--- name: hs-crypto-settings-network-policy title: Managing the network access policy description: After you set up your IBM Cloud® Hyper Protect Crypto Services instance, you manage network access policy by using the Hyper Protect Crypto Services key management service API. last-updated: 2026-07-01 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Managing the network access policy {: #managing-network-access-policies} IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted. {: deprecated} After you set up your IBM Cloud® Hyper Protect Crypto Services instance, you manage network access policy by using the Hyper Protect Crypto Services key management service API. {: shortdesc} Before you update the network access policy, you need to initialize the service instance first. See [Initializing service instances with the IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm&format=markdown) or [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities&format=markdown) for instructions. {: important} For more information about how the network access differs, see [Understanding the network access policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connection&format=markdown#understand-network-access-policies). ## Updating the network access policy for your Hyper Protect Crypto Services instance with the UI {: #update-network-access-policy-ui} {: ui} As a security administrator, if you prefer to update the network access policy for your instance by using a graphical interface, you can use the UI. After the network access policy is set to `private-only`, the UI cannot be used for any Hyper Protect Crypto Services actions. Any Hyper Protect Crypto Services operations in the UI return an unauthorized error (HTTP status code 401). {: note} After you create a Hyper Protect Crypto Services instance, complete the following steps to create a network access policy: 1. [Log in to the UI](https://cloud.ibm.com/){: external}. 2. Go to **Menu** > **Resource list** to view a list of your resources. 3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services. 4. In the UI of the selected service instance, select the **Instance policies** tab in the side menu. 5. In the **Allowed network** section, select the network that you want traffic to come through, and click **Save policy**. The default network policy is public and private, which allows access from both public and private networks. If a private-only network is enabled, you are not able to view or manage keys with the UI. However, you can still adjust the network setting later by using the API or CLI. {: note} ## Updating the network access policy for your Hyper Protect Crypto Services instance with the key management service API {: #update-network-access-policy-api} {: api} As a security administrator, update the network access policy for your Hyper Protect Crypto Services instance by making a `PUT` call to the following endpoint. See these API references to [set](https://cloud.ibm.com/apidocs/hs-crypto#putinstancepolicy){: external} and [list](https://cloud.ibm.com/apidocs/hs-crypto#getinstancepolicy){: external} instance policies. ``` https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork ``` {: codeblock} 1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api&format=markdown). To change a network access policy, you must be assigned a _Manager_ access policy for your Hyper Protect Crypto Services instance. To learn how IAM (identity and access management) roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access&format=markdown#service-access-roles). {: note} 2. Update the network access policy for your Hyper Protect Crypto Services instance by running the following cURL command. ```sh $ curl -X PUT \ "https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork" \ -H "accept: application/vnd.ibm.kms.policy+json" \ -H "authorization: Bearer " \ -H "bluemix-instance: " \ -H "content-type: application/vnd.ibm.kms.policy+json" \ -d '{ "metadata": { "collectionType": "application/vnd.ibm.kms.policy+json", "collectionTotal": 1 }, "resources": [ { "policy_type": "allowedNetwork", "policy_data": { "enabled": true, "attributes": { "allowed_network": "" } } } ] }' ``` {: codeblock} Replace the variables in the example request according to the following table. | Variable | Description | | --- | --- | | `region` | **Required.** The region abbreviation, such as `us-south` or `eu-de`, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown#service-endpoints). | | `port` | **Required.** The port number of the API endpoint. | | `IAM_token` | **Required.** Your IBM Cloud access token. Include the full contents of the `IAM` token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token&format=markdown). | | `instance_ID` | **Required.** The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID&format=markdown). | | `enabled` | **Required.** Set to `true` to enable a network access policy. | | `access_type` | **Required.** The network access policy to apply to your Hyper Protect Crypto Services instance. Acceptable values are `public-and-private` or `private-only`. After the network access policy is set to `private-only`, you cannot access your instance from the public network and cannot view or manage keys with the UI. However, you can still adjust the network setting later using the API or CLI. | {: caption="Describes the variables needed to set a network access policy at the instance level" caption-side="bottom"} A successful request returns an HTTP `204 No Content` response, which indicates that your Hyper Protect Crypto Services instance now enforces a network access policy. API requests to the service are restricted to the policy that you set. This policy applies to Hyper Protect Crypto Services instances only. The network access policy does not apply to specific keys. 3. Optional: Verify that the network access policy is created by browsing the policies that are available for your Hyper Protect Crypto Services instance. ```sh $ curl -X GET \ "https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork" \   -H "accept: application/vnd.ibm.kms.policy+json" \   -H "authorization: Bearer " \   -H "bluemix-instance: " ``` {: codeblock} ## Updating the network access policy for your Hyper Protect Crypto Services instance with the CLI {: #update-network-access-policy-cli} {: cli} You can also update the network access policy for your Hyper Protect Crypto Services instance using the CLI. For more information, see [the CLI reference](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference&format=markdown#kp-instance-policy-update-allowed){: external}. ## Disabling the network access policy for your Hyper Protect Crypto Services instance with the key management service API {: #disable-network-access-policy-api} {: api} As a security administrator, disable a network access policy for a Hyper Protect Crypto Services instance by making a `PUT` call to the following endpoint. See these API references to [set](https://cloud.ibm.com/apidocs/hs-crypto#putinstancepolicy){: external} and [list](https://cloud.ibm.com/apidocs/hs-crypto#getinstancepolicy){: external} instance policies. ``` https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork ``` {: codeblock} 1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api&format=markdown). To change a network access policy, you must be assigned a _Manager_ access policy for your Hyper Protect Crypto Services instance. To learn how IAM (identity and access management) roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access&format=markdown#service-access-roles). {: note} 2. Disable a network access policy for your Hyper Protect Crypto Services instance by running the following cURL command. ```sh $ curl -X PUT \ "https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork" \ -H "accept: application/vnd.ibm.kms.policy+json" \ -H "authorization: Bearer " \ -H "bluemix-instance: " \ -H "content-type: application/vnd.ibm.kms.policy+json" \ -d '{ "metadata": { "collectionType": "application/vnd.ibm.kms.policy+json", "collectionTotal": 1 }, "resources": [ { "policy_type": "allowedNetwork", "policy_data": { "enabled": false, "attributes": { "allowed_network": "private-only" } } } ] }' ``` {: codeblock} Replace the variables in the example request according to the following table. | Variable | Description | | --- | --- | | `region` | **Required.** The region abbreviation, such as `us-south` or `eu-de`, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown#service-endpoints). | | `port` | **Required.** The port number of the API endpoint. | | `IAM_token` | **Required.** Your IBM Cloud access token. Include the full contents of the `IAM` token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token&format=markdown). | | `instance_ID` | **Required.** The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID&format=markdown). | | `enabled` | **Required.** Set to `false` to remove the network access policy, that is, the policy is not enforced and your service instance is back to the default state where both the public and private network access are allowed. | {: caption="Describes the variables needed to disable a network access policy at the instance level" caption-side="bottom"} A successful request returns an HTTP `204 No Content` response, which indicates that the network access policy of your Hyper Protect Crypto Services instance is updated. 3. Optional: Verify that the network access policy is disabled by browsing the policies that are available for your Hyper Protect Crypto Services instance. ```sh $ curl -X GET \ "https://.api..hs-crypto.appdomain.cloud/api/v2/instance/policies?policy=allowedNetwork" \   -H "accept: application/vnd.ibm.kms.policy+json" \   -H "authorization: Bearer " \   -H "bluemix-instance: " ``` {: codeblock}