---
title: "Send your sandboxes' outbound connections through your own proxy."
method: PUT
path: "/v1/networks/upstream-proxy"
tags: ["networks"]
---

# Send your sandboxes' outbound connections through your own proxy.

`PUT /v1/networks/upstream-proxy`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/networks/upstream-proxy`
- Auth: HTTP bearer

Needs a kept top-up. After Runtime's own network rules allow a connection, the host's proxy reaches it with CONNECT through yours, so your proxy's controls and logs apply and the traffic leaves from your proxy's address. Secrets are still put in by Runtime before the bytes enter your proxy's tunnel. If your proxy refuses or cannot be reached, the connection fails with upstream-proxy-failed; it never falls back to a direct connection. UDP to a covered host is refused. Takes effect on new connections within seconds.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `url` string, required: http://host:port or https://host:port. An https proxy's certificate must verify against the public roots.
  - `secret` string: Optional. One of your secrets, sent as the Proxy-Authorization header's whole value. Its hosts must name the proxy's host.
  - `hosts` string[]: Optional. Only connections to these hosts (or *.domain) go through the proxy; the rest leave as before. Every connection when absent.

## Response `200`

Success

- object
  - `url` string: The proxy: http://host:port or https://host:port.
  - `secret` string: The secret whose value is sent as Proxy-Authorization, such as Basic dXNlcjpwYXNz. Its hosts must name the proxy's host.
  - `hosts` string[]: The destinations that go through the proxy; every destination when absent.
  - `updatedAt` string, date-time
  - `enforced` boolean: True when every server running the organization's sandboxes, and every server still holding an earlier version, confirmed the change; a sandbox that starts or wakes later is given it before it runs. False while a server has not confirmed it yet: each server asks Runtime for changes every 15 seconds, and one that has not heard from Runtime for a minute sends no secret's value until it has.

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)