---
title: "Restrict guest agent access"
method: POST
path: "/api/v1/apps/{app_id}/guest-agent-access/restrict"
tags: ["Apps", "apps-guest-agent-access"]
---

# Restrict guest agent access

`POST /api/v1/apps/{app_id}/guest-agent-access/restrict`

## Request

- Base URL: `https://cloud-api.phala.com`
- URL: `https://cloud-api.phala.com/api/v1/apps/{app_id}/guest-agent-access/restrict`
- Auth: none declared
- TypeScript: <https://skmtc.dev/phala/apis/phala-cloud-api/docs/api/v1/apps/:app_id/guest-agent-access/restrict/post.ts> (a function with typed inputs; its response is checked against the schema)

Restricts the app's guest agent (port 8090) to Phala Cloud by setting enabled_guest_agent_access to false. Repeating the call changes nothing. Relaxing the restriction requires Phala Cloud support. Returns the app detail.

## Path parameters

- `app_id` string, required: Hex app identifier

## Response `200`

App details with enabled_guest_agent_access false

- union
  - TeehouseApiRoutesWorkspaceAppsV20251028SchemasDstackAppFullResponse
    - `id` string, hashid, required: A hashed identifier that maps to an internal database ID
    - `name` string, required
    - `app_id` string, required
    - `app_provision_type` string, nullable
    - `app_icon_url` string, nullable
    - `created_at` string, required
    - `enabled_guest_agent_access` boolean, required: Stored guest agent access choice. False means port 8090 is restricted to Phala Cloud. This is the requested value, not the mode a node reports.
    - `kms_type` string, required
    - `profile` ProfileGetResponse: Response model for entity profile - only public display data.
      - `display_name` string, nullable
      - `avatar_url` string, nullable
      - `description` string, nullable
      - `custom_domain` string, nullable
    - `current_cvm` TeehouseApiRoutesWorkspaceAppsV20251028SchemasCvmBasicInfo
      - `vm_uuid` string, nullable, required
      - `app_id` string, required
      - `name` string
      - `status` string, required
      - `vcpu` integer, required
      - `memory` integer, required
      - `disk_size` integer, required
      - `teepod_id` integer, required
      - `teepod_name` string, required
      - `region_identifier` string, nullable, required
      - `kms_type` string, nullable, required
      - `instance_type` string, nullable, required
      - `listed` boolean, nullable
      - `base_image` string, nullable
      - `kms_slug` string, nullable
      - `kms_id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
      - `kms_contract_id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
      - `instance_id` string, nullable
      - `machine_info` MachineInfo: CVM hardware configuration.
        - `vcpu` integer, required: Virtual CPU count
        - `memory` integer, required: Memory in MB
        - `disk_size` integer, required: Disk size in GB
        - `gpu_count` integer, required: GPU count (0 if none)
      - `updated_at` string, date-time, nullable
      - `enabled_ssh_access` boolean, required: True when SSH access is enabled for this CVM (today: it runs a dev OS image).
    - `cvms` TeehouseApiRoutesWorkspaceAppsV20251028SchemasCvmBasicInfo[]
      - `vm_uuid` string, nullable, required
      - `app_id` string, required
      - `name` string
      - `status` string, required
      - `vcpu` integer, required
      - `memory` integer, required
      - `disk_size` integer, required
      - `teepod_id` integer, required
      - `teepod_name` string, required
      - `region_identifier` string, nullable, required
      - `kms_type` string, nullable, required
      - `instance_type` string, nullable, required
      - `listed` boolean, nullable
      - `base_image` string, nullable
      - `kms_slug` string, nullable
      - `kms_id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
      - `kms_contract_id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
      - `instance_id` string, nullable
      - `machine_info` MachineInfo: CVM hardware configuration.
        - `vcpu` integer, required: Virtual CPU count
        - `memory` integer, required: Memory in MB
        - `disk_size` integer, required: Disk size in GB
        - `gpu_count` integer, required: GPU count (0 if none)
      - `updated_at` string, date-time, nullable
