Securing APIs by IP address - API Platform & Symfony

Question

I've got my API made with API platform and Symfony but I'm having problems securing my endpoints. I have my documentation on the basic URL: api.domaine.com and access points: /articles/stocks for example. I have this in my security file:

access_control:
        - { path: ^/$, roles: PUBLIC_ACCESS }
        - { path: ^/*, roles: IS_AUTHENTICATED_ANONYMOUSLY, ips: [ 109.239.112.139, 45.10.152.49 ] }

For the documentation, it works well, and my endpoints are all open even with IP restriction. I can't understand why my endpoints are open even with the IPS rules.

Do you have an idea?

I tried to work with the roles like this:

access_control:
        - { path: ^/$, roles: PUBLIC_ACCESS }
        - { path: ^/*, roles: ROLE_IP_USER, ips: [ 109.239.112.139, 45.10.152.49 ] }

and I have also tried this in my entities :

#[ApiResource(
    operations: [
        new Get(),
        new GetCollection(),
    ],
    order: ['createdAt' => 'DESC'],
    paginationClientItemsPerPage: true,
    paginationItemsPerPage: 30,
    security: 'is_granted(\'ROLE_IP_USER\')'
)]