I'm trying to get a better understanding of the extent that IP whitelisting helps to prevent attacks against an API.
At the moment I'm thinking of a B2B scenario where organisation A provides an API and organisation B consumes the API.
If the organisation A that is producing the API configures its API so that it will only accept IP addresses from organisation B, what additional security does it provide?
Note, this is inaction (OP: "in addition"?) to other security measures such as Shared secret + TLS or Mutual TLS.
I understand that it will have some effect on a denial of service attack and can (OP: finish this sentence?)