---
title: "Set a workspace override of the egress policy (new immutable version)"
method: PUT
path: "/v1/workspaces/{workspace_id}/egress-policy"
tags: ["Egress policy"]
---

# Set a workspace override of the egress policy (new immutable version)

`PUT /v1/workspaces/{workspace_id}/egress-policy`

## Request

- Base URL: `https://api.shardflux.dev`
- URL: `https://api.shardflux.dev/v1/workspaces/{workspace_id}/egress-policy`
- Auth: HTTP bearer

Same body and validation as the project policy. Optional If-Match. 409 conflict (details.reason workspace_deleted) for deleted workspaces. 422 egress_widening (details {template_egress, outside: [hosts] | ["cidrs"] | ["allow_all"]}) when the workspace’s template egress ceiling would narrow the policy.

## Path parameters

- `workspace_id` string, uuid, required

## Headers

- `if-match` string

## Request body

- object
  - `mode` 'allow_all' | 'allowlist' | 'deny_all', required
  - `rules` object[]: allowlist only; at most 256.
    - `host` string, required
    - `ports` integer[]: Default [443].
    - `protocols` string[]: Only "tcp" (default); udp/quic are rejected.
  - `cidrs` string[]: allowlist only; public ranges; at most 64.

## Response `200`

Default Response

- object
  - `organization_id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `project_id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `workspace_id` string, uuid, required: UUIDv7, lowercase canonical form.
  - `version` integer, required: Current version number of the workspace override history (0 = none); send as If-Match.
  - `override` object, nullable, required
    - `id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `scope` union, required
      - 'project'
      - 'workspace'
    - `project_id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `workspace_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
    - `version` integer, required
    - `kind` union, required: cleared: the workspace override was removed (falls back to the project policy).
      - 'policy'
      - 'cleared'
    - `mode` 'allow_all' | 'allowlist' | 'deny_all', nullable, required
    - `rules` object[], required
      - `host` string, required: Lower-case IDNA A-label FQDN, or `*.` + FQDN (matches exactly one extra label).
      - `ports` integer[], required
      - `protocols` string[], required
    - `cidrs` string[], required
    - `policy_sha256` string, nullable, required
    - `created_by` object, required
      - `type` union, required
        - 'user'
        - 'api_key'
      - `id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `created_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `project_policy` object, nullable, required
    - `id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `scope` union, required
      - 'project'
      - 'workspace'
    - `project_id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `workspace_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
    - `version` integer, required
    - `kind` union, required: cleared: the workspace override was removed (falls back to the project policy).
      - 'policy'
      - 'cleared'
    - `mode` 'allow_all' | 'allowlist' | 'deny_all', nullable, required
    - `rules` object[], required
      - `host` string, required: Lower-case IDNA A-label FQDN, or `*.` + FQDN (matches exactly one extra label).
      - `ports` integer[], required
      - `protocols` string[], required
    - `cidrs` string[], required
    - `policy_sha256` string, nullable, required
    - `created_by` object, required
      - `type` union, required
        - 'user'
        - 'api_key'
      - `id` string, uuid, required: UUIDv7, lowercase canonical form.
    - `created_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `effective` object, required
    - `source` union, required: organization: an organization egress override (deny_all, e.g. outbound transfer allowance used up;) wins over every policy until it lifts.
      - 'organization'
      - 'workspace'
      - 'project'
      - 'platform_default'
    - `policy_version_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
    - `policy_version` integer, nullable, required
    - `mode` 'allow_all' | 'allowlist' | 'deny_all', required
    - `rules` object[], required
      - `host` string, required: Lower-case IDNA A-label FQDN, or `*.` + FQDN (matches exactly one extra label).
      - `ports` integer[], required
      - `protocols` string[], required
    - `cidrs` string[], required
    - `policy_sha256` string, required: SHA-256 of the canonical policy document; what the host acknowledges.
  - `organization_override` object, nullable, required: Active organization egress override; policies stay stored and apply again when it lifts.
    - `mode` 'deny_all', required
    - `reason` 'transfer_allowance_exhausted', required
    - `set_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
    - `lifts_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `enforcement` object, required
    - `state` union, required: not_enforced until the cell/host acknowledges the current effective policy for the current ownership epoch.
      - 'not_enforced'
      - 'pending'
      - 'enforced'
      - 'failed'
    - `reason` union, required
      - 'not_acknowledged'
      - 'other_version_acknowledged'
      - 'stale_epoch'
    - `applied_version` integer, nullable, required: Version number of the policy the cell/host last acknowledged for this workspace (null: none, or the platform default).
    - `effective_version` integer, nullable, required: Version number of the current effective policy (null: platform default).
    - `acknowledged` object, nullable, required
      - `policy_version_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
      - `policy_version` integer, nullable, required
      - `policy_sha256` string, required
      - `ownership_epoch` integer, required
      - `state` union, required
        - 'pending'
        - 'enforced'
        - 'failed'
      - `host_id` string, uuid, nullable, required: UUIDv7, lowercase canonical form.
      - `error_code` string, nullable, required
      - `result` object, required: Host enforcement result as reported by the cell.
      - `acknowledged_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
      - `applied_at` string, date-time, nullable, required: RFC 3339 UTC timestamp with Z.
      - `updated_at` string, date-time, required: RFC 3339 UTC timestamp with Z.
  - `template_egress` TemplateEgressDefault, required: The template’s workspace network ceiling: the cell intersects it with the effective egress policy.
    - `mode` 'allowlist' | 'none', required
    - `allow_hosts` string[], required: Normalized (lowercase, sorted); empty for none.
  - `effective_policy` object, required: What the host enforces: the effective policy intersected with the template egress ceiling (equal to `effective` without a ceiling).
    - `mode` union, required
      - 'allow_all'
      - 'allowlist'
      - 'deny_all'
    - `rules` object[], required
      - `host` string, required
      - `ports` integer[], required: [] = any port (a ceiling host).
      - `protocols` string[], required
    - `cidrs` string[], required

## Other responses

- `4XX`: Default Response
- `5XX`: Default Response

---

[API](https://skmtc.dev/shardflux/apis/shardflux-api.md) · [All operations](https://skmtc.dev/shardflux/apis/shardflux-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shardflux/apis/shardflux-api/revisions/ea685f7b39c4?raw)