Get the organization's sandbox network policy
Returns the organization's sandbox network layer, defaults and version, plus the members and API keys with their own policy layers. Send the bundle's version as expectedVersion on a write. Every layer is a ceiling on the sandboxes created under it. Network policy access must be enabled for the organization. Host egress, DNS and bandwidth enforcement is not yet available. Creates requiring an unsupported restriction return 503 NETWORK_POLICY_UNSUPPORTED. Only the organization layer's preview source restrictions are enforced. Host policy updates are not pushed to running sandboxes. The router applies updated organization preview restrictions on each new request, including previews of existing sandboxes, after receiving the new policy version.
Required permission
Requires the sandboxes.network_read permission. See Permissions for the roles and API key permissions that include it.
Command line
The orl CLI wraps this endpoint:
Guided workflow: orl sandbox network-policy get
orl sandbox network-policy getapiKeyAuthorizationBearer <token>OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).
The organization's policy
application/json- response
version*integerThe policy's version. Send it as expectedVersion on a write.
int64layer?One level's network policy. A missing field restricts nothing. Every level (organization, user, key, sandbox) is a ceiling on the ones below it: a destination is reachable only if every layer admits it.
defaults?The sandbox layer of a create that names neither network nor egress.
updatedAt?stringdate-timeupdatedBy?stringuser: for a session, key: for an API key.
users*array<>keys*array<>curl -X GET 'https://api.openrelay.inc/v1/sandbox-network-policy'{ "version": 0, "layer": { "egress": { "mode": "open", "allow": [ { "cidr": "string", "domain": "string", "protocol": "any", "ports": [ 0 ] } ], "deny": [ { "cidr": "string", "domain": "string", "protocol": "any", "ports": [ 0 ] } ] }, "dns": { "blockBypass": true }, "ingress": { "previewSources": [ "string" ] }, "bandwidth": { "egressMbps": 0, "ingressMbps": 0 } }, "defaults": { "egress": { "mode": "open", "allow": [ { "cidr": "string", "domain": "string", "protocol": "any", "ports": [ 0 ] } ], "deny": [ { "cidr": "string", "domain": "string", "protocol": "any", "ports": [ 0 ] } ] }, "dns": { "blockBypass": true }, "ingress": { "previewSources": [ "string" ] }, "bandwidth": { "egressMbps": 0, "ingressMbps": 0 } }, "updatedAt": "2019-08-24T14:15:22Z", "updatedBy": "string", "users": [ { "id": "string", "version": 0, "updatedAt": "2019-08-24T14:15:22Z" } ], "keys": [ { "id": "string", "version": 0, "updatedAt": "2019-08-24T14:15:22Z" } ]}Get a sandbox template GET
Returns a sandbox template and the state of its builds. Use the template's id to create sandboxes after its build is ready.
Replace sandbox network policy PUT
Replaces the organization's sandbox network layer and defaults using expectedVersion. An API key may only narrow the policy. Defaults are the sandbox layer of a create that names neither network nor egress. An API key needs sandboxes.network_admin named in its permissions, and may only narrow the layer and its defaults. Network policy access must be enabled for the organization. Host egress, DNS and bandwidth enforcement is not yet available. Creates requiring an unsupported restriction return 503 NETWORK_POLICY_UNSUPPORTED. Only the organization layer's preview source restrictions are enforced. Host policy updates are not pushed to running sandboxes. The router applies updated organization preview restrictions on each new request, including previews of existing sandboxes, after receiving the new policy version.