---
title: "Replace a sandbox's network rules: internet on or off, allowed and denied destinations, host:port pairs."
method: PUT
path: "/v1/sandboxes/{id}/network"
tags: ["network"]
---

# Replace a sandbox's network rules: internet on or off, allowed and denied destinations, host:port pairs.

`PUT /v1/sandboxes/{id}/network`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/sandboxes/{id}/network`
- Auth: HTTP bearer

Takes effect on open connections too: a connection the new rules refuse is cut. Private addresses are always refused. A paid sandbox of an organization with a paid purchase reaches every port, narrowed by allow and deny; a sandbox without credit reaches ports 80 and 443. Some ports (telnet, SMB, IRC, and mail unless enabled by support) are never reachable.

## Path parameters

- `id` string, required: Resource identifier (UUID).

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `internet` boolean, required: false refuses every outbound connection.
  - `allow` string[]: When not empty, only these destinations are reachable, on every port the sandbox may use.
  - `deny` string[]: Never reachable. Wins over everything.
  - `connect` string[]: host:port pairs beyond ports 80 and 443. A paid sandbox of an organization with a paid purchase reaches every port already; list pairs here when you narrow it with allow. Sandboxes without credit stay on ports 80 and 443.

## Response `200`

Success

- object
  - `sandboxId` string
  - `internet` boolean
  - `allow` string[]
  - `deny` string[]
  - `connect` string[]
  - `version` integer
  - `enforced` boolean: The sandbox's host confirmed it holds these rules (version).
  - `enforcedVersion` integer
  - `ports` integer[]: Ports reachable without a connect entry.
  - `openPorts` boolean: Every public host:port is reachable, except forbiddenPorts: a paid sandbox of an organization with a paid purchase.
  - `connectAllowed` boolean: This organization may use connect.
  - `connectReason` string: paid, granted, not_paid, revoked, suspended, or trial (a sandbox without credit reaches ports 80 and 443 only).
  - `forbiddenPorts` integer[]: Never reachable, with or without connect.
  - `updatedAt` string, date-time, nullable

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)