> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oneshotagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox egress

> Limit where compute sandboxes can connect.

Compute goals run their autonomous work in sandboxes. By default a sandbox can reach any host. Two settings limit it to OneShot's API plus an allowlist:

* **Per goal**: pass `egress_allowlist` when you [create the goal](https://docs.oneshotagent.com/api-reference/compute/create.md#param-egress-allowlist). Setting it, even to `[]`, limits every sandbox of that goal.
* **Per organization**: an admin turns on **default-deny** with `PUT /v1/org/sandbox-egress` `{ "default_deny": true }`. Every sandbox of the organization's goals is then limited, with or without a goal allowlist.

Entries are hostnames, IPv4 addresses or IPv4 ranges, at most 50. No wildcards, URLs, IPv6 or all-traffic ranges. The policy is read from the database when a sandbox is created, so it covers goals queued before the setting changed; a running sandbox keeps the policy it started with.

## What is enforced

The sandbox's network filter denies every connection except OneShot's API and the listed hosts. Its limits:

* Hostnames are matched on the HTTP `Host` header (port 80) and the TLS server name (port 443). Other ports are matched by address, so list an address or range for them.
* A hostname on a shared CDN endpoint may expose other sites served there.
* With hostnames in the allowlist, the sandbox can also reach the public DNS resolver `8.8.8.8`. This cannot be closed today.
* Only IPv4 is filtered.

## Blocked attempts

There is no log of denied connections at the network level, and no command is refused on its text: a URL in a command is data until a connection is made, so every command runs and the network filter decides. The sandbox runtime records what it observes at run time as `egress_blocked` goal events with `source: command_failure`: a finished command, including a background one, reported a refused or reset connection. The host is given when the command named one outside the allowlist.

An attempt inside a script that hides its errors is blocked but produces no event. Reports are retried and flushed before the agent exits. On the agent loop, where commands run through the platform, a blocked attempt fails the command and produces no event.

> [!NOTE]
>
> OneShot tools the sandbox calls (web read, search, browser, email) run outside the sandbox and are not limited by this setting.

## API

| Route | Role |
| - | - |
| `GET /v1/org/sandbox-egress` | member |
| `PUT /v1/org/sandbox-egress` `{ default_deny: boolean }` | admin |

Both return `{ success: true, data: { default_deny } }`. Each change is an `org.sandbox_egress_changed` audit entry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.