypass for a specific app/folder/tenant URL pattern when the org otherwise has enforcement on.

### uip admin ip-restriction bypass-rules list

#### Options

| Long | Value | Description |
|---|---|---|
| `--filter <fragment>` | string | Case-insensitive substring filter on `regexEntry` or `appName`, applied client-side. |

#### Example

```bash
uip admin ip-restriction bypass-rules list --filter contoso
```

#### Data shape (--output json)

```json
{ "Code": "ApmsBypassRulesList", "Data": [{ "id": "b1c2d3e4-0000-0000-0000-000000000001", "regexEntry": "^.*\\.contoso\\.com$" }] }
```

### uip admin ip-restriction bypass-rules get

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<id>` | yes | Bypass rule UUID. |

#### Example

```bash
uip admin ip-restriction bypass-rules get b1c2d3e4-0000-0000-0000-000000000001
```

#### Data shape (--output json)

```json
{ "Code": "ApmsBypassRulesGet", "Data": { "id": "b1c2d3e4-0000-0000-0000-000000000001", "regexEntry": "^.*\\.contoso\\.com$" } }
```

### uip admin ip-restriction bypass-rules create

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--file <path>` | path | **yes** | Full `AddRegexBypassRequest` JSON body — there is no inline-flag form for create. |

#### Example

```bash
uip admin ip-restriction bypass-rules create --file ./bypass-rule.json
```

#### Data shape (--output json)

```json
{ "Code": "ApmsBypassRulesCreated", "Data": { "id": "b1c2d3e4-0000-0000-0000-000000000001", "regexEntry": "^.*\\.contoso\\.com$" } }
```

### uip admin ip-restriction bypass-rules update

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<id>` | yes | Bypass rule UUID. |

#### Options

| Long | Value | Description |
|---|---|---|
| `--regex-entry <pattern>` | string | Replacement regex pattern — the only field the typical case needs. Mutually exclusive with `--file`. |
| `--file <path>` | path | Full `UpdateRegexBypassRequest` body, for the rarer case of updating tenant/app metadata too. Mutually exclusive with `--regex-entry`. |

Exactly one of `--regex-entry` or `--file` is required.

#### Example

```bash
uip admin ip-restriction bypass-rules update b1c2d3e4-0000-0000-0000-000000000001 --regex-entry '^.*\.contoso\.com$'
```

#### Data shape (--output json)

```json
{ "Code": "ApmsBypassRulesUpdated", "Data": { "id": "b1c2d3e4-0000-0000-0000-000000000001", "regexEntry": "^.*\\.contoso\\.com$" } }
```

### uip admin ip-restriction bypass-rules delete

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<id>` | yes | Bypass rule UUID. |

#### Example

```bash
uip admin ip-restriction bypass-rules delete b1c2d3e4-0000-0000-0000-000000000001
```

#### Data shape (--output json)

```json
{ "Code": "ApmsBypassRulesDeleted", "Data": {} }
```

## uip admin ip-restriction my-ip

Show the public IP the UiPath platform sees for the current caller — useful before `ip-ranges create` (to know what to allowlist) and before `enforcement enable` (to confirm you're covered).

### Example

```bash
uip admin ip-restriction my-ip
```

### Data shape (--output json)

```json
{ "Code": "ApmsMyIpGet", "Data": { "ipAddress": "<your-public-ip>" } }
```

## See also

- [Global options](./global-options.md)
- [Exit codes](./exit-codes.md)