Emergency Release: Country Restriction and Per-IP Rate Limit for APIs
Published: 2026-11-06
To strengthen protection against unauthorized access, we have made an emergency release of the following two features in the API [Security] settings.
- Country restriction: Limits access to an API to requests from the countries you specify.
- Rate limit per IP address: Limits the number of requests a single IP address can send to an API.
As announced in the notice of 2026-10-20, attempts to log in with leaked IDs and passwords are increasing. Our analysis of Kuroco logs shows that many recent AI-driven attacks come from a single IP address, which makes the rate limit per IP address effective against them. Please consider using these features to curb large volumes of attempts against publicly exposed APIs such as login APIs. We also ask that you review your API permission settings.
How to configure
In the side menu, click [API], select the target API, and click [Security]. Configure each item on the screen that appears, then save.
Country restriction
Under [Access restriction], select the countries allowed to access the API in [Country restriction]. You can specify multiple countries.
- When both [IP address restriction] and [Country restriction] are set, a request that matches either one is allowed. For example, you can allow specific locations such as partner companies with the IP address restriction, and allow general users with the country restriction.
- A request whose country cannot be determined is refused unless the IP address restriction allows it.
- A refused request receives the same error as the IP address restriction (
IP address is out of range.). The response does not indicate whether the request was refused by the country restriction or the IP address restriction.
The country is determined from the source IP address and is not always accurate. A request actually sent from within your country may be identified as coming from another country.
Before setting a country restriction, check which countries requests are coming from in the [Country code] column of the API log. Make sure there is no legitimate access from countries you do not plan to allow, and then decide which countries to allow.
Requests from users on business trips abroad and through VPNs or cloud services routed via overseas servers are also refused. Confirm every source that uses the API before configuring this setting.
Rate limit per IP address
In [Rate limit per IP address], set the number of requests a single IP address can send to this API within the specified number of seconds.
| Item | Description |
|---|---|
| Requests (Hit) | Specify a value from 0 to 720000. Leave it empty or set 0 for no limit. |
| Seconds | The period over which requests are counted. Specify a value from 1 to 3600 seconds. The default is 60 seconds. |
- Requests are counted as the total across all endpoints in the API.
- Requests that exceed the limit receive 429 Too Many Requests with a
Retry-Afterheader (the number of seconds until the client can retry). - You can check the limit status in the following response headers.
- Limit:
x-rcms-ip-ratelimit-limit - Remaining requests:
x-rcms-ip-ratelimit-remaining - Time until reset:
x-rcms-ip-ratelimit-reset
- Limit:
- Responses served from the CDN cache are not counted.
- Requests refused by the IP address restriction are not counted. Requests from IP addresses allowed by the IP address restriction are counted.
- Requests to the MCP server (
/rcms-api/{api_id}/mcp) are not subject to this limit.
On corporate networks or mobile connections, multiple users may share the same IP address. Set the limit with enough headroom for the expected usage.
Difference from the endpoint rate limit
The [Rate limit] in the endpoint settings counts the total of all requests to the endpoint, not per source IP address or access token. To limit large volumes of requests from a specific IP address, use [Rate limit per IP address].
For details, see Endpoint settings.
Configuring with Admin MCP
With Admin MCP api-upsert, you can configure these features with the following parameters.
| Feature | Parameters |
|---|---|
| Country restriction | country_whitelist (ISO 3166-1 alpha-2 country codes, e.g. JP) |
| Rate limit per IP address | ip_rate_limit_req (requests), ip_rate_limit_slot (seconds) |
Like ip_whitelist, country_whitelist can only be changed with the mcp:admin scope.
Please Review Your API Permission Settings
The country restriction and rate limit control where requests come from and how many are accepted. The range of data that can be read or updated through an API is determined by its permission settings. Please review your current settings from the following perspectives.
- Security type: Check that APIs whose [Security] is
Nonedo not expose endpoints that read or update non-public data. - API request restriction: For endpoints that should be available only to logged-in members, check that [API request restriction] is set to
GroupAuthorMemberCustomSearchAuth. - Group permissions: Check that the groups of members who use the API are not granted more permissions than necessary.
- Static access tokens: Check that no unnecessary static access tokens or static tokens with privileges remain.
- CORS: Check that the allowed origins in [CORS] do not include unnecessary origins.
For configuration details, see the following.
Security Settings Assessment with AI Agents
With Admin MCP and kuroco-security-audit in Kuroco Skills, an AI agent can check settings such as API security types, CORS, IP address restrictions, login and password policies, two-factor authentication, permission groups and superusers, and static access tokens against a checklist, and produce a report. kuroco-security-audit is read-only and does not change any settings.
Ask your AI agent, for example:
"Check whether there are any problems with our security settings"
"Review the CORS and IP restriction settings"
"Take inventory of permission groups and superusers"
We also offer the paid Kuroco Configuration Security Assessment, in which the Kuroco team assesses your settings and reports risks and remediation guidance.
For details, see the Security Center.
Kuroco's Ongoing Efforts
AI-driven attacks are expected to keep evolving. Kuroco will continue to strengthen its features with a focus on security. We also ask that you make use of the security settings assessment and other measures to build a robust system.
Contact
If you have any questions about this matter, please feel free to contact Kuroco support.
Related Documents
Support
If you have any other questions, please contact us or check out Our Slack Community.