# How to retrieve Azion IP ranges for origin server allowlisting

import DocButton from '~/components/webkit/DocButton.vue';
import Code from '~/components/Code/Code.astro'

When your application's origin server sits behind Azion, all inbound requests arrive from Azion's global infrastructure — not directly from end users. To secure your origin, you need to allowlist only Azion's IP/CIDR ranges and block everything else.

**Origin Shield** provides the `Azion Origin Shield` network list — a curated, dynamically updated list of all IPv4 and IPv6 prefixes used exclusively by Azion's global infrastructure to connect to origin servers.

---

## Prerequisites

- The [Network Shield module](/en/documentation/products/secure/firewall/network-shield/) enabled on your Firewall.
- An active **Origin Shield** add-on subscription. Contact the [sales team](https://www.azion.com/en/contact/) to subscribe.

---

## Access the list via Azion Console

1. Access [Azion Console](https://console.azion.com) > **Network Lists**.
2. Select **Azion Origin Shield** from the list.
3. In the **List** field, copy all IP/CIDR entries.

---

## Access the list via API

Run the following request, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/):

<Code lang="bash" code={`
curl --request GET \\
  --url https://api.azion.com/v4/workspace/network_lists \\
  --header 'Accept: application/json' \\
  --header 'Authorization: Token [TOKEN VALUE]'
`} />

The response will include the `Azion Origin Shield` entry:

<Code lang="json" code={`
{
  "count": 4,
  "total_pages": 1,
  "schema_version": 3,
  "links": {
    "previous": null,
    "next": null
  },
  "results": [
    {
      "id": 2345,
      "last_editor": "last.editor@azion.com",
      "last_modified": "2023-03-27T21:19:27.996870Z",
      "list_type": "ip_cidr",
      "name": "Azion Origin Shield",
      "country_list": [],
      "ip_list": [
        "192.0.2.0/24",
        "2001:db8::/32"
      ]
    }
  ]
}
`} />

The `ip_list` field contains all current Azion prefixes. Use these values to configure your origin firewall.

:::note
Azion sends an email notification every time the list is updated. You have **7 days** to apply the new addresses to your origin firewall rules or automations before new servers go into production.
:::

---

## Related resources

<DocButton href="/en/documentation/products/secure/secure-infrastructure/" label="Secure an infrastructure" kind="secondary" size="medium" />
<DocButton href="/en/documentation/products/secure/connectors/origin-shield/" label="Origin Shield reference" kind="secondary" size="medium" />
<DocButton href="/en/documentation/products/secure/firewall/network-shield/" label="Network Shield reference" kind="secondary" size="medium" />
<DocButton href="/en/documentation/products/secure/edge-firewall/network-layer-protection/network-lists/" label="Network Lists reference" kind="secondary" size="medium" />