Skip to main content
PUT
Update sandbox network

Authorizations

X-API-Key
string
header
required

Path Parameters

sandboxID
string
required

Body

application/json

Network configuration update for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting a field clears it.

allowOut
string[]

List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.

denyOut
string[]

List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.

egressProxy
object | null

SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain).

rules
object

Per-domain transform rules applied to matching outbound HTTPS requests. Replaces all existing rules when provided. Keys may be exact DNS names or a single leading wildcard (for example, ".example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination.

allow_internet_access
boolean

Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config.

Response

Successfully updated the sandbox network configuration