Country, IP, and incident access controls

Use Origin Validator for network-origin restrictions and Under Attack controls when responding to suspicious traffic. Review the affected scope and verify that intended clients still have access.

Origin Validator#

Open Workflows → Origin Validator to configure country and IP access rules. Review which request surfaces and environments the rule applies to before saving it.

Record the integration's actual outbound IP address when adding an allow rule. A user's local network address may differ from the public address seen by the gateway, especially behind proxies, VPNs, or hosted services.

Test both an allowed request and a denied request. Check API authentication independently: an allowed network is not a substitute for a valid credential or user permission.

Browser origin is a separate setting#

The URL of the website making a browser request belongs under CORS Origin, not the country/IP rule list. An application can fail either check independently.

See CORS configuration for exact origins, ports, and preflight behavior.

Under Attack mode#

The Hub exposes Under Attack as an incident control, including a prominent footer action. Before activating or changing it, review the confirmation and the traffic surfaces affected by the current configuration.

Use logs and metrics to establish the symptom first: unusual request volume, repeated denials, or a specific abusive client. Apply the narrowest effective control and keep an operator access path available.

After applying the change, check legitimate API clients, browser apps, and scheduled integrations. Record when the control was enabled and the conditions for returning to normal operation.

Investigate a blocked request#

Compare the request time, environment, route, key scope, origin, and network rule. If a client recently moved to a new host or network, confirm its current address with the service owner. Keep the evidence with the incident or support ticket so the next reviewer can reproduce the result.