ArcGIS Enterprise currently allows administrators to enable or disable the ArcGIS Server Services Directory globally. This is useful for reducing public exposure, but it is too broad for secure enterprise deployments.
Many organizations need to keep REST API access available for applications, ArcGIS Pro, Field Maps, Survey123, integrations, and Portal workflows, while restricting only the browsable HTML REST directory to trusted administrator or internal IP ranges.
Requested enhancement:
Add built-in IP allowlist controls for REST directory browsing in ArcGIS Enterprise, including:
ArcGIS Server Services Directory browsing, for example /rest/services
Portal Sharing REST directory browsing, for example /sharing/rest
Optional separate controls for Admin Directory and Manager endpoints
Support for client IP and trusted proxy headers such as X-Forwarded-For
Ability to allow JSON/API calls while blocking browsable HTML directory pages from untrusted IPs
Configuration through Server Manager, Portal Admin, and/or Admin REST API
Example behavior:
Users and applications can still access valid REST API requests such as ?f=json or authenticated service requests.
The HTML REST directory page is only visible from approved IP ranges.
External users outside the allowlist receive a configurable 403 response or redirect.
Administrators can audit denied REST directory browsing attempts.
Business/security value:
This would help organizations meet security and compliance requirements without breaking ArcGIS Enterprise workflows. Today, administrators must implement this through external controls such as F5, WAF, IIS URL Rewrite, reverse proxy rules, or custom network policies. A native product feature would reduce operational risk and make the behavior consistent across Portal, ArcGIS Server, and Web Adaptor deployments.
This is especially important for public-facing or geo-restricted ArcGIS Enterprise deployments where the REST API must remain available to authorized users and applications, but service discovery and browsable REST directory pages should be limited to trusted networks.
