<a id="ip-filter-management-auditable-events"></a>

# IP Filter Management Auditable Event Methods on Confluent Cloud

IP filter and IP group management auditable events record create, update, and
delete operations on IP filters with resource type `IP_FILTER` and IP groups
with resource type `IP_GROUP` in Confluent Cloud. The following auditable event methods
generate auditable event messages for the `io.confluent.cloud/request` event
type. An auditable event method sends a message to the audit log when the
corresponding auditable event occurs; the message is stored as an audit log
record.

For details about the IP filtering feature and the use of IP filters and IP
groups, see [IP filtering](../../../security/access-control/ip-filtering/overview.md#ip-filtering). For the procedures that
generate these events, see [Manage IP Filters on Confluent Cloud](../../../security/access-control/ip-filtering/manage-ip-filters.md#manage-ip-filters). For the event generated
when an IP filter denies a request, see
[IP filter authorization](ip-filter-authz.md#ip-filter-authz-auditable-events). For more
information about audit log records, see
[Audit log event records](../audit-log-records.md#cloud-audit-log-records).

For IP filter events, the `request.data` field contains only the IP filter
fields submitted in the request, such as `filter_name`, `operation_groups`,
`ip_groups`, and `resource_group`. For IP group events, `request.data`
contains only the IP group fields submitted in the request, such as
`group_name` and `cidr_blocks`. Confluent Cloud does not log API envelope fields,
such as `kind`, `api_version`, `metadata`, and `resource_scope`.

<a id="ip-filter-management-event-methods"></a>

## IP filter event methods

An IP filter (`IP_FILTER`) associates one or more IP groups with the
[operation groups](../../../security/access-control/ip-filtering/overview.md#ip-filter-operation-groups) that the filter governs.
An IP group (`IP_GROUP`) is a named set of Classless Inter-Domain Routing
(CIDR) blocks that you attach to one or more IP filters to control network
access. The following actions, or operations, on an IP filter or an IP group
generate auditable event messages.

| Method name                                | Action triggering an auditable event message   |
|--------------------------------------------|------------------------------------------------|
| [CreateIPFilter](#createipfilter-examples) | A request to create an IP filter.              |
| [UpdateIPFilter](#updateipfilter-examples) | A request to update an IP filter.              |
| [DeleteIPFilter](#deleteipfilter-examples) | A request to delete an IP filter.              |
| [CreateIPGroup](#createipgroup-examples)   | A request to create an IP group.               |
| [UpdateIPGroup](#updateipgroup-examples)   | A request to update an IP group.               |
| [DeleteIPGroup](#deleteipgroup-examples)   | A request to delete an IP group.               |

<a id="createipfilter-examples"></a>

### CreateIPFilter

The `CreateIPFilter` method creates an IP filter that associates IP groups
with operation groups. A request to create an IP filter generates the
`CreateIPFilter` event.

To view example event messages, expand the Success or Failure dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"CreateIPFilter",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_FILTER",
               "resourceId":"ipf-abcef"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "filter_name":"US Offices",
            "id":null,
            "ip_groups":[
               {
                  "id":"ipg-3rrky",
                  "related":"",
                  "resource_name":""
               }
            ],
            "operation_groups":[
               "MANAGEMENT",
               "SCHEMA"
            ],
            "resource_group":"multiple"
         }
      },
      "result":{
         "status":"SUCCESS",
         "data":{
            "id":"ipf-abcef"
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-filter=ipf-abcef",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:14:20.929Z",
   "type":"io.confluent.cloud/request"
}
```

### Failure

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"CreateIPFilter",
      "cloudResources":[
         {
            "resource":{
               "type":"ORGANIZATION",
               "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "filter_name":"US Offices",
            "id":"",
            "ip_groups":[
               {
                  "id":"ipg-notfound",
                  "related":"",
                  "resource_name":""
               }
            ],
            "operation_groups":[
               "SCHEMA"
            ],
            "resource_group":"multiple"
         }
      },
      "result":{
         "status":"FAILURE",
         "data":{
            "errors":[
               {
                  "detail":"invalid input: IP group does not exist",
                  "id":"53313aa8109a583e0ae800a57004c2eb",
                  "source":{},
                  "status":"400"
               }
            ]
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:14:20.929Z",
   "type":"io.confluent.cloud/request"
}
```

<a id="updateipfilter-examples"></a>

### UpdateIPFilter

The `UpdateIPFilter` method modifies the name, the IP groups, or the
operation groups of an existing IP filter. A request to update an IP filter
generates the `UpdateIPFilter` event.

