Use approved domains to restrict which origins can call an agent’s /completions endpoint.
Each agent has a list of approved domains.
- If the approved domains list is empty, requests from any origin are accepted.
- If the approved domains list has entries, only requests whose
Origin header or referrer matches an approved domain are accepted: all others receive a 403.
Approved domain matching
Approved domains are matched against the request’s Origin (or referrer) header:
| Pattern | Example | Matches |
|---|
| Exact host | myapp.example.com | https://myapp.example.com |
| Full URL | https://myapp.example.com | Matches myapp.example.com |
| Wildcard | *.example.com | Any subdomain, for example https://sub.example.com |
Add approved domains
This operation requires an API key with the editSettings ACL.
For example, to add a domain to an agent’s approved list:
curl -X POST "https://$ALGOLIA_APPLICATION_ID.algolia.net/agent-studio/1/agents/$AGENT_ID/allowed-domains" \
-H 'Content-Type: application/json' \
-H "x-algolia-application-id: $ALGOLIA_APPLICATION_ID" \
-H "x-algolia-api-key: $ALGOLIA_API_KEY" \
-d '{ "domain": "https://myapp.example.com" }'
Add multiple domains
For example:
curl -X POST "https://$ALGOLIA_APPLICATION_ID.algolia.net/agent-studio/1/agents/$AGENT_ID/allowed-domains/bulk" \
-H 'Content-Type: application/json' \
-H "x-algolia-application-id: $ALGOLIA_APPLICATION_ID" \
-H "x-algolia-api-key: $ALGOLIA_API_KEY" \
-d '{ "domains": ["https://app2.example.com", "*.allowed.com"] }'
The API skips duplicates for the same agent.
List approved domains
curl "https://$ALGOLIA_APPLICATION_ID.algolia.net/agent-studio/1/agents/$AGENT_ID/allowed-domains" \
-H "x-algolia-application-id: $ALGOLIA_APPLICATION_ID" \
-H "x-algolia-api-key: $ALGOLIA_API_KEY"
Response
{
"domains": [
{
"id": "8b77f421-4a22-4405-a01a-49f21631e56b",
"domain": "https://myapp.example.com",
"createdAt": "2026-04-27T12:00:00Z",
"updatedAt": "2026-04-27T12:00:00Z"
}
]
}
Remove approved domains
Remove one domain
Remove several domains
curl -X DELETE "https://$ALGOLIA_APPLICATION_ID.algolia.net/agent-studio/1/agents/$AGENT_ID/allowed-domains/$DOMAIN_ID" \
-H "x-algolia-application-id: $ALGOLIA_APPLICATION_ID" \
-H "x-algolia-api-key: $ALGOLIA_API_KEY"
Bulk delete by a list of domain ids:curl -X DELETE "https://$ALGOLIA_APPLICATION_ID.algolia.net/agent-studio/1/agents/$AGENT_ID/allowed-domains/bulk" \
-H 'Content-Type: application/json' \
-H "x-algolia-application-id: $ALGOLIA_APPLICATION_ID" \
-H "x-algolia-api-key: $ALGOLIA_API_KEY" \
-d '{ "domain_ids": ["8b77f421-4a22-4405-a01a-49f21631e56b"] }'
Blocked requests
If a request’s Origin header or referrer doesn’t match an approved domain, the API returns a 403 response:
{
"message": "Request blocked for this domain"
}
Origin header or referrer are also blocked.
See also
