Docs
⌘K
Outbound rules ›

Set network

PUT/v1/sandboxes/{id}/network

Sets the addresses the sandbox may reach on top of its template's outbound rule, in place of the ones it had. They add to what the template lets out and never take from it: on an open template they change nothing until the template is blocked or an allowlist. The sandbox is held to its template's rule with these on top from when this answers, without a restart, running or stopped, and connections that are already open are not cut. The rule itself is its template's, and is changed with PUT /v1/templates/{id}/network: sending outbound here is refused with rule_on_template. What is sent to the sandbox, commands, files, its public addresses and SSH, is not affected. Only where GET /v1/policy says networkPolicy.

RequestTypeScript
  1. import { Agental } from "agental-sdk";
  3. const agental = new Agental();
  4. const sandbox = await agental.sandboxes.get("sbx_2a9a47e50daec64a");
  5. await sandbox.setNetwork({ allow: ["203.0.113.7"] });
Answer200 OK · SandboxNetworkDetail
  1. {
  2. "outbound": "open" | "blocked" | "allowlist",
  3. "allow": string[],
  4. "template": {
  5. "templateId": string,
  6. "name": string,
  7. "outbound": "open" | "blocked" | "allowlist",
  8. "allow": string[],
  9. },
  10. "own": {
  11. "allow": string[],
  12. },
  13. }

The rule the sandbox is held to from now on, and what it comes from, with each address written one way.

Path

idrequired
string
 e.g. "sbx_0123456789abcdef"

Headers

Authorizationrequired
Bearer key
An API key that may make this call.

Body

allowrequired
array of string
The addresses the sandbox may reach on top of its template's outbound rule, in place of the ones it had. An empty list takes them all away. IPv4 addresses and ranges, as 203.0.113.7 or 198.51.100.0/24, 100 at most. Names are not taken, and nor is a range inside a private network. A range is kept by its first address, so 198.51.100.7/24 comes back as 198.51.100.0/24. With its template's addresses they come to 100 at most. e.g. ["192.0.2.99"]

Returns

200 The rule the sandbox is held to from now on, and what it comes from, with each address written one way.

SandboxNetworkDetail4 fields
outbound
openblockedallowlist
The rule the sandbox is held to now, as network on the sandbox says it: its template's rule as its copy has it, with its own addresses on top.
allow
string[]
The addresses an allowlist lets out to: its template's, then its own.
More Empty for open and blocked.
template
object4 fields
Its template's rule as the sandbox has it: as it was when the sandbox last started, was put on the template, or was named by POST /v1/templates/{id}/apply.
More GET /v1/sandboxes/{id}/template says whether that is the template as it is now.
templateId
string
name
string
outbound
openblockedallowlist
allow
string[]
own
object1 field
The addresses it may reach on top of its template's rule.
More They add to an allowlist, make a blocked template's rule an allowlist of them, and change nothing while the template is open.
allow
string[]

Errors and other answers

400invalid_network_policy an address cannot be allowed, or the list itself holds more than 100, and the message says which and why.
400rule_on_template outbound was sent, and the message says where a rule is set now.
404 Not found.
409too_many_addresses the list is of 100 or fewer, and with its template's addresses, as the sandbox has them or as the template is now, they come to more than 100. sandbox_archived or sandbox_migrating: the sandbox's machine is not where sandboxes run. Start it, or read it until it is no longer migrating, and send it again.
409invalid_state the sandbox is neither running nor stopped. Nothing was changed.
501network_policy_unavailable addresses were sent where GET /v1/policy says networkPolicy is false. Nothing was changed.

Every error answers { "error": { "code", "message" } }; a key without the action a call needs answers 403 key_action_forbidden, naming it.

← Get networkList sandbox host routes →