# Update sandbox network (/docs/api-reference/sandboxes/update-sandbox-network)

<!-- agent-signals: reading_time_min: 3 · est_tokens: 1644 · updated: 2026-07-30 -->
Related: [List sandboxes](/docs/api-reference/sandboxes/list-sandboxes.md), [Create sandbox](/docs/api-reference/sandboxes/create-sandbox.md), [List sandboxes (v2)](/docs/api-reference/sandboxes/list-sandboxes-v2.md), [List sandbox metrics](/docs/api-reference/sandboxes/list-sandbox-metrics.md), [Get sandbox logs](/docs/api-reference/sandboxes/get-sandbox-logs.md), [Get sandbox logs (v2)](/docs/api-reference/sandboxes/get-sandbox-logs-v2.md)

# Update sandbox network

`PUT /sandboxes/{sandboxID}/network`

Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it.

## OpenAPI

```json
{
  "security": [
    {
      "ApiKeyAuth": []
    }
  ],
  "parameters": [
    {
      "name": "sandboxID",
      "in": "path",
      "required": true,
      "schema": {
        "type": "string"
      }
    }
  ],
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "description": "Network configuration update for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting a field clears it.",
          "properties": {
            "allowOut": {
              "type": "array",
              "description": "List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. \"8.8.8.8/32\"), a bare IP address (e.g. \"8.8.8.8\"), or a domain name (e.g. \"example.com\", \"*.example.com\"). Allowed entries always take precedence over denied entries.",
              "items": {
                "type": "string"
              }
            },
            "denyOut": {
              "type": "array",
              "description": "List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.",
              "items": {
                "type": "string"
              }
            },
            "egressProxy": {
              "type": "object",
              "nullable": true,
              "description": "SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain).",
              "required": [
                "address"
              ],
              "properties": {
                "address": {
                  "type": "string",
                  "description": "SOCKS5 proxy address in host:port format (e.g. \"proxy.example.com:1080\")."
                },
                "username": {
                  "type": "string",
                  "maxLength": 255,
                  "description": "Optional SOCKS5 username (RFC 1929), max 255 bytes."
                },
                "password": {
                  "type": "string",
                  "maxLength": 255,
                  "description": "Optional SOCKS5 password (RFC 1929), max 255 bytes."
                }
              }
            },
            "rules": {
              "type": "object",
              "description": "Per-domain transform rules. Replaces all existing rules when provided.",
              "additionalProperties": {
                "type": "array",
                "items": {
                  "type": "object",
                  "description": "Transform rule applied to egress requests matching a domain pattern.",
                  "properties": {
                    "transform": {
                      "type": "object",
                      "description": "Transformations applied to matching egress requests before forwarding.",
                      "properties": {
                        "headers": {
                          "type": "object",
                          "description": "HTTP headers to inject or override in matching requests. An existing header with the same name is replaced. Values are plain strings; secret resolution happens client-side before sending to the API.\n",
                          "additionalProperties": {
                            "type": "string"
                          }
                        }
                      }
                    }
                  }
                }
              }
            },
            "allow_internet_access": {
              "type": "boolean",
              "description": "Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config."
            }
          }
        }
      }
    }
  },
  "responses": {
    "204": {
      "description": "Successfully updated the sandbox network configuration"
    },
    "401": {
      "description": "Authentication error",
      "content": {
        "application/json": {
          "schema": {
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "integer",
                "format": "int32",
                "description": "Error code"
              },
              "message": {
                "type": "string",
                "description": "Error"
              }
            },
            "type": "object"
          }
        }
      }
    },
    "404": {
      "description": "Not found",
      "content": {
        "application/json": {
          "schema": {
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "integer",
                "format": "int32",
                "description": "Error code"
              },
              "message": {
                "type": "string",
                "description": "Error"
              }
            },
            "type": "object"
          }
        }
      }
    },
    "409": {
      "description": "Conflict",
      "content": {
        "application/json": {
          "schema": {
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "integer",
                "format": "int32",
                "description": "Error code"
              },
              "message": {
                "type": "string",
                "description": "Error"
              }
            },
            "type": "object"
          }
        }
      }
    },
    "500": {
      "description": "Server error",
      "content": {
        "application/json": {
          "schema": {
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "integer",
                "format": "int32",
                "description": "Error code"
              },
              "message": {
                "type": "string",
                "description": "Error"
              }
            },
            "type": "object"
          }
        }
      }
    }
  }
}
```