networks

Send your sandboxes' outbound connections through your own proxy.

Needs a kept top-up. After Runtime's own network rules allow a connection, the host's proxy reaches it with CONNECT through yours, so your proxy's controls and logs apply and the traffic leaves from your proxy's address. Secrets are still put in by Runtime before the bytes enter your proxy's tunnel. If your proxy refuses or cannot be reached, the connection fails with upstream-proxy-failed; it never falls back to a direct connection. UDP to a covered host is refused. Takes effect on new connections within seconds.

put/v1/networks/upstream-proxy

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/networks/upstream-proxy
  • Auth: HTTP bearer

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

urlstring required

http://host:port or https://host:port. An https proxy's certificate must verify against the public roots.

secretstring

Optional. One of your secrets, sent as the Proxy-Authorization header's whole value. Its hosts must name the proxy's host.

hostsstring[]

Optional. Only connections to these hosts (or *.domain) go through the proxy; the rest leave as before. Every connection when absent.

Example request

{
  "url": "http://proxy.example.com:3128",
  "secret": "PROXY_AUTH",
  "hosts": [
    "*.internal.example.com"
  ]
}

Response

Success

urlstring

The proxy: http://host:port or https://host:port.

secretstring

The secret whose value is sent as Proxy-Authorization, such as Basic dXNlcjpwYXNz. Its hosts must name the proxy's host.

hostsstring[]

The destinations that go through the proxy; every destination when absent.

updatedAtstring date-time
enforcedboolean

True when every server running the organization's sandboxes, and every server still holding an earlier version, confirmed the change; a sandbox that starts or wakes later is given it before it runs. False while a server has not confirmed it yet: each server asks Runtime for changes every 15 seconds, and one that has not heard from Runtime for a minute sends no secret's value until it has.

Example response

{
  "url": "http://proxy.example.com:3128"
}

Changes

No recorded changes to this operation across all 1 revision of this API.