---
title: "Set the outbound connection rules"
method: PUT
path: "/api/egress/"
tags: ["Filters, rules and taint"]
---

# Set the outbound connection rules

`PUT /api/egress/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/egress/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Replaces one scope's outbound connection policy: its three settings and its whole ordered rule list, in one step. `mode` is untrusted (check only destinations that untrusted input chose) or all (check every connection); `default` is allow or deny (what happens when no rule matches); `on_violation` is block or report. Null or an empty string for any of the three means inherit. Each rule is {action: allow|deny, target, note}; a target is *, an IP address, a CIDR range, a host name, *.domain, @internal, @metadata, or an http(s) URL prefix, with an optional :port. Targets come back in canonical form. A bad row is a 400 naming the row number. At most 128 rules per scope. Machines pick the change up on their next config fetch, within about 30 seconds. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `machine` string: An es-python machine public_id; omit/empty for the account policy.
  - `mode` string, nullable: untrusted, all, or null to inherit.
  - `default` string, nullable: allow, deny, or null to inherit.
  - `on_violation` string, nullable: block, report, or null to inherit.
  - `rules` unknown[]: Ordered [{action, target, note}]. Replaces the stored list; [] or omitted clears it.
    - unknown

## Response `200`

OK. For example:

```
200 with the same body as GET, carrying the stored values.
```

- number

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)