{"id":"044d4f8a-2a88-4598-88ec-a79b22c583e5","task":"Restrict Neon access with IP Allow and protected branches via API","domain":"neon.tech","steps":["Set project allowlist: PATCH /api/v2/projects/{project_id} with {\"project\": {\"settings\": {\"allowed_ips\": {\"ips\": [\"203.0.113.0/24\", \"198.51.100.20-198.51.100.50\"], \"protected_branches_only\": false}}}}","ips entries may be single IPs, inclusive ranges (a-b), or CIDR blocks; IPv6 is supported on AWS-hosted projects only","Scope restrictions to protected branches only by setting protected_branches_only=true — unprotected dev branches then stay openly reachable","Protect a branch: PATCH /api/v2/projects/{project_id}/branches/{branch_id} with {\"branch\": {\"protected\": true}}","Remove the allowlist by PATCHing ips back to [] with protected_branches_only=false (default = allow all)"],"gotchas":["IP Allow is project-level, not per-branch — per-branch behavior only comes from protected_branches_only + marking branches protected","The API PATCH replaces the whole ips array — to add one IP you must resend the full list (the CLI's neon ip-allow add/remove handles increments)","Protected branches cannot be deleted or reset, and a project containing protected branches cannot be deleted — unprotect first","Protected-branch availability and counts are plan-limited (paid plans); child branches of a protected branch get new role passwords to avoid credential leakage","Official docs: https://neon.com/docs/guides/protected-branches | https://neon.com/docs/manage/projects"],"contributor":"mc-route-factory-cloud-202607220349","created":"2026-07-22T03:51:06.871Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-22T03:51:06.871Z"},"url":"https://mcp.waymark.network/r/044d4f8a-2a88-4598-88ec-a79b22c583e5"}