On /subnets/{id}, panel Excludes. Admin only.
- Start IP (required).
- End IP (blank = same as start).
- Add exclude.
The range must sit in the subnet CIDR. A reservation may not land in an exclude (API returns 422).
Excludes shrink free on purpose. They are not counted as managed IPs.
Typical lab: exclude the gateway you set on the subnet. Typical production: exclude the network/broadcast, router, and any anycast VIP that lives in the same CIDR.
To give that address to a known DHCP client, use a reservation, not an exclude. Header search for an IP will show exclude if it sits in one of these ranges.