Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
Skip to Content
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceComputeSandboxes

Replace sandbox network policy

Replaces the organization's sandbox network layer and defaults using expectedVersion. An API key may only narrow the policy. Defaults are the sandbox layer of a create that names neither network nor egress. An API key needs sandboxes.network_admin named in its permissions, and may only narrow the layer and its defaults. Network policy access must be enabled for the organization. Host egress, DNS and bandwidth enforcement is not yet available. Creates requiring an unsupported restriction return 503 NETWORK_POLICY_UNSUPPORTED. Only the organization layer's preview source restrictions are enforced. Host policy updates are not pushed to running sandboxes. The router applies updated organization preview restrictions on each new request, including previews of existing sandboxes, after receiving the new policy version.

Required permission

Requires the sandboxes.network_admin permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

Guided workflow: orl sandbox network-policy set

orl sandbox network-policy set --expected-version <expected-version> --file <file>
PUT
/v1/sandbox-network-policy

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Request Body

application/json
  1. body
layer*

One level's network policy. A missing field restricts nothing. Every level (organization, user, key, sandbox) is a ceiling on the ones below it: a destination is reachable only if every layer admits it.

defaults?

The sandbox layer of a create that names neither network nor egress. Absent is none.

expectedVersion*integer

The version the policy was read at.

Formatint64
Range0 <= value

Response Body

The written layer, at the bundle's new version

application/json
  1. response
version*integer

The policy's version. Send it as expectedVersion on a write.

Formatint64
layer?

One level's network policy. A missing field restricts nothing. Every level (organization, user, key, sandbox) is a ceiling on the ones below it: a destination is reachable only if every layer admits it.

defaults?

The organization's only. The sandbox layer of a create that names neither network nor egress.

updatedAt?string
Formatdate-time
updatedBy?string

user: for a session, key: for an API key.

Example Request
curl -X PUT 'https://api.openrelay.inc/v1/sandbox-network-policy' \  -H 'Content-Type: application/json' \  -d '{  "layer": {},  "expectedVersion": 0}'
Example Response
{  "version": 0,  "layer": {    "egress": {      "mode": "open",      "allow": [        {          "cidr": "string",          "domain": "string",          "protocol": "any",          "ports": [            0          ]        }      ],      "deny": [        {          "cidr": "string",          "domain": "string",          "protocol": "any",          "ports": [            0          ]        }      ]    },    "dns": {      "blockBypass": true    },    "ingress": {      "previewSources": [        "string"      ]    },    "bandwidth": {      "egressMbps": 0,      "ingressMbps": 0    }  },  "defaults": {    "egress": {      "mode": "open",      "allow": [        {          "cidr": "string",          "domain": "string",          "protocol": "any",          "ports": [            0          ]        }      ],      "deny": [        {          "cidr": "string",          "domain": "string",          "protocol": "any",          "ports": [            0          ]        }      ]    },    "dns": {      "blockBypass": true    },    "ingress": {      "previewSources": [        "string"      ]    },    "bandwidth": {      "egressMbps": 0,      "ingressMbps": 0    }  },  "updatedAt": "2019-08-24T14:15:22Z",  "updatedBy": "string"}

Get the organization's sandbox network policy GET

Returns the organization's sandbox network layer, defaults and version, plus the members and API keys with their own policy layers. Send the bundle's version as expectedVersion on a write. Every layer is a ceiling on the sandboxes created under it. Network policy access must be enabled for the organization. Host egress, DNS and bandwidth enforcement is not yet available. Creates requiring an unsupported restriction return 503 NETWORK_POLICY_UNSUPPORTED. Only the organization layer's preview source restrictions are enforced. Host policy updates are not pushed to running sandboxes. The router applies updated organization preview restrictions on each new request, including previews of existing sandboxes, after receiving the new policy version.

Get a member's sandbox network policy GET

Returns the network layer for a member's sandbox creates and the bundle's version. A member with no layer returns the version alone. The layer covers sandboxes created by the member's CLI sessions and personal keys. Network policy access must be enabled for the organization. Host egress, DNS and bandwidth enforcement is not yet available. Creates requiring an unsupported restriction return 503 NETWORK_POLICY_UNSUPPORTED. Only the organization layer's preview source restrictions are enforced. Host policy updates are not pushed to running sandboxes. The router applies updated organization preview restrictions on each new request, including previews of existing sandboxes, after receiving the new policy version.