SecurityProfiles

SecurityProfiles let you define granular security rules applied to your App’s API requests: restriction by IP or domain, a per-transaction amount cap, a whitelist of payment methods, and blocking of high-risk countries.

Typical use cases: limiting API calls to your production servers, preventing payments beyond a certain amount from the frontend, blocking countries under embargo or with a high fraud rate.

Availability

SecurityProfiles are available on the Growth, Business, and Enterprise plans. On the Starter plan, requests are not filtered by a security profile.

Endpoints

Méthode	Endpoint	Description
POST	`/security-profiles/`	Create a security profile
GET	`/security-profiles/`	List profiles
GET	`/security-profiles/{id}/`	Retrieve a profile
PATCH	`/security-profiles/{id}/`	Update a profile
DELETE	`/security-profiles/{id}/`	Delete a profile

Is this introduction clear?

Object schema

ResponseSecurityProfile object

Full structure returned by all endpoints of this resource.

json

{
  "id": "sp_xxxxxxxxxxxx",
  "object": "security_profile",
  "name": "E-commerce Production Profile",
  "allowed_ips": [
    "196.200.1.0/24",
    "41.202.219.5"
  ],
  "allowed_domains": [
    "ma-boutique.com",
    "app.ma-boutique.com"
  ],
  "max_amount": 500000,
  "allowed_payment_methods": [
    "mobile_money",
    "bank_card"
  ],
  "blocked_countries": [
    "KP",
    "IR"
  ],
  "livemode": true,
  "created_at": "2026-01-01T00:00:00Z",
  "updated_at": "2026-01-01T00:00:00Z"
}

Create a SecurityProfile

Creates a new security profile for your App. The profile is applied immediately to all API requests as soon as it is created.

POSTRequest body

nameRequis

stringex :E-commerce Production Profile

Name of the security profile. Used only for identification purposes in the dashboard — not visible to your customers.

allowed_ipsOptionnel

array[string]ex :[“196.200.1.0/24”, “41.202.219.5”]

List of IP addresses or CIDR ranges allowed to issue API requests. If this field is set, any request coming from an unlisted IP is rejected with a 403 Forbidden error.

Accepted formats: a single IPv4 address (41.202.219.5) or CIDR notation (196.200.1.0/24). Leave this field empty to allow all IPs — useful if your servers don’t have a fixed IP. Combine with allowed_domains for defense in depth.

allowed_domainsOptionnel

array[string]ex :[“ma-boutique.com”, “app.ma-boutique.com”]

List of domains allowed to initiate requests from the browser (the Origin header). Useful for restricting the use of your public key to only the domains you control.

Do not include the protocol (https://) or the trailing slash. Subdomains must be listed explicitly — ma-boutique.com does not automatically allow app.ma-boutique.com. The allowed_domains field applies only to frontend requests (CORS); server-to-server calls are not filtered by this field.

max_amountOptionnel

integercentsex :500000

Maximum amount allowed per transaction, in cents. Any payment attempt exceeding this threshold is rejected before being created.

This cap applies to the raw amount of the PaymentIntent, before discounts or taxes. Leave this field as null to not apply a cap. Useful for limiting exposure in case of API key compromise, or for merchants subject to regulatory per-transaction limits.

allowed_payment_methodsOptionnel

array[string]

List of payment methods allowed by this profile. If set, only the listed methods can be used in transactions associated with this App.

Possible values: mobile_money, bank_card, bank_transfer. If this field is empty or omitted, all of the App’s active methods are allowed. Restricting to the methods actually offered on your interface reduces the attack surface.

blocked_countriesOptionnel

array[string]ISO 3166-1 alpha-2

List of country codes whose payments are blocked. Any transaction initiated from an IP geolocated in a blocked country is rejected.

Uppercase ISO 3166-1 alpha-2 codes (e.g. KP, IR, SY). Geolocation is based on the buyer’s IP — not bypassable via VPN in most cases thanks to anomaly detection. This list is independent of your App’s restrictions; a country can be blocked here without being removed from your catalog.

