---
title: "Update sandbox network"
method: PUT
path: "/sandboxes/{sandboxID}/network"
tags: ["sandboxes"]
---

# Update sandbox network

`PUT /sandboxes/{sandboxID}/network`

Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it.

## Path parameters

- `sandboxID` string, required

## Request body

- SandboxNetworkUpdateConfig — Network configuration update for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting a field clears it.
  - `allowOut` string[] — List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
  - `denyOut` string[] — List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.
  - `egressProxy` SandboxEgressProxyConfig, nullable — SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain).
    - `address` string, required — SOCKS5 proxy address in host:port format (e.g. "proxy.example.com:1080").
    - `username` string — Optional SOCKS5 username (RFC 1929), max 255 bytes.
    - `password` string — Optional SOCKS5 password (RFC 1929), max 255 bytes.
  - `rules` object — Per-domain transform rules. Replaces all existing rules when provided.
  - `allow_internet_access` boolean — Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config.

## Response `204`

Successfully updated the sandbox network configuration

## Other responses

- `401` — Authentication error
- `404` — Not found
- `409` — Conflict
- `500` — Server error

## Changes

> 53 revisions in range; 4 could not be searched.

- **2026-07-24** `93ed246a4c10` — 3 info
  - the endpoint scheme security `AdminApiKeyAuth AND AdminTeamAuth` was added to the API
  - the endpoint scheme security `Supabase1TokenAuth AND Supabase2TeamAuth` was removed from the API
  - added the new optional request property `egressProxy`
- **2026-05-27** `e13ef89d456c` — 1 info
  - the endpoint scheme security `AuthProviderBearerAuth AND AuthProviderTeamAuth` was added to the API
- **2026-05-26** `6c40e6f50bad` — 1 info
  - endpoint added
- **2023-11-15** `897ba2f1c7b6` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/e2b-dev/apis/e2b-api/changes/sandboxes/:sandboxID/network/put.md)

---

[API](https://skmtc.dev/e2b-dev/apis/e2b-api.md) · [All operations](https://skmtc.dev/e2b-dev/apis/e2b-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/e2b-dev/e2b-api/revisions/e01b3f5506fe/schema)