How to block access to certain url if IP address not in list?

Only certain IP addresses should be allowed to visit URLs that start with mysubdomain.mydomain.com/wp-json.
I can't find this setting in Cloudflare.

I've tried it with a WAF rule to block when: (http.request.uri contains "mysubdomain.mydomain.com/wp-json" and ip.src ne 188.8.2.0) where the IP address is just a random ip address. Yet, with this rule in place, I can still visit the url.
Was this page helpful?