Sandboxes

Update Sandbox Network

Applies the complete replacement policy to a running sandbox, then records it as the current policy. A rejected update leaves the previous policy unchanged. Free-plan accounts cannot update network policies and receive 403 with code sandbox_network_plan_required. For paid accounts, an empty object restores unrestricted egress. Existing network sessions are not terminated; the replacement governs new connections and is retained across later stops and resumes. Sandboxes that are not running, or whose policy changes concurrently, return 409.

PUT

api

sandboxes

{sid}

network

Replace a running sandbox's network policy

curl --request PUT \
  --url https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '{}'

import requests

url = "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"

payload = {}
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "data": {
    "egress": {
      "default": "allow",
      "allow": [
        "<string>"
      ],
      "deny": [
        "<string>"
      ],
      "drain_on_pause": [
        "bedrock-runtime.*.amazonaws.com"
      ]
    }
  }
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

Authorizations

Authorization

string

header

required

API key

Path Parameters

sid

string<uuid>

required

Sandbox UUID

Body

application/json

Sandbox network policy. New sandboxes on free plans receive deny-all egress with no allowlist exceptions. Start/resume and forks retain the stored policy. For paid accounts, egress is unrestricted when omitted.

egress

object

Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied.

Show child attributes

Response

The network policy was replaced

success

boolean

required

Example:

true

data

object

required

Show child attributes

Replace a running sandbox's network policy

curl --request PUT \
  --url https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '{}'

import requests

url = "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"

payload = {}
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://control.green.us-east-1.aws.prod.archil.com/api/sandboxes/{sid}/network")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "data": {
    "egress": {
      "default": "allow",
      "allow": [
        "<string>"
      ],
      "deny": [
        "<string>"
      ],
      "drain_on_pause": [
        "bedrock-runtime.*.amazonaws.com"
      ]
    }
  }
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

{
  "success": false,
  "error": "Invalid request parameters",
  "code": "<string>"
}

Overview

Disks

Serverless Execution

Sandboxes

Disk Users

API Tokens

Update Sandbox Network

Authorizations

Path Parameters

Body

Response