      - `enabled_ssh_access` boolean, required: True when SSH access is enabled for this CVM (today: it runs a dev OS image).
    - `cvm_count` integer
    - `team_slug` string, nullable
    - `team_name` string, nullable
  - TeehouseApiRoutesWorkspaceAppsV20260121SchemasDstackAppFullResponse
    - `id` string, hashid, required: A hashed identifier that maps to an internal database ID
    - `name` string, required
    - `app_id` string, required
    - `app_provision_type` string, nullable
    - `app_icon_url` string, nullable
    - `created_at` string, required
    - `enabled_guest_agent_access` boolean, required: Stored guest agent access choice. False means port 8090 is restricted to Phala Cloud. This is the requested value, not the mode a node reports.
    - `kms_type` string, required
    - `profile` ProfileGetResponse: Response model for entity profile - only public display data.
      - `display_name` string, nullable
      - `avatar_url` string, nullable
      - `description` string, nullable
      - `custom_domain` string, nullable
    - `current_cvm` TeehouseApiRoutesCvmsV20260121SchemasCVMInfo
      - `id` string, hashid, required: A hashed identifier that maps to an internal database ID
      - `name` string, required
      - `app_id` string, nullable
      - `vm_uuid` string, nullable
      - `instance_id` string, nullable
      - `resource` CVMResourceInfo, required
        - `instance_type` string, nullable
        - `vcpu` integer, nullable
        - `memory_in_gb` number, nullable
        - `disk_in_gb` integer, nullable
        - `gpus` integer, nullable
        - `compute_billing_price` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `billing_period` 'skip' | 'hourly' | 'monthly'
      - `node_info` NodeRef: Minimal node/teepod reference for embedding in responses.
        - `object_type` 'node': Fixed value 'node'
        - `id` integer, nullable: Teepod numeric ID
        - `node_id` integer, nullable: Physical node numeric ID
        - `node` string, nullable: Physical node name
        - `name` string, nullable: Node display name
        - `region` string, nullable: Region identifier
        - `device_id` string, nullable: Resolved single device ID (deprecated)
        - `device_ids` NodeDeviceIdOut[]: All device_ids configured for this node
          - `device_id` string, required: Device identifier
          - `algorithm_version` string, required: Semver of the derivation algorithm that produced this device_id
          - `enabled` boolean, required: Whether this device_id is active
        - `ppid` string, nullable: PPID
        - `status` 'ONLINE' | 'OFFLINE' | 'MAINTENANCE'
        - `version` string, nullable: Teepod version
      - `os` CVMOSInfo
        - `name` string, nullable
        - `version` string, nullable
        - `is_dev` boolean, nullable
        - `os_image_hash` string, nullable
      - `kms_type` 'phala' | 'ethereum' | 'base' | 'local' | 'legacy'
      - `kms_info` CVMKmsInfo
        - `chain_id` integer, nullable
        - `dstack_kms_address` string, nullable
        - `dstack_app_address` string, nullable
        - `deployer_address` string, nullable
        - `rpc_endpoint` string, nullable
        - `encrypted_env_pubkey` string, nullable
        - `k256_pubkey` string, nullable
      - `status` string, required
      - `in_progress` boolean
      - `progress` CVMProgressInfo
        - `target` string, nullable
        - `started_at` string, date-time, nullable
        - `correlation_id` string, nullable
      - `compose_hash` string, nullable
      - `docker_compose_hash` string, nullable
      - `pre_launch_script_hash` string, nullable
      - `gateway` CVMGatewayInfo, required
        - `base_domain` string, nullable
        - `cname` string, nullable
      - `logs` CVMLogUrls
        - `serial` string, nullable
        - `stdout` string, nullable
        - `stderr` string, nullable
        - `container_log_base` string, nullable
      - `services` object[]
      - `endpoints` CvmNetworkUrls[], nullable
        - `app` string, required
        - `instance` string, required
      - `public_logs` boolean
      - `public_sysinfo` boolean
      - `public_tcbinfo` boolean
      - `gateway_enabled` boolean
      - `secure_time` boolean
      - `managed_env` boolean
