Outbound network access

Configure outbound access

An Environment's network policy applies to every Session, native Harness, shell and background process in its Sandbox. Sandbox0 enforces the policy outside the guest. Use Environment → Configuration → Outbound network access in the console, or the public operations below.

Choose Block outbound access (block-all) for a restricted workload and add only the domains it needs. In this mode, domain exceptions allow access. With allow-all, exceptions block access. Exact names do not include subdomains; *.example.com is a wildcard suffix. Enter domain names without a URL, path, IP address or port. Domain exception rules cover all ports; the Platform editor does not expose Sandbox0 CIDR, port or protocol-operation rules.

New Environments default to allow-all with no exceptions. You can set networkPolicy when creating an Environment through the API or console. It is stored before Sandbox provisioning, so repository initialization is subject to the same policy. Allow any repository, redirect and dependency hosts required for setup. A model connection URL never adds a network exception automatically.

Read the current policy

Reads return the configured base policy without waking a paused Sandbox. Use a personal token for a personal Environment, or the owning Project's token for a Project Environment. Cross-owner and cross-Project requests return 404.

curl \
    "https://api.sandpi.ai/v1/environments/$ENVIRONMENT_ID/network-policy" \
    -H "Authorization: Bearer $SANDPI_API_TOKEN"

{
  "data": {
    "mode": "allow-all",
    "domainExceptions": [
      "example"
    ]
  }
}

{
  "error": {
    "code": "platform_balance_insufficient",
    "message": "Top up Platform credits before submitting a Run.",
    "requestId": "req_example"
  }
}

Enabled egress credentials are composed into this policy separately. In block-all, each enabled credential with a current source version also allows its configured domain and port destinations. Review these bindings as well as the base policy when checking outbound access.

Replace the policy

Replacement changes the complete base policy and preserves existing credential bindings. The Environment must be ready. A paused Sandbox can be updated without resuming it or starting a model request.

curl -X PUT \
    "https://api.sandpi.ai/v1/environments/$ENVIRONMENT_ID/network-policy" \
    -H "Authorization: Bearer $SANDPI_API_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
  "mode": "block-all",
  "domainExceptions": [
    "gateway.example.com"
  ]
}'

{
  "mode": "block-all",
  "domainExceptions": [
    "gateway.example.com"
  ]
}

{
  "data": {
    "mode": "allow-all",
    "domainExceptions": [
      "example"
    ]
  }
}

{
  "error": {
    "code": "platform_balance_insufficient",
    "message": "Top up Platform credits before submitting a Run.",
    "requestId": "req_example"
  }
}

Runs, initialization, checkpoint work, rollback and lifecycle changes hold the Environment lock. A conflicting update returns HTTP 409 platform_environment_busy. Stop active work if necessary, wait for checkpoint and pause work to settle, then retry. Policy changes are not queued behind a Run.

A successful response follows Sandbox0 acknowledgement and persistence of the configuration. Active-policy updates reconcile existing Sandbox connections; even permitted clients may need to reconnect. If the request fails ambiguously, retry the same desired policy before starting more work; a configuration read alone does not prove that an interrupted update finished applying.

Keep pilot boundaries explicit

For an isolated validation pilot, configure the policy before starting work, prepare the public repository and dependencies, and then narrow access to the model endpoint and any remaining required hosts. Verify a permitted destination and a blocked destination in the actual Environment.

Allowing a domain does not make its requests read-only. This control does not filter HTTP methods, repository paths or local commands such as git commit. Keep GitHub write credentials, production credentials and Controller access tokens out of the Sandbox. Use separate controls for those permissions and for BYOK spending limits.

Forks and rollback

A fork copies its source's base network policy but has no inherited egress credential bindings. Later policy edits are independent. RootFS rollback does not revert network policy; deleting an Environment removes its Sandbox.