IP Address Blacklist

Overview

These commands manage the tenant's IP address blacklist. Once an IP is added and enabled, the IpBlacklistMiddleware returns HTTP 403 Forbidden on every request from that address. Changes take effect immediately — the in-memory cache is invalidated on every write so no restart is needed.

Permission Required

• Write operations: Settings.ManageGeneralConfig
• Read operations: Settings.ViewGeneralConfig or Settings.ManageGeneralConfig

---

AddIpBlacklistCommand

Adds an IP address to the blacklist.

Request

{
  "cmd": "AddIpBlacklistCommand",
  "data": {
    "ipAddress": "192.168.1.100",
    "description": "Brute-force attacker detected on 2026-08-02",
    "enabled": true
  }
}

Request Fields

Field	Type	Required	Default	Description
ipAddress	string	Yes	—	IPv4 or IPv6 address, e.g. "192.168.1.10"
description	string	No	""	Human-readable note for audit purposes
enabled	bool	No	true	false adds the entry without immediately activating the block

Response

{
  "isSuccessful": true,
  "statusCode": "00",
  "message": "IP address '192.168.1.100' has been blacklisted.",
  "data": {
    "id": 42,
    "parameterValue1": "192.168.1.100",
    "description": "Brute-force attacker detected on 2026-08-02",
    "enabled": true
  }
}

---

RemoveIpBlacklistCommand

Permanently deletes a blacklist entry by its database ID. Use UpdateIpBlacklistCommand if you want to suspend the block temporarily instead of deleting it.

Request

{
  "cmd": "RemoveIpBlacklistCommand",
  "data": {
    "id": 42
  }
}

Request Fields

Field	Type	Required	Description
id	long	Yes	The ApplicationParameterSetting.Id — returned by AddIpBlacklistCommand or GetIpBlacklistQuery

---

UpdateIpBlacklistCommand

Enables or disables an existing entry without deleting it. Useful for temporarily lifting a block during investigation.

Request

{
  "cmd": "UpdateIpBlacklistCommand",
  "data": {
    "id": 42,
    "enabled": false
  }
}

Request Fields

Field	Type	Required	Description
id	long	Yes	The ApplicationParameterSetting.Id of the entry
enabled	bool	Yes	true to activate the block; false to suspend it

Response

{
  "isSuccessful": true,
  "statusCode": "00",
  "message": "IP address '192.168.1.100' has been suspended (not deleted).",
  "data": {
    "id": 42,
    "parameterValue1": "192.168.1.100",
    "description": "Brute-force attacker detected on 2026-08-02",
    "enabled": false
  }
}

---

GetIpBlacklistQuery

Returns all blacklist entries for the current tenant — both active and suspended — ordered by IP address.

Request

{
  "cmd": "GetIpBlacklistQuery",
  "data": {}
}

Response

{
  "isSuccessful": true,
  "statusCode": "00",
  "message": "2 blacklist entry(ies) found.",
  "data": [
    { "id": 42, "ipAddress": "192.168.1.100", "description": "Brute-force attacker", "enabled": true },
    { "id": 43, "ipAddress": "10.0.0.55",     "description": "Suspended — under review", "enabled": false }
  ]
}

---

Developer Notes (Raji)

Item	Detail
Command file	CB.Administration.Api/Commands/BPM/Security/IpBlacklistCommand.cs
Handler	IpBlacklistCommandHandlers
Storage	ApplicationParameterSetting table — ParameterCategory = "IpBlacklist", ParameterKey = "BlockedIp"
Middleware	CB.Administration.Api/Utilities/IpBlacklistMiddleware.cs — reads from cache, returns 403
Cache key	IpBlacklist_{tenantId} — invalidated immediately on every write
Write permission	PermissionStandardCodes.Settings.ManageGeneralConfig
Read permission	PermissionStandardCodes.Settings.ViewGeneralConfig