E2e2b-dev
sandboxes

Update sandbox network

Changed on

Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it.

put/sandboxes/{sandboxID}/network

Request

  • Base URL
    https://api.e2b.app
  • URL
    https://api.e2b.app/sandboxes/{sandboxID}/network
  • Auth
    • API key in header X-API-Key
    • or HTTP bearer and API key in header X-Team-ID
    • or API key in header X-Admin-Token and API key in header X-Team-ID
    • or HTTP bearer and API key in header X-Team-ID

Path parameters

sandboxIDstring required

Request body

allowOutstring[]

List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries. When allowOut contains a domain, the servers in dnsServers (8.8.8.8 by default) are also allowed.

denyOutstring[]

List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.

dnsServersstring[]

DNS servers the sandbox can reach when allowOut contains a domain. Each entry must be an IPv4 address, and all traffic to it is allowed. Omit it to reset to the default nameserver 8.8.8.8, or pass an empty list to allow none. This does not change the sandbox's /etc/resolv.conf.

rulesobject

Per-domain transform rules applied to matching outbound HTTPS requests. Replaces all existing rules when provided. Keys may be exact DNS names or a single leading wildcard (for example, ".example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination.

allow_internet_accessboolean

Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config.

Response

Successfully updated the sandbox network configuration

Changes