Port forwarding, dedicated IPs and bridged IPs

Open ports to equipment behind a device, and assign it dedicated or bridged public IP addresses, with the Partner API — list, add and remove each kind of rule.

Guide3 min readUpdated November 6, 2026

Reach a camera, server or other equipment behind a MergeWiFi device from the internet, or give the device its own public address. There are three kinds of rule, and each has the same three calls: list, add and remove.

Rule	What it does	List	Add	Remove
Port forwarding	Sends traffic for a public address and port to a device on the local network	GET/v1/devices/{uuid}/port_forwards	POST/v1/devices/{uuid}/port_forwards	DELETE/v1/devices/{uuid}/port_forwards/{rule_id}
Dedicated IP	Assigns the device a dedicated inbound address, optionally used for outbound traffic too	GET/v1/devices/{uuid}/dedicated_ips	POST/v1/devices/{uuid}/dedicated_ips	DELETE/v1/devices/{uuid}/dedicated_ips/{rule_id}
Bridged IP	Assigns the device a bridged public address, with its subnet and gateway	GET/v1/devices/{uuid}/bridged_ips	POST/v1/devices/{uuid}/bridged_ips	DELETE/v1/devices/{uuid}/bridged_ips/{rule_id}

Before you start

Scopes. Listing needs devices:read. Adding and removing need devices:write.
Capabilities. Your account needs the Devices module, plus port forwarding, dedicated IP addresses or bridged IP addresses switched on for the kind of rule you're using. Without it you get a 403 with the code not_entitled. GET/v1/me lists yours under entitlements.devices.
The device's id. Every call takes it, from GET/v1/devices.
A public address. inbound_ip has to be one of the public IPs in your account's pool. The API doesn't list the pool yet; in the partner portal, the device's Advanced tab shows the addresses you can pick when you add a rule.

Each list comes back whole, and each add answers with the device's full set of rules of that kind, so you always see the result in one response.

Port forwarding

Add a rule with POST/v1/devices/{uuid}/port_forwards:

curl https://cloud.mergewifi.com/v1/devices/0d5102c1-b8d2-4ba4-b6aa-43ed91d768c0/port_forwards \
  -X POST \
  -H "Authorization: Bearer $MERGEWIFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "inbound_ip": "203.0.113.10",
    "inbound_port": 8080,
    "internal_ip": "192.168.1.50",
    "internal_port": 80,
    "protocol": "TCP",
    "application_protocol": "HTTP"
  }'

{
  "object": "list",
  "data": [
    {
      "object": "port_forward",
      "id": "412",
      "inbound_ip": "203.0.113.10",
      "inbound_port": 8080,
      "internal_ip": "192.168.1.50",
      "internal_port": 80,
      "protocol": "TCP",
      "application_protocol": "HTTP",
      "source_ip": null
    }
  ],
  "has_more": false,
  "next_cursor": null
}

inbound_ip and inbound_port are the public address and port people connect to.
internal_ip and internal_port are the equipment on the device's local network that receives the traffic.
protocol is TCP, UDP or BOTH.
application_protocol is HTTP, HTTPS or OTHER, and defaults to OTHER.
source_ip is optional.
Ports run from 1 to 65535.

A rule counts as the same one when the inbound address and port, internal address and port, and protocol all match. It can take a minute to apply on the device. See what's there now with GET/v1/devices/{uuid}/port_forwards.

Dedicated IPs

Assign one with POST/v1/devices/{uuid}/dedicated_ips:

curl https://cloud.mergewifi.com/v1/devices/0d5102c1-b8d2-4ba4-b6aa-43ed91d768c0/dedicated_ips \
  -X POST \
  -H "Authorization: Bearer $MERGEWIFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "inbound_ip": "203.0.113.10" }'

{ "object": "dedicated_ip", "id": "77", "inbound_ip": "203.0.113.10", "outbound_traffic": false, "status": "active" }

Set "outbound_traffic": true to route the device's outbound traffic through this address as well; it's false if you leave it out. Each rule comes back with a status. It can take a few minutes to activate, so check GET/v1/devices/{uuid}/dedicated_ips for it.

Bridged IPs

Assign one with POST/v1/devices/{uuid}/bridged_ips:

curl https://cloud.mergewifi.com/v1/devices/0d5102c1-b8d2-4ba4-b6aa-43ed91d768c0/bridged_ips \
  -X POST \
  -H "Authorization: Bearer $MERGEWIFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "inbound_ip": "203.0.113.20" }'

{ "object": "bridged_ip", "id": "31", "inbound_ip": "203.0.113.20", "status": "active", "subnet": "255.255.255.248", "gateway": "203.0.113.17" }

Each bridged address comes back with its subnet and gateway. Like dedicated IPs, it can take a few minutes to activate; GET/v1/devices/{uuid}/bridged_ips shows where it stands.

Remove a rule

Take the rule's id from the list call, then delete it with DELETE/v1/devices/{uuid}/port_forwards/{rule_id}, DELETE/v1/devices/{uuid}/dedicated_ips/{rule_id} or DELETE/v1/devices/{uuid}/bridged_ips/{rule_id}:

curl https://cloud.mergewifi.com/v1/devices/0d5102c1-b8d2-4ba4-b6aa-43ed91d768c0/port_forwards/412 \
  -X DELETE \
  -H "Authorization: Bearer $MERGEWIFI_API_KEY"

A successful delete answers 204 with no body. The rule is checked against the device first, so an id from a different device returns 404 and nothing is removed.