network

Replace a sandbox's network rules: internet on or off, allowed and denied destinations, host:port pairs.

Takes effect on open connections too: a connection the new rules refuse is cut. Private addresses are always refused. A paid sandbox of an organization with a paid purchase reaches every port, narrowed by allow and deny; a sandbox without credit reaches ports 80 and 443. Some ports (telnet, SMB, IRC, and mail unless enabled by support) are never reachable.

put/v1/sandboxes/{id}/network

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/sandboxes/{id}/network
  • Auth: HTTP bearer

Path parameters

idstring required

Resource identifier (UUID).

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

internetboolean required

false refuses every outbound connection.

allowstring[]

When not empty, only these destinations are reachable, on every port the sandbox may use.

denystring[]

Never reachable. Wins over everything.

connectstring[]

host:port pairs beyond ports 80 and 443. A paid sandbox of an organization with a paid purchase reaches every port already; list pairs here when you narrow it with allow. Sandboxes without credit stay on ports 80 and 443.

Example request

{
  "allow": [
    "registry.npmjs.org"
  ],
  "deny": [
    "registry.npmjs.org"
  ],
  "connect": [
    "db.example.com:5432"
  ]
}

Response

Success

sandboxIdstring
internetboolean
allowstring[]
denystring[]
connectstring[]
versioninteger
enforcedboolean

The sandbox's host confirmed it holds these rules (version).

enforcedVersioninteger
portsinteger[]

Ports reachable without a connect entry.

openPortsboolean

Every public host:port is reachable, except forbiddenPorts: a paid sandbox of an organization with a paid purchase.

connectAllowedboolean

This organization may use connect.

connectReasonstring

paid, granted, not_paid, revoked, suspended, or trial (a sandbox without credit reaches ports 80 and 443 only).

forbiddenPortsinteger[]

Never reachable, with or without connect.

updatedAtstring date-time nullable

Changes

No recorded changes to this operation across all 1 revision of this API.