      - `enabled_ssh_access` boolean, required
      - `storage_fs` string
      - `workspace` WorkspaceRef: Minimal workspace reference for embedding in responses.
        - `object_type` 'workspace': Fixed value 'workspace'
        - `id` string, hashid, required: Hashed workspace ID
        - `name` string, required: Workspace display name
        - `slug` string, nullable: URL-safe workspace identifier
        - `avatar_url` string, nullable: Workspace avatar URL from profile
      - `creator` UserRef: Minimal user reference for embedding in responses.
        - `object_type` 'user': Fixed value 'user'
        - `id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
        - `username` string, nullable: Display username
        - `avatar_url` string, nullable: Gravatar or OAuth provider avatar URL
      - `hourly_rate` CVMHourlyRate
        - `total` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `compute` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `disk` string, decimal, nullable: A monetary value with precise decimal arithmetic
      - `billing_interval` 'hourly' | 'monthly' | 'unmetered', nullable
      - `gpu_rental_order` CVMGpuRentalOrderInfo
        - `order_id` string, hashid, required: A hashed identifier that maps to an internal database ID
        - `status` 'pending' | 'provisioning' | 'active' | 'teardown' | 'completed' | 'cancelled', required: Lifecycle states for GPU rental orders.
        - `pricing_plan` 'on_demand' | 'commitment': Pricing plan for GPU SKUs.
        - `commitment_days` integer, nullable
        - `auto_renew` boolean
        - `expires_at` string, date-time, nullable
        - `renewal_in_progress` boolean
        - `renewal_next_attempt_at` string, date-time, nullable
        - `agreed_hourly_rate` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `hourly_billing_start_time` string, date-time, nullable
        - `activated_at` string, date-time, nullable
        - `completed_at` string, date-time, nullable
        - `cancelled_at` string, date-time, nullable
        - `decoupled_at` string, date-time, nullable
        - `sku_code` string, nullable
        - `sku_display_name` string, nullable
      - `created_at` string, date-time, nullable
      - `deleted_at` string, date-time, nullable
      - `listed` boolean
      - `project_type` string, nullable
    - `cvms` TeehouseApiRoutesCvmsV20260121SchemasCVMInfo[]
      - `id` string, hashid, required: A hashed identifier that maps to an internal database ID
      - `name` string, required
      - `app_id` string, nullable
      - `vm_uuid` string, nullable
      - `instance_id` string, nullable
      - `resource` CVMResourceInfo, required
        - `instance_type` string, nullable
        - `vcpu` integer, nullable
        - `memory_in_gb` number, nullable
        - `disk_in_gb` integer, nullable
        - `gpus` integer, nullable
        - `compute_billing_price` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `billing_period` 'skip' | 'hourly' | 'monthly'
      - `node_info` NodeRef: Minimal node/teepod reference for embedding in responses.
        - `object_type` 'node': Fixed value 'node'
        - `id` integer, nullable: Teepod numeric ID
        - `node_id` integer, nullable: Physical node numeric ID
        - `node` string, nullable: Physical node name
        - `name` string, nullable: Node display name
        - `region` string, nullable: Region identifier
        - `device_id` string, nullable: Resolved single device ID (deprecated)
        - `device_ids` NodeDeviceIdOut[]: All device_ids configured for this node
          - `device_id` string, required: Device identifier
          - `algorithm_version` string, required: Semver of the derivation algorithm that produced this device_id
          - `enabled` boolean, required: Whether this device_id is active
        - `ppid` string, nullable: PPID
        - `status` 'ONLINE' | 'OFFLINE' | 'MAINTENANCE'
        - `version` string, nullable: Teepod version
      - `os` CVMOSInfo
        - `name` string, nullable
        - `version` string, nullable
        - `is_dev` boolean, nullable
        - `os_image_hash` string, nullable
      - `kms_type` 'phala' | 'ethereum' | 'base' | 'local' | 'legacy'
      - `kms_info` CVMKmsInfo
