---
title: "Replace workspace network policy"
method: PUT
path: "/v3/organizations/{orgId}/network-policy"
tags: ["Network policy"]
---

# Replace workspace network policy

`PUT /v3/organizations/{orgId}/network-policy`

## Request

- Base URL: `https://api.reasonmachines.com`
- URL: `https://api.reasonmachines.com/v3/organizations/{orgId}/network-policy`
- Auth: HTTP bearer

Requires network:write. Replaces the entire saved host list; [] clears it. Writes require a workspace owner or admin. Workspace hosts add allowed destinations to the platform baseline; an empty list does not remove baseline access. Changes apply at the next Hands start, not as immediate revocation of active leases.

<sub>Scope: `network:write`</sub>

## Request body

- ReplaceNetworkPolicy
  - `network_allowed_hosts` string[], required

## Response `200`

Saved network policy.

- NetworkPolicy
  - `network_allowed_hosts` string[], required

## Other responses

- `400`: Invalid request.
- `401`: Missing, invalid, or expired key.
- `403`: The key lacks the required scope or role.
- `429`: Too many requests. Retry after the number of seconds in the `Retry-After` response header.
- `503`: Product writes are disabled.

## Changes

- **2026-10-15** `85b2017ca5c4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ara/apis/reason-api/changes/v3/organizations/:orgId/network-policy/put.md)

---

[API](https://skmtc.dev/ara/apis/reason-api.md) - [All operations](https://skmtc.dev/ara/apis/reason-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ara/apis/reason-api/revisions/e97c8704807c?raw)