Sandboxes

Update sandbox egress policy

Changes outbound network policy for a sandbox. Supported modes:

open — full outbound internet access.
deny_all — all outbound connections blocked.
restricted — default deny with an allowlist (allow required).

Switching between modes may reattach the sandbox to a different network profile. The response includes network_updated: true when that happens. Allow a few seconds for the new policy to take effect before probing from inside the sandbox.

Sandbox must be in status ready.

PUT

/

sandboxes

/

{id}

/

egress

curl --request PUT \
  --url https://sandbox.brimble.io/sandboxes/{id}/egress \
  --header 'Content-Type: application/json' \
  --header 'x-brimble-key: <api-key>' \
  --data '{
  "mode": "open"
}'

{
  "message": "Sandbox egress updated",
  "data": {
    "id": "507f1f77bcf86cd799439011",
    "egress": {
      "mode": "restricted",
      "allow": [
        "1.1.1.1"
      ]
    },
    "block_outbound": false,
    "network_updated": true
  }
}

Authorizations

x-brimble-key

string

header

required

Your account-level Brimble API key. Find it in the dashboard under your profile drawer → API key (click the avatar in the sidebar). Available on paid plans only.

Path Parameters

id

string

required

24-char hex id of the sandbox.

Pattern: ^[a-f0-9]{24}$

Body

application/json

Request body for PUT /sandboxes/{id}/egress.

mode

enum<string>

required

Outbound network policy for a sandbox.

open — full outbound internet access (default).
deny_all — all outbound connections blocked; inbound Brimble API calls still work.
restricted — default deny with an allowlist (allow required on update).

Available options:

open,

restricted,

deny_all

allow

string[]

Required when mode is restricted; must be omitted otherwise.

Required array length: 1 - 50 elements

Required string length: 1 - 253

Response

Egress updated

message

string

required

Example:

"Sandbox egress updated"

data

object

required

Includes network_updated when the network profile changed.

Show child attributes

Last modified on July 1, 2026

List all snapshots for the callerReturns every snapshot owned by the caller across all sandboxes.

curl --request PUT \
  --url https://sandbox.brimble.io/sandboxes/{id}/egress \
  --header 'Content-Type: application/json' \
  --header 'x-brimble-key: <api-key>' \
  --data '{
  "mode": "open"
}'

{
  "message": "Sandbox egress updated",
  "data": {
    "id": "507f1f77bcf86cd799439011",
    "egress": {
      "mode": "restricted",
      "allow": [
        "1.1.1.1"
      ]
    },
    "block_outbound": false,
    "network_updated": true
  }
}