To view example event messages, expand the Success or Failure dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"UpdateIPFilter",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_FILTER",
               "resourceId":"ipf-abcef"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "filter_name":"US Offices renamed",
            "id":"ipf-abcef",
            "ip_groups":[
               {
                  "id":"ipg-3rrky",
                  "related":"",
                  "resource_name":""
               }
            ],
            "operation_groups":[
               "SCHEMA"
            ],
            "resource_group":"multiple"
         }
      },
      "result":{
         "status":"SUCCESS",
         "data":{
            "id":"ipf-abcef"
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-filter=ipf-abcef",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:16:04.113Z",
   "type":"io.confluent.cloud/request"
}
```

### Failure

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"UpdateIPFilter",
      "cloudResources":[
         {
            "resource":{
               "type":"ORGANIZATION",
               "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "filter_name":"US Offices",
            "id":"ipf-notfound",
            "ip_groups":[
               {
                  "id":"ipg-3rrky",
                  "related":"",
                  "resource_name":""
               }
            ],
            "operation_groups":[
               "SCHEMA"
            ],
            "resource_group":"multiple"
         }
      },
      "result":{
         "status":"FAILURE",
         "data":{
            "errors":[
               {
                  "detail":"invalid input: IP filter does not exist",
                  "id":"53313aa8109a583e0ae800a57004c2eb",
                  "source":{},
                  "status":"400"
               }
            ]
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:16:04.113Z",
   "type":"io.confluent.cloud/request"
}
```

<a id="deleteipfilter-examples"></a>

### DeleteIPFilter

The `DeleteIPFilter` method removes an IP filter from the organization. A
request to delete an IP filter generates the `DeleteIPFilter` event.

To view an example event message, expand the following dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"DeleteIPFilter",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_FILTER",
               "resourceId":"ipf-abcef"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "id":"ipf-abcef"
         }
      },
      "result":{
         "status":"SUCCESS"
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-filter=ipf-abcef",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:22:47.507Z",
   "type":"io.confluent.cloud/request"
}
```

<a id="createipgroup-examples"></a>

### CreateIPGroup

The `CreateIPGroup` method creates an IP group from a set of CIDR blocks. A
request to create an IP group generates the `CreateIPGroup` event.

To view an example event message, expand the following dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"CreateIPGroup",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_GROUP",
               "resourceId":"ipg-3rrky"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "cidr_blocks":[
               "192.168.0.0/24"
            ],
            "group_name":"US Office Network",
            "id":""
         }
      },
      "result":{
         "status":"SUCCESS",
         "data":{
            "id":"ipg-3rrky"
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-group=ipg-3rrky",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:10:35.842Z",
   "type":"io.confluent.cloud/request"
}
```

<a id="updateipgroup-examples"></a>

### UpdateIPGroup

The `UpdateIPGroup` method modifies the name or the CIDR blocks of an
existing IP group. A request to update an IP group generates the
`UpdateIPGroup` event.

To view an example event message, expand the following dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"UpdateIPGroup",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_GROUP",
               "resourceId":"ipg-3rrky"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "cidr_blocks":[
               "192.168.0.0/24"
            ],
            "group_name":"US Office Network renamed",
            "id":"ipg-3rrky"
         }
      },
      "result":{
         "status":"SUCCESS",
         "data":{
            "id":"ipg-3rrky"
         }
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-group=ipg-3rrky",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:19:11.226Z",
   "type":"io.confluent.cloud/request"
}
```

<a id="deleteipgroup-examples"></a>

### DeleteIPGroup

The `DeleteIPGroup` method removes an IP group from the organization. A
request to delete an IP group generates the `DeleteIPGroup` event.

To view an example event message, expand the following dropdown:

### Success

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/service=cc-policy-service",
      "methodName":"DeleteIPGroup",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
                  }
               ]
            },
            "resource":{
               "type":"IP_GROUP",
               "resourceId":"ipg-3rrky"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-nxd3q3"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-nxd3q3"
      },
      "requestMetadata":{
         "requestId":[
            "53313aa8109a583e0ae800a57004c2eb"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request":{
         "accessType":"MODIFICATION",
         "data":{
            "id":"ipg-3rrky"
         }
      },
      "result":{
         "status":"SUCCESS"
      }
   },
   "subject":"crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/ip-group=ipg-3rrky",
   "specversion":"1.0",
   "id":"6a407325-7496-4291-8f37-8b58922470d6",
   "source":"crn://confluent.cloud/",
   "time":"2026-03-12T18:24:53.318Z",
   "type":"io.confluent.cloud/request"
}
```