Are the SecurityProfile parameters clear?

Create a restrictive profile

bash

curl -X POST https://api.sangho.ga/v1/security-profiles/ \
  -H "Authorization: Bearer sk_prod_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "E-commerce Production Profile",
    "allowed_ips": ["196.200.1.0/24", "41.202.219.5"],
    "allowed_domains": ["ma-boutique.com", "app.ma-boutique.com"],
    "max_amount": 500000,
    "allowed_payment_methods": ["mobile_money", "bank_card"],
    "blocked_countries": ["KP", "IR"]
  }'

Response201 Created

The profile is active immediately. Your App's API requests are now filtered according to these rules.

json

{
  "id": "sp_xxxxxxxxxxxx",
  "object": "security_profile",
  "name": "E-commerce Production Profile",
  "allowed_ips": [
    "196.200.1.0/24",
    "41.202.219.5"
  ],
  "allowed_domains": [
    "ma-boutique.com",
    "app.ma-boutique.com"
  ],
  "max_amount": 500000,
  "allowed_payment_methods": [
    "mobile_money",
    "bank_card"
  ],
  "blocked_countries": [
    "KP",
    "IR"
  ],
  "livemode": true,
  "created_at": "2026-03-01T10:00:00Z",
  "updated_at": "2026-03-01T10:00:00Z"
}

List SecurityProfiles

Returns all of your App’s security profiles, sorted by descending creation date.

Update a SecurityProfile

Updates one or more fields of an existing profile. Changes are applied immediately — subsequent requests are filtered according to the new rules.

PATCHUpdate body (PATCH)

nameOptionnel

string

New name for the profile.

allowed_ipsOptionnel

array[string]

New complete list of allowed IPs. Entirely replaces the existing list — this is not a merge. Pass an empty array [] to remove all IP restrictions.

allowed_domainsOptionnel

array[string]

New complete list of allowed domains. Entirely replaces the existing list. Pass [] to remove domain restrictions.

max_amountOptionnel

integercents

New amount cap. Pass null to remove the cap.

allowed_payment_methodsOptionnel

array[string]

New list of allowed methods. Entirely replaces the existing list.

blocked_countriesOptionnel

array[string]ISO 3166-1 alpha-2

New list of blocked countries. Entirely replaces the existing list. Pass [] to unblock all countries.

Delete a SecurityProfile

Permanently deletes the security profile. The associated rules immediately stop being applied. This action is irreversible.

Immediate impact

Deleting a SecurityProfile takes effect instantly: your App is no longer subject to any security restrictions until a new profile is created and activated. Make sure you have a replacement profile ready before deleting a production profile.

Are the operations on SecurityProfiles well documented?

List profiles

bash

curl "https://api.sangho.ga/v1/security-profiles/" \
  -H "Authorization: Bearer sk_prod_xxxx"

Update a profile

bash

curl -X PATCH https://api.sangho.ga/v1/security-profiles/sp_xxx/ \
  -H "Authorization: Bearer sk_prod_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "max_amount": 750000,
    "blocked_countries": ["KP", "IR", "SY"]
  }'

Response200 OK — Profile updated

Returns the full SecurityProfile object with the updated rules. Changes take effect immediately.

json

{
  "id": "sp_xxxxxxxxxxxx",
  "object": "security_profile",
  "name": "E-commerce Production Profile",
  "allowed_ips": ["196.200.1.0/24", "41.202.219.5"],
  "allowed_domains": ["ma-boutique.com", "app.ma-boutique.com"],
  "max_amount": 750000,
  "allowed_payment_methods": ["mobile_money", "bank_card"],
  "blocked_countries": ["KP", "IR", "SY"],
  "livemode": true,
  "updated_at": "2026-04-10T15:30:00Z"
}

Delete a profile

bash

curl -X DELETE https://api.sangho.ga/v1/security-profiles/sp_xxx/ \
  -H "Authorization: Bearer sk_prod_xxxx"

Response204 No Content — Deleted

The deletion succeeded. The security rules stop being applied immediately.