You have it right. To restrict who can use the application programming interface (API), administrators can create IP-allow lists in Directus. This ensures that only authorised users and systems are able to access the platform.