# Update status page access — API reference

> Updates e-mail and IP allowlists for a status page and returns the resulting access policy.

Source: https://upfour.io/docs/api/status-pages/update-status-page-access

[Developers](https://upfour.io/docs/api.md)/[Status pages](https://upfour.io/docs/api/status-pages.md)

Updates e-mail and IP allowlists for a status page and returns the resulting access policy.

PUT https://app.upfour.io/v1/status-pages/{pageID}/access

scope status_page.write stable returns 200

## Parameters

| Field | Type | Description |
| --- | --- | --- |
| `pageID` required | uuid | path parameter |

## Body

`application/json` required 3 fields

All other fields3 fields

access_email_allowliststring[] · nullable

Full addresses or @domain.tld entries. Omitted leaves the allowlist as configured.

access_email_codesboolean · nullable

Omitted leaves the e-mail-code setting as configured.

ip_allowliststring[]

IPv4, IPv6 or CIDR entries. Always applied: omitting it clears the list.

## Returns

A successful request returns `200` with application/json.

Response fields 1 top-level fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | StatusPageAccessPolicy | |
| StatusPageAccessPolicy · 6 fields FieldTypeDescription `access_email_allowlist` string[]  · nullable Full addresses or @domain.tld entries allowed to request an e-mail access code. `access_email_codes` boolean `access_token_configured` boolean `ip_allowlist` string[]  · nullable `status_page_id` uuid `token_rotated_at` string (date-time)  · nullable | | |

## Errors

Only the errors this operation can return. Every error uses the [same envelope](https://upfour.io/docs/api/responses.md).

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | [bad_request](https://upfour.io/docs/api/errors#code-bad_request) | The request is malformed or fails validation. |
| 404 | [not_found](https://upfour.io/docs/api/errors#code-not_found) | The requested resource does not exist or is outside the caller's scope. |
| 403 | [permission_denied](https://upfour.io/docs/api/errors#code-permission_denied) | The credentials do not permit this action. |

Every call can also return `unauthorized` (401), `rate_limit_exceeded` (429) or `internal_error` (500 / 502). See [Responses and errors](https://upfour.io/docs/api/responses.md).

[PreviousGet status page access](https://upfour.io/docs/api/status-pages/get-status-page-access.md) [NextRemove a status page access token](https://upfour.io/docs/api/status-pages/remove-a-status-page-access-token.md)

## Request

### cURL

```bash
curl -s -X PUT "https://app.upfour.io/v1/status-pages/00000000-0000-4000-8000-000000000001/access" \
  -H "Authorization: Bearer $UP4_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "access_email_codes": false,
    "ip_allowlist": [
      "203.0.113.0/24"
    ]
  }'
```

### JavaScript

```javascript
const res = await fetch("https://app.upfour.io/v1/status-pages/00000000-0000-4000-8000-000000000001/access", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.UP4_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    access_email_codes: false,
    ip_allowlist: ["203.0.113.0/24"],
  }),
});
console.log(res.status, await res.json());
```

### Python

```python
import os
import requests

res = requests.put(
    "https://app.upfour.io/v1/status-pages/00000000-0000-4000-8000-000000000001/access",
    headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"},
    json={
        "access_email_codes": False,
        "ip_allowlist": ["203.0.113.0/24"],
    },
)
print(res.status_code, res.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "access_email_codes": false,
  "ip_allowlist": [
    "203.0.113.0/24"
  ]
}`)
	req, _ := http.NewRequest("PUT", "https://app.upfour.io/v1/status-pages/00000000-0000-4000-8000-000000000001/access", payload)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}
```

### PHP

```php
<?php
$payload = <<<'JSON'
{
  "access_email_codes": false,
  "ip_allowlist": [
    "203.0.113.0/24"
  ]
}
JSON;

$ch = curl_init("https://app.upfour.io/v1/status-pages/00000000-0000-4000-8000-000000000001/access");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "PUT",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("UP4_API_KEY"),
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS => $payload,
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n";
curl_close($ch);
```

## Response

### 200

```json
{
  "data": {
    "access_email_allowlist": [],
    "access_email_codes": false,
    "access_token_configured": false,
    "ip_allowlist": [
      "203.0.113.0/24"
    ],
    "status_page_id": "00000000-0000-4000-8000-000000000001",
    "token_rotated_at": null
  }
}
```

### 400

```json
{
  "error": {
    "code": "bad_request",
    "message": "The request is malformed or fails validation.",
    "request_id": "req_…"
  }
}
```

### 403

```json
{
  "error": {
    "code": "permission_denied",
    "message": "The credentials do not permit this action.",
    "request_id": "req_…"
  }
}
```

### 404

```json
{
  "error": {
    "code": "not_found",
    "message": "The requested resource does not exist or is outside the caller's scope.",
    "request_id": "req_…"
  }
}
```