        - `chain_id` integer, nullable
        - `dstack_kms_address` string, nullable
        - `dstack_app_address` string, nullable
        - `deployer_address` string, nullable
        - `rpc_endpoint` string, nullable
        - `encrypted_env_pubkey` string, nullable
        - `k256_pubkey` string, nullable
      - `status` string, required
      - `in_progress` boolean
      - `progress` CVMProgressInfo
        - `target` string, nullable
        - `started_at` string, date-time, nullable
        - `correlation_id` string, nullable
      - `compose_hash` string, nullable
      - `docker_compose_hash` string, nullable
      - `pre_launch_script_hash` string, nullable
      - `gateway` CVMGatewayInfo, required
        - `base_domain` string, nullable
        - `cname` string, nullable
      - `logs` CVMLogUrls
        - `serial` string, nullable
        - `stdout` string, nullable
        - `stderr` string, nullable
        - `container_log_base` string, nullable
      - `services` object[]
      - `endpoints` CvmNetworkUrls[], nullable
        - `app` string, required
        - `instance` string, required
      - `public_logs` boolean
      - `public_sysinfo` boolean
      - `public_tcbinfo` boolean
      - `gateway_enabled` boolean
      - `secure_time` boolean
      - `managed_env` boolean
      - `enabled_ssh_access` boolean, required
      - `storage_fs` string
      - `workspace` WorkspaceRef: Minimal workspace reference for embedding in responses.
        - `object_type` 'workspace': Fixed value 'workspace'
        - `id` string, hashid, required: Hashed workspace ID
        - `name` string, required: Workspace display name
        - `slug` string, nullable: URL-safe workspace identifier
        - `avatar_url` string, nullable: Workspace avatar URL from profile
      - `creator` UserRef: Minimal user reference for embedding in responses.
        - `object_type` 'user': Fixed value 'user'
        - `id` string, hashid, nullable: A hashed identifier that maps to an internal database ID
        - `username` string, nullable: Display username
        - `avatar_url` string, nullable: Gravatar or OAuth provider avatar URL
      - `hourly_rate` CVMHourlyRate
        - `total` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `compute` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `disk` string, decimal, nullable: A monetary value with precise decimal arithmetic
      - `billing_interval` 'hourly' | 'monthly' | 'unmetered', nullable
      - `gpu_rental_order` CVMGpuRentalOrderInfo
        - `order_id` string, hashid, required: A hashed identifier that maps to an internal database ID
        - `status` 'pending' | 'provisioning' | 'active' | 'teardown' | 'completed' | 'cancelled', required: Lifecycle states for GPU rental orders.
        - `pricing_plan` 'on_demand' | 'commitment': Pricing plan for GPU SKUs.
        - `commitment_days` integer, nullable
        - `auto_renew` boolean
        - `expires_at` string, date-time, nullable
        - `renewal_in_progress` boolean
        - `renewal_next_attempt_at` string, date-time, nullable
        - `agreed_hourly_rate` string, decimal, nullable: A monetary value with precise decimal arithmetic
        - `hourly_billing_start_time` string, date-time, nullable
        - `activated_at` string, date-time, nullable
        - `completed_at` string, date-time, nullable
        - `cancelled_at` string, date-time, nullable
        - `decoupled_at` string, date-time, nullable
        - `sku_code` string, nullable
        - `sku_display_name` string, nullable
      - `created_at` string, date-time, nullable
      - `deleted_at` string, date-time, nullable
      - `listed` boolean
      - `project_type` string, nullable
    - `cvm_count` integer

## Other responses

- `401`: Not authenticated
- `403`: No workspace access
- `404`: App not found
- `422`: Validation Error

## Changes

- **2026-11-07** `c71a8dc90391`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/phala/apis/phala-cloud-api/changes/api/v1/apps/:app_id/guest-agent-access/restrict/post.md)

---

[API](https://skmtc.dev/phala/apis/phala-cloud-api.md) - [All operations](https://skmtc.dev/phala/apis/phala-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/phala/apis/phala-cloud-api/revisions/c71a8dc90391?raw)