---
title: "Update sandbox egress policy"
method: PUT
path: "/sandboxes/{id}/egress"
tags: ["Sandboxes"]
---

# Update sandbox egress policy

`PUT /sandboxes/{id}/egress`

Changes outbound network policy for a sandbox. Supported modes:

- `open` — full outbound internet access.
- `deny_all` — all outbound connections blocked.
- `restricted` — default deny with an allowlist (`allow` required).

Switching between modes may reattach the sandbox to a different network
profile. The response includes `network_updated: true` when that happens.
Allow a few seconds for the new policy to take effect before probing from
inside the sandbox.

Sandbox must be in status `ready`.

## Path parameters

- `id` string, required

## Request body

- UpdateSandboxEgressInput — Request body for `PUT /sandboxes/{id}/egress`.
  - `mode` 'open' | 'restricted' | 'deny_all', required — Outbound network policy for a sandbox. - `open` — full outbound internet access (default). - `deny_all` — all outbound connections blocked; inbound Brimble API calls still work. - `restricted` — default deny with an allowlist (`allow` required on update).
  - `allow` string[] — Required when `mode` is `restricted`; must be omitted otherwise.

## Response `200`

Egress updated

- SandboxEgressUpdateEnvelope
  - `message` string, required
  - `data` Sandbox, required
    - `id` string, required
    - `name` string, required
    - `template` string, required
    - `status` 'starting' | 'ready' | 'pausing' | 'paused' | 'resuming' | 'failed' | 'destroyed', required
    - `region` SandboxRegion, required
      - `id` string, required
      - `name` string, required
      - `country` string, required
      - `continent` string, required
      - `enabled` boolean, required — Whether the region is currently accepting new sandboxes.
      - `type` 'sandbox', required — Region kind. Sandbox endpoints only return sandbox-eligible regions.
    - `specs` SandboxSpecs, required
      - `cpu` integer — CPU shares in Nomad MHz units.
      - `memory` integer — Memory in MB.
      - `disk` integer — Ephemeral scratch disk in GB. Separate from persistent storage.
    - `team` string, nullable
    - `project_environment` string, nullable
    - `auto_destroy` boolean, required
    - `destroy_timeout` '30m' | '1h' | '3h' | '6h' | '12h' | '18h' | 'null', nullable
    - `one_shot` boolean, required
    - `block_outbound` boolean, required — Legacy mirror of egress policy. `true` when `egress.mode` is `deny_all`. Prefer reading `egress.mode` directly.
    - `egress` SandboxEgressConfig, required — Outbound network policy applied to the sandbox container.
      - `mode` 'open' | 'restricted' | 'deny_all', required — Outbound network policy for a sandbox. - `open` — full outbound internet access (default). - `deny_all` — all outbound connections blocked; inbound Brimble API calls still work. - `restricted` — default deny with an allowlist (`allow` required on update).
      - `allow` string[] — Allowlist for `restricted` mode. Each entry is an IPv4 address, CIDR range (e.g. `10.0.0.0/8`), or hostname (e.g. `api.example.com`). Required with at least one entry when updating to `restricted`; optional at create time.
    - `network_updated` boolean — Only present on `PUT /sandboxes/{id}/egress` responses. `true` when the sandbox was reattached to a different network profile as part of the update.
    - `persistent` boolean, required
    - `persistent_disk_gb` integer, nullable
    - `paused_at` string, date-time, nullable
    - `from_snapshot` string, nullable
    - `snapshot_mode` 'manual' | 'automatic'
    - `snapshot_frequency` string, nullable
    - `created_at` string, date-time, required
    - `last_activity_at` string, date-time, required
    - `expires_at` string, date-time, required
    - `destroyed_at` string, date-time, nullable
    - `destroy_reason` 'user' | 'idle_ttl' | 'max_lifetime' | 'one_shot_stopped' | 'failed' | 'paused_too_long'

## Other responses

- `400` — Validation error / invalid state transition
- `404` — Sandbox or related resource not found (also returned when owned by another user)

---

[API](https://skmtc.net/brimblehq/apis/brimble-sandbox-api.md) · [All operations](https://skmtc.net/brimblehq/apis/brimble-sandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/brimblehq/brimble-sandbox-api/versions/7fe2df041597/schema)