REST API · outbound-allowlist

POST /outbound-allowlist

Narrow the project's outbound host allowlist (never widen it — widening stays panel-only). Body: `{patterns: string[]}`. Accepted only when `patterns` is a strict subset of, or equal to, the current list — compared as exact normalized strings, never pattern subsumption — and only when no existing target (inactive lines included) already falls outside it. Empty means "any public host", so submitting an empty list over a set one is refused as a widen, not a no-op.

post_api_outbound_allowlist

Authentication

• Bearer

Request body

application/json · required

{
    "patterns": [
        "api.support-vendor.example"
    ]
}

Responses

200

The resulting allowlist.

application/json

{
    "outboundHostAllowlist": [
        "api.support-vendor.example"
    ],
    "message": "Outbound host allowlist saved — targets may only point at api.support-vendor.example."
}

400

patterns must be an array of valid hostnames.

application/json

{
    "required": [
        "error"
    ],
    "properties": {
        "error": {
            "description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
            "type": "string",
            "enum": [
                "bad_request",
                "unauthorized",
                "insufficient_credits",
                "forbidden",
                "web_only",
                "allowlist_widens",
                "not_found",
                "conflict",
                "draft_revision_conflict",
                "rollback_confirmation_conflict",
                "not_replayable",
                "targets_outside_allowlist",
                "gone",
                "deprecated_operation",
                "validation",
                "rate_limited",
                "payment_provider",
                "verification_unavailable",
                "analytics_unavailable",
                "credential_vault_unavailable",
                "notification_grants_unavailable"
            ]
        },
        "message": {
            "description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
            "type": "string"
        },
        "object": {
            "description": "The resource the error concerns, when there is one.",
            "required": [
                "type",
                "id"
            ],
            "properties": {
                "type": {
                    "type": "string"
                },
                "id": {
                    "type": "string"
                }
            },
            "type": "object"
        },
        "action": {
            "description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
            "type": "string"
        },
        "fields": {
            "description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
            "type": "object",
            "additionalProperties": {
                "type": "string"
            }
        },
        "retry_after": {
            "description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
            "type": "string",
            "format": "date-time"
        }
    },
    "type": "object"
}

403

The submitted list widens the current allowlist — narrowing only.

application/json

{
    "required": [
        "error"
    ],
    "properties": {
        "error": {
            "description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
            "type": "string",
            "enum": [
                "bad_request",
                "unauthorized",
                "insufficient_credits",
                "forbidden",
                "web_only",
                "allowlist_widens",
                "not_found",
                "conflict",
                "draft_revision_conflict",
                "rollback_confirmation_conflict",
                "not_replayable",
                "targets_outside_allowlist",
                "gone",
                "deprecated_operation",
                "validation",
                "rate_limited",
                "payment_provider",
                "verification_unavailable",
                "analytics_unavailable",
                "credential_vault_unavailable",
                "notification_grants_unavailable"
            ]
        },
        "message": {
            "description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
            "type": "string"
        },
        "object": {
            "description": "The resource the error concerns, when there is one.",
            "required": [
                "type",
                "id"
            ],
            "properties": {
                "type": {
                    "type": "string"
                },
                "id": {
                    "type": "string"
                }
            },
            "type": "object"
        },
        "action": {
            "description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
            "type": "string"
        },
        "fields": {
            "description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
            "type": "object",
            "additionalProperties": {
                "type": "string"
            }
        },
        "retry_after": {
            "description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
            "type": "string",
            "format": "date-time"
        }
    },
    "type": "object"
}

409

An existing target already falls outside the submitted list.

application/json

{
    "required": [
        "error"
    ],
    "properties": {
        "error": {
            "description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
            "type": "string",
            "enum": [
                "bad_request",
                "unauthorized",
                "insufficient_credits",
                "forbidden",
                "web_only",
                "allowlist_widens",
                "not_found",
                "conflict",
                "draft_revision_conflict",
                "rollback_confirmation_conflict",
                "not_replayable",
                "targets_outside_allowlist",
                "gone",
                "deprecated_operation",
                "validation",
                "rate_limited",
                "payment_provider",
                "verification_unavailable",
                "analytics_unavailable",
                "credential_vault_unavailable",
                "notification_grants_unavailable"
            ]
        },
        "message": {
            "description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
            "type": "string"
        },
        "object": {
            "description": "The resource the error concerns, when there is one.",
            "required": [
                "type",
                "id"
            ],
            "properties": {
                "type": {
                    "type": "string"
                },
                "id": {
                    "type": "string"
                }
            },
            "type": "object"
        },
        "action": {
            "description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
            "type": "string"
        },
        "fields": {
            "description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
            "type": "object",
            "additionalProperties": {
                "type": "string"
            }
        },
        "retry_after": {
            "description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
            "type": "string",
            "format": "date-time"
        }
    },
    "type": "object"
}