Update network policy | Vercel REST API

APIs & SDKs

Update network policy

POSThttps://api.vercel.com/v2/sandboxes/sessions/{sessionId}/network-policy

Replaces the network access policy of a running session. Use this to control which external hosts the session can communicate with. This is a full replacement. Any previously configured network rules will be overwritten.

https://api.vercel.com/v2/sandboxes/sessions/{sessionId}/network-policy

const response = await fetch('https://api.vercel.com/v2/sandboxes/sessions/sessionId/network-policy?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "mode": "custom",
    "allowedDomains": [],
    "allowedCIDRs": [],
    "deniedCIDRs": [],
    "injectionRules": [
      {
        "domain": "string",
        "headers": "value",
        "match": {
          "path": {
            "exact": "string",
            "startsWith": "string"
          },
          "method": [],
          "queryString": [
            {
              "key": {
                "exact": "string",
                "startsWith": "string"
              },
              "value": {
                "exact": "string",
                "startsWith": "string"
              }
            }
          ],
          "headers": [
            {
              "key": {
                "exact": "string",
                "startsWith": "string"
              },
              "value": {
                "exact": "string",
                "startsWith": "string"
              }
            }
          ]
        }
      }
    ]
  }),
});

const data = await response.json();
console.log(data);

Response

{
  "session": {
    "abortedAt": "1750344501629",
    "activeCpuDurationMs": "42",
    "architecture": "amd64",
    "createdAt": "1750344501629",
    "cwd": "/vercel/sandbox",
    "duration": "3600000",
    "id": "sbx_123a6c5209bc3778245d011443644c8d27dc2c50",
    "memory": "2048",
    "networkPolicy": {
      "allowedCIDRs": [],
      "allowedDomains": [],
      "deniedCIDRs": [],
      "injectionRules": [
        {
          "domain": "api.vercel.com",
          "headerNames": []
        }
      ],
      "mode": "custom"
    },
    "networkTransfer": {
      "egress": "123",
      "ingress": "123"
    },
    "projectId": "prj_123a6c5209bc3778245d011443644c8d27dc2c50",
    "region": "iad1",
    "requestedAt": "1750344501629",
    "requestedStopAt": "1750344501629",
    "runtime": "node22",
    "snapshottedAt": "1750344501629",
    "sourceSandboxName": "my-sandbox",
    "sourceSnapshotId": "snap_123a6c5209bc3778245d011443644c8d27dc2c50",
    "startedAt": "1750344501629",
    "status": "running",
    "stoppedAt": "1750344501629",
    "timeout": "3600000",
    "updatedAt": "1750344501629",
    "v0": "false",
    "vcpus": "2"
  }
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

sessionIdstringRequired

The unique identifier of the session to update the network policy for.

Query parameters

teamIdstringOptional

The Team identifier to perform the request on behalf of.

slugstringOptional

The Team slug to perform the request on behalf of.

Body

application/json

modestringRequired

The network access policy mode. Use "allow-all" to permit all outbound traffic. Use "deny-all" to block all outbound traffic. Use "custom" to specify explicit allow/deny rules.

allowedDomainsarrayOptional

List of domain names the sandbox is allowed to connect to. Only applies when mode is "custom". Supports wildcard patterns (e.g., "*.example.com" matches all subdomains).

allowedCIDRsarrayOptional

List of IP address ranges (in CIDR notation) the sandbox is allowed to connect to. Traffic to these addresses bypasses domain-based restrictions.

deniedCIDRsarrayOptional

List of IP address ranges (in CIDR notation) the sandbox is blocked from connecting to. These rules take precedence over all allowed rules.

injectionRulesarrayOptional

HTTP header injection rules for outgoing requests matching specific domains. Traffic to matching domains will be intercepted instead of proxied through encrypted connections.

Response

200The session network policy was updated successfully.

sessionobjectRequired

This object contains information related to a Vercel Sandbox Session. v2 endpoints return "session" instead of "sandbox" as the response wrapper key.

