> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leamout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network policies

> Restrict organization API access by source IP address.

Network policies apply organization-level source-IP allow and deny rules. These endpoints require the `networking` resource scope and the **private networking** capability in your organization's entitlements.

## Create a policy

```bash theme={null}
curl -sS -X POST "https://api.leamout.com/v1/network-policies/" \
  -H "Authorization: Bearer $LEAMOUT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Office network",
    "action": "allow",
    "source_cidr": "203.0.113.0/24"
  }'
```

`action` must be `allow` or `deny`; `source_cidr` must be a valid IPv4 or IPv6 CIDR. Policy records also have `active` or `disabled` status.

## How matching works

* A matching active `deny` rule always blocks the request.
* A matching active `allow` rule permits the request unless a matching deny also exists.
* If any active allow rule exists, unmatched source addresses are denied.
* With only deny rules, or no active policies, unmatched addresses are allowed.

This policy applies to organization API access; it is separate from a SIP trunk's trusted inbound source networks.

<Warning>
  Adding the first active allow rule can block API access from every other source address. Verify the source IPs used by your administrators and integrations before enabling restrictive rules.
</Warning>

Use `GET /v1/network-policies/` to inspect rules, `PATCH /v1/network-policies/{network_policy_id}` to update a rule or status, and `DELETE` on that path to remove it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.