Sandboxes

Update sandbox egress

Changes outbound network policy for a sandbox. Supported modes:

open — full outbound internet access.
deny_all — all outbound connections blocked.
restricted — default deny with an allowlist (allow required).

Switching between modes may reattach the sandbox to a different network profile. The response includes network_updated: true when that happens. Allow a few seconds for the new policy to take effect before probing from inside the sandbox.

Sandbox must be in status ready.

PUT

sandboxes

{id}

egress

curl --request PUT \
  --url https://sandbox.brimble.io/sandboxes/{id}/egress \
  --header 'Content-Type: application/json' \
  --header 'x-brimble-key: <api-key>' \
  --data '{
  "mode": "open"
}'

{
  "message": "Sandbox egress updated",
  "data": {
    "id": "507f1f77bcf86cd799439011",
    "egress": {
      "mode": "restricted",
      "allow": [
        "1.1.1.1"
      ]
    },
    "block_outbound": false,
    "network_updated": true
  }
}

Changes outbound network policy for a ready sandbox.

Request body

Field	Type	Required	Description
`mode`	`"open"` \| `"restricted"` \| `"deny_all"`	yes	Target egress mode.
`allow`	`string[]`	when `mode` is `restricted`	IPv4 addresses, CIDR ranges, or hostnames. Min 1, max 50 entries. Must be omitted for `open` and `deny_all`.

Examples

{ "mode": "open" }

{ "mode": "deny_all" }

{
  "mode": "restricted",
  "allow": ["1.1.1.1", "api.openai.com"]
}

Response

Returns the updated sandbox record in data, including:

Field	Type	Description
`egress.mode`	string	Applied egress mode.
`egress.allow`	`string[]`	Applied allowlist (restricted mode only).
`block_outbound`	`boolean`	Legacy mirror; `true` when mode is `deny_all`.
`network_updated`	`boolean`	`true` when the sandbox was switched to a different network profile. Allow a few seconds before probing connectivity from inside the sandbox.

Authorizations

x-brimble-key

string

header

required

Your account-level Brimble API key. Find it in the dashboard under your profile drawer → API key (click the avatar in the sidebar). Available on paid plans only.

Path Parameters

string

required

24-char hex id of the sandbox.

Pattern: ^[a-f0-9]{24}$

Body

application/json

Request body for PUT /sandboxes/{id}/egress.

mode

enum<string>

required

Outbound network policy for a sandbox.

open — full outbound internet access (default).
deny_all — all outbound connections blocked; inbound Brimble API calls still work.
restricted — default deny with an allowlist (allow required on update).

Available options:

open,

restricted,

deny_all

allow

string[]

Required when mode is restricted; must be omitted otherwise.

Required array length: 1 - 50 elements

Required string length: 1 - 253

Response

Egress updated

message

string

required

Example:

"Sandbox egress updated"

data

object

required

Includes network_updated when the network profile changed.

Show child attributes

Last modified on June 29, 2026

Run a shell commandRuns `cmd` inside the sandbox via a shell, so pipes, `&&`, redirects, and installed CLI tools all work. Sandbox must be in status `ready`. Pass `stream: true` to receive `stdout` / `stderr` as they arrive. The response then uses `Content-Type: text/event-stream` with one JSON object per `data:` line; the final event is `{ "type": "done", ... }`. See `ExecStreamFrame` for the event shape.

curl --request PUT \
  --url https://sandbox.brimble.io/sandboxes/{id}/egress \
  --header 'Content-Type: application/json' \
  --header 'x-brimble-key: <api-key>' \
  --data '{
  "mode": "open"
}'

{
  "message": "Sandbox egress updated",
  "data": {
    "id": "507f1f77bcf86cd799439011",
    "egress": {
      "mode": "restricted",
      "allow": [
        "1.1.1.1"
      ]
    },
    "block_outbound": false,
    "network_updated": true
  }
}

​Request body

​Examples

​Response

Authorizations

Path Parameters

Body

Response

Request body

Examples

Response