---
title: "Update a NetworkPolicy."
method: POST
path: "/v1/network-policies/{id}"
tags: ["network-policies"]
---

# Update a NetworkPolicy.

`POST /v1/network-policies/{id}`

Update an existing NetworkPolicy. All fields are optional.

## Path parameters

- `id` string, required

## Request body

- NetworkPolicyUpdateParameters — Parameters for updating an existing NetworkPolicy. All fields are optional.
  - `name` string, nullable — Updated human-readable name for the NetworkPolicy.
  - `description` string, nullable — Updated description for the NetworkPolicy.
  - `allow_all` boolean, nullable — If true, all egress traffic is allowed (ALLOW_ALL policy).
  - `allow_devbox_to_devbox` boolean, nullable — If true, allows traffic between the account's own devboxes via tunnels.
  - `allowed_hostnames` string[], nullable — Updated DNS-based allow list with wildcard support. Examples: ['github.com', '*.npmjs.org'].
  - `allow_agent_gateway` boolean, nullable — If true, allows devbox egress to the agent gateway.
  - `allow_mcp_gateway` boolean, nullable — If true, allows devbox egress to the MCP hub.

## Response `200`

NetworkPolicy updated successfully.

- NetworkPolicyView — A NetworkPolicy defines egress network access rules for devboxes. Policies can be applied to blueprints, devboxes, and snapshot resumes.
  - `id` string, required — The unique identifier of the NetworkPolicy.
  - `name` string, required — The human-readable name of the NetworkPolicy. Unique per account.
  - `description` string, nullable — Optional description of the NetworkPolicy.
  - `egress` EgressRulesView, required — Egress (outbound) network rules for a NetworkPolicy.
    - `allow_all` boolean, required — If true, all egress traffic is allowed and other fields are ignored. Used for ALLOW_ALL policies.
    - `allow_devbox_to_devbox` boolean, required — If true, allows traffic between the account's own devboxes via tunnels.
    - `allowed_hostnames` string[], required — DNS-based allow list with wildcard support. Examples: ['github.com', '*.npmjs.org', 'api.openai.com']. Empty list with allow_all=false means no network access (DENY_ALL behavior).
    - `allow_agent_gateway` boolean, required — If true, allows devbox egress to the agent gateway for credential proxying.
    - `allow_mcp_gateway` boolean, required — If true, allows devbox egress to the MCP hub for MCP server access.
  - `create_time_ms` integer, required — The creation time of the NetworkPolicy (Unix timestamp in milliseconds).
  - `update_time_ms` integer, required — Last update time of the NetworkPolicy (Unix timestamp in milliseconds).

## Other responses

- `400` — Bad request. Invalid parameters.
- `401` — Unauthorized. Invalid or missing authentication.
- `403` — Forbidden. Account does not have devbox capability.
- `404` — NetworkPolicy not found.
- `500` — Internal server error.

## Changes

- **2026-02-26** `439b1a08248e` — 1 breaking, 1 warning, 2 info
  - removed the required property `egress/allow_ai_gateway` from the response with the `200` status
  - removed the request property `allow_ai_gateway`
  - added the new optional request property `allow_agent_gateway`
  - added the required property `egress/allow_agent_gateway` to the response with the `200` status
- **2026-02-25** `dd0f43e15cb6` — 4 info
  - added the new optional request property `allow_ai_gateway`
  - added the new optional request property `allow_mcp_gateway`
  - added the required property `egress/allow_ai_gateway` to the response with the `200` status
  - added the required property `egress/allow_mcp_gateway` to the response with the `200` status
- **2026-01-19** `8ebd9dbfacb1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/runloopai/apis/runloop-api/changes/v1/network-policies/:id/post.md)

---

[API](https://skmtc.dev/runloopai/apis/runloop-api.md) · [All operations](https://skmtc.dev/runloopai/apis/runloop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/runloopai/runloop-api/revisions/cd3a17e212ec/schema)