Skip to main content
Change a running sandbox's outbound network policy

Authorizations

Authorization
string
header
required

BoxRouter API key; never an upstream provider key.

Headers

Idempotency-Key
string

Optional for this operation. Preserve the same stable identifier when retrying an uncertain response; never reuse it for new work. If omitted where allowed, Cloud generates a request-scoped key that cannot reconcile a later retry. Do not include credentials or payloads. Stable identifier for one logical mutation.

Required string length: 1 - 128

Path Parameters

sandbox_id
string
required

Workspace-owned BoxRouter sandbox ID, not an upstream ID.

Minimum string length: 1
Pattern: ^[^\u0000]*$

Body

application/json

The outbound policy to enforce from now on, with its entries. An allowlist needs at least one allow entry and may carry deny entries, which win over its allow entries; a denylist needs at least one deny entry and takes no allow entries; deny_all and open take none.

policy
enum<string>
required
Available options:
deny_all,
allowlist,
denylist,
open
allow
(string | object)[]
required if policy = allowlist
Maximum array length: 4096

A host name or address, or an HTTP rule object. A rule object needs the sandbox's network_lockdown request to have named http_rules true.

Minimum string length: 1
deny
(string | object)[]
required if policy = denylist
Maximum array length: 4096

A host name or address, or an HTTP rule object. A rule object needs the sandbox's network_lockdown request to have named http_rules true.

Minimum string length: 1

Response

The policy now enforced.

policy
enum<string>
required

The policy now enforced.

Available options:
deny_all,
allowlist,
denylist,
open