> ## Documentation Index > Fetch the complete documentation index at: https://docs.validationcloud.io/llms.txt > Use this file to discover all available pages before exploring further. # Set endpoint options > Change the endpoint's IP allowlist, origin allowlist and log retention. Send at least one of the fields; a field you leave out keeps its current value (list or get endpoints to see the current values). `allowed_ips` and `allowed_origins` replace the whole stored list, so resend every entry to keep; an empty list clears it. Each list takes at most 1000 entries. Each `allowed_ips` entry is an IPv4 address or IPv4 CIDR range. Each `allowed_origins` entry is `*` or scheme://host[:port] with no path, query or userinfo; it is stored lowercase without a default port or trailing slash. `*` admits any browser origin but still refuses callers that send neither an Origin nor a Referer header; an empty list allows every caller. A non-empty allowlist therefore refuses every caller not on it, including servers that send no Origin or Referer header and live production traffic. `log_retention_hours` is 0 to 48; 0 turns request logs off. Needs a WRITE-scoped key. On plans that do not include it the call returns 403 plan_not_eligible; requests that only clear a list or turn logs off are always allowed. If the plan check cannot reach billing the call returns 503 internal_error and can be retried. Changes usually reach the gateway within about five minutes. ## OpenAPI ````yaml nodeapi/openapi/admin-api.json PATCH /endpoints/{id}/options openapi: 3.1.0 info: description: |- Programmatic, API-key-authenticated surface for managing Validation Cloud RPC endpoints and retrieving usage. Only the currently-implemented endpoints are documented; the broader PRD surface is intentionally omitted until served. `/admin/v1` is a strict contract — breaking changes are made under `/admin/v2`, never in place. Clients branch on the stable `error.code` enum, not on HTTP status alone. title: Validation Cloud Node API — Admin API version: 1.0.0 servers: - url: https://api.validationcloud.io/admin/v1 security: [] externalDocs: description: '' url: '' paths: /endpoints/{id}/options: patch: tags: - Endpoints summary: Set an endpoint's options description: >- Change the endpoint's IP allowlist, origin allowlist and log retention. Send at least one of the fields; a field you leave out keeps its current value (list or get endpoints to see the current values). `allowed_ips` and `allowed_origins` replace the whole stored list, so resend every entry to keep; an empty list clears it. Each list takes at most 1000 entries. Each `allowed_ips` entry is an IPv4 address or IPv4 CIDR range. Each `allowed_origins` entry is `*` or scheme://host[:port] with no path, query or userinfo; it is stored lowercase without a default port or trailing slash. `*` admits any browser origin but still refuses callers that send neither an Origin nor a Referer header; an empty list allows every caller. A non-empty allowlist therefore refuses every caller not on it, including servers that send no Origin or Referer header and live production traffic. `log_retention_hours` is 0 to 48; 0 turns request logs off. Needs a WRITE-scoped key. On plans that do not include it the call returns 403 plan_not_eligible; requests that only clear a list or turn logs off are always allowed. If the plan check cannot reach billing the call returns 503 internal_error and can be retried. Changes usually reach the gateway within about five minutes. parameters: - description: Endpoint UUID in: path name: id required: true schema: format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/admin.setEndpointOptionsRequest' summary: request description: Options to change description: Options to change required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/admin.endpointResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/admin.errorEnvelope' description: Service Unavailable security: - AdminApiKey: [] components: schemas: admin.setEndpointOptionsRequest: properties: allowed_ips: items: type: string maxItems: 1000 type: array uniqueItems: false allowed_origins: items: type: string maxItems: 1000 type: array uniqueItems: false log_retention_hours: maximum: 48 minimum: 0 type: integer type: object admin.endpointResponse: properties: api_key: type: string chain: type: string enabled: type: boolean id: format: uuid type: string name: type: string network: type: string options: $ref: '#/components/schemas/adminapi.EndpointOptions' urls: $ref: '#/components/schemas/adminapi.EndpointURLs' type: object admin.errorEnvelope: properties: error: $ref: '#/components/schemas/admin.errorBody' type: object adminapi.EndpointOptions: properties: allowed_ips: items: type: string type: array uniqueItems: false allowed_origins: items: type: string type: array uniqueItems: false log_retention_hours: type: integer type: object adminapi.EndpointURLs: properties: https: type: string wss: type: string type: object admin.errorBody: properties: code: enum: - unauthorized - forbidden - invalid_request - not_found - endpoint_limit_reached - plan_not_eligible - rate_limited - internal_error example: invalid_request type: string message: example: from must be an RFC3339 timestamp type: string type: object securitySchemes: AdminApiKey: description: >- Admin API key under the `ApiKey` scheme: `Authorization: ApiKey vc_adm_...`. Each key is bound to one team and carries a READ or WRITE scope; the usage endpoints require only READ. in: header name: Authorization type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.