Sandboxes
Update Sandbox Network
Applies the complete replacement policy to a running sandbox, then records it as the current policy. A rejected update leaves the previous policy unchanged. Free-plan accounts cannot update network policies and receive 403 with code sandbox_network_plan_required. For paid accounts, an empty object restores unrestricted egress. Existing network sessions are not terminated; the replacement governs new connections and is retained across later stops and resumes. Sandboxes that are not running, or whose policy changes concurrently, return 409.
PUT
/
api
/
sandboxes
/
{sid}
/
network
Replace a running sandbox's network policy
curl --request PUT \
--url https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{}'import requests
url = "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"
payload = {}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"egress": {
"default": "allow",
"allow": [
"<string>"
],
"deny": [
"<string>"
],
"drain_on_pause": [
"bedrock-runtime.*.amazonaws.com"
]
}
}
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}Authorizations
Archil API key, including its key- prefix
Path Parameters
Sandbox UUID
Body
application/json
Sandbox network policy. New sandboxes on free plans receive deny-all egress with no allowlist exceptions. Start/resume and forks retain the stored policy. For paid accounts, egress is unrestricted when omitted.
Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied.
Show child attributes
Show child attributes
Response
The network policy was replaced
Was this page helpful?
Replace a running sandbox's network policy
curl --request PUT \
--url https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{}'import requests
url = "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"
payload = {}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{}")
.asString();require 'uri'
require 'net/http'
url = URI("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{}"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"egress": {
"default": "allow",
"allow": [
"<string>"
],
"deny": [
"<string>"
],
"drain_on_pause": [
"bedrock-runtime.*.amazonaws.com"
]
}
}
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}{
"success": false,
"error": "Invalid request parameters",
"code": "<string>"
}