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.

401The request is not authorized.

403You do not have permission to access this resource.

404Error

410Error

422Error

429Error

500Error

Cross-link map: Update network policy (/docs/rest-api/sandboxes/update-network-policy)

From the Vercel docs graph (built 2026-10-10T05:32:43.016Z), spanning vercel.com docs + KB, nextjs.org, ai-sdk.dev, and other Vercel documentation sites. Full graph as JSON: https://vercel.com/docs/graph.json

Semantically closest pages

Get a session — GET /v2/sandboxes/sessions/{sessionId} — Retrieves detailed information about a specific session, including its current
Extend session timeout — POST /v2/sandboxes/sessions/{sessionId}/extend-timeout — Extends the maximum execution time of a running session. The se
List sandboxes — GET /v2/sandboxes — Retrieves a paginated list of named sandboxes belonging to a specific project. Results can be sorted
Delete a sandbox — DELETE /v2/sandboxes/{name} — Deletes a sandbox by name. If sandboxes are currently running, they will be stopped first.
Create a snapshot — POST /v2/sandboxes/sessions/{sessionId}/snapshot — Creates a point-in-time snapshot of a running session's filesystem. S

This page links to (1)

Vercel REST API Reference — Interact programmatically with your Vercel account using the SDK or direct HTTP requests.

Pages that link here (1)

By site: vercel-docs (1)

Vercel REST API Reference — Interact programmatically with your Vercel account using the SDK or direct HTTP requests.

https://api.vercel.com/v2/sandboxes/sessions/{sessionId}/network-policy

const response = await fetch('https://api.vercel.com/v2/sandboxes/sessions/sessionId/network-policy?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "mode": "custom",
    "allowedDomains": [],
    "allowedCIDRs": [],
    "deniedCIDRs": [],
    "injectionRules": [
      {
        "domain": "string",
        "headers": "value",
        "match": {
          "path": {
            "exact": "string",
            "startsWith": "string"
          },
          "method": [],
          "queryString": [
            {
              "key": {
                "exact": "string",
                "startsWith": "string"
              },
              "value": {
                "exact": "string",
                "startsWith": "string"
              }
            }
          ],
          "headers": [
            {
              "key": {
                "exact": "string",
                "startsWith": "string"
              },
              "value": {
                "exact": "string",
                "startsWith": "string"
              }
            }
          ]
        }
      }
    ]
  }),
});

const data = await response.json();
console.log(data);

Response

{
  "session": {
    "abortedAt": "1750344501629",
    "activeCpuDurationMs": "42",
    "architecture": "amd64",
    "createdAt": "1750344501629",
    "cwd": "/vercel/sandbox",
    "duration": "3600000",
    "id": "sbx_123a6c5209bc3778245d011443644c8d27dc2c50",
    "memory": "2048",
    "networkPolicy": {
      "allowedCIDRs": [],
      "allowedDomains": [],
      "deniedCIDRs": [],
      "injectionRules": [
        {
          "domain": "api.vercel.com",
          "headerNames": []
        }
      ],
      "mode": "custom"
    },
    "networkTransfer": {
      "egress": "123",
      "ingress": "123"
    },
    "projectId": "prj_123a6c5209bc3778245d011443644c8d27dc2c50",
    "region": "iad1",
    "requestedAt": "1750344501629",
    "requestedStopAt": "1750344501629",
    "runtime": "node22",
    "snapshottedAt": "1750344501629",
    "sourceSandboxName": "my-sandbox",
    "sourceSnapshotId": "snap_123a6c5209bc3778245d011443644c8d27dc2c50",
    "startedAt": "1750344501629",
    "status": "running",
    "stoppedAt": "1750344501629",
    "timeout": "3600000",
    "updatedAt": "1750344501629",
    "v0": "false",
    "vcpus": "2"
  }
}

OpenAPI Specification