---
title: "Partially update a running sandbox"
method: PATCH
path: "/sandboxes/{sandbox_id}"
tags: ["Sandboxes"]
---

# Partially update a running sandbox

`PATCH /sandboxes/{sandbox_id}`

Applies a partial update to a running sandbox. Each top-level field
in the request body is optional; only fields that are present are
applied. Omitted top-level fields are left unchanged. Nested objects
are full replacements when present — to clear a list, send it as an
empty array.

At least one top-level field must be present, otherwise the request
is rejected with `400`. Unknown top-level fields are also rejected
with `400` so typos surface as errors instead of silent no-ops.

## Currently patchable fields

- `network` — replaces the egress allow/deny rules. The sandbox
  must be in the `active` state; patching a paused or idle sandbox
  returns `409`. Rules take effect immediately and are persisted so
  they survive a future pause/resume cycle.

## Request body

- SandboxPatch — Partial update body for `PATCH /sandboxes/{sandbox_id}`. Each top-level field is optional; only fields that are present are applied. Omitted fields are left unchanged. Nested objects are full replacements when present — to clear a list, send it as an empty array. At least one top-level field must be set, otherwise the request is rejected with `400`. Unknown fields are also rejected with `400`.
  - `network` NetworkConfig — Egress network rules for a sandbox. `allow_out` accepts CIDRs (e.g. `8.8.8.8/32`) and domain names (e.g. `api.openai.com`, `*.github.com`). `deny_out` accepts CIDRs only. Private ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16) are always blocked regardless of rules.
    - `allow_out` string[] — CIDRs or domains to allow.
    - `deny_out` string[] — CIDRs to deny. Use `0.0.0.0/0` to block all traffic not in `allow_out`.

## Response `204`

Patch applied

## Other responses

- `400` — Invalid request
- `401` — Missing or invalid API key
- `404` — Resource not found
- `409` — Sandbox is not in a valid state for this operation
- `500` — Internal server error

---

[API](https://skmtc.net/superserve-ai/apis/superserve-api.md) · [All operations](https://skmtc.net/superserve-ai/apis/superserve-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/superserve-ai/superserve-api/versions/304fe18155b8/schema)