Network Policy

Control outbound network access using DNS-based filtering. Policies define which domains sprites can reach, with support for exact matches, wildcard subdomains, and preset rule bundles.

Changes apply immediately—existing connections to newly-blocked domains are terminated. Failed DNS lookups return REFUSED for fast failure.

Get Network Policy

GET /v1/sprites/{name}/policy/network

Get the current network policy configuration.

Response

application/json

rules* NetworkPolicyRule[]

List of network policy rules

domain string

Domain pattern (e.g., *.github.com)

action string

allow or deny

include string

Include rules from preset

Response Codes

200

Success

404

Not Found - Resource not found

500

Internal Server Error

bash

curl -X GET \
  "https://api.sprites.dev/v1/sprites/{name}/policy/network" \
  -H "Authorization: Bearer $SPRITES_TOKEN"

token := os.Getenv("SPRITE_TOKEN")
spriteName := os.Getenv("SPRITE_NAME")

client := sprites.New(token)
sprite := client.Sprite(spriteName)

policy, err := sprite.GetNetworkPolicy(context.Background())
if err != nil {
	log.Fatal(err)
}

out, _ := json.MarshalIndent(policy, "", "  ")
fmt.Println(string(out))

// Example: Get Network Policy
// Endpoint: GET /v1/sprites/{name}/policy/network


const token = process.env.SPRITE_TOKEN!;
const spriteName = process.env.SPRITE_NAME!;

const client = new SpritesClient(token);
const sprite = client.sprite(spriteName);

const policy = await sprite.getNetworkPolicy();

console.log(JSON.stringify(policy, null, 2));

import json
import os

from sprites import SpritesClient

token = os.environ["SPRITE_TOKEN"]
sprite_name = os.environ["SPRITE_NAME"]

client = SpritesClient(token)
sprite = client.sprite(sprite_name)

policy = sprite.get_network_policy()

result = {
    "rules": [
        {"domain": rule.domain, "action": rule.action}
        for rule in policy.rules
    ]
}

print(json.dumps(result, indent=2))

token = System.get_env("SPRITE_TOKEN")
sprite_name = System.get_env("SPRITE_NAME")

client = Sprites.new(token)
sprite = Sprites.sprite(client, sprite_name)

{:ok, policy} = Sprites.get_network_policy(sprite)

policy
|> Sprites.Policy.to_map()
|> Jason.encode!(pretty: true)
|> IO.puts()

200 Response

{
  "rules": [
    {
      "action": "allow",
      "domain": "github.com"
    },
    {
      "action": "allow",
      "domain": "*.npmjs.org"
    },
    {
      "action": "deny",
      "domain": "*"
    }
  ]
}

{
  "rules": [
    {
      "domain": "api.github.com",
      "action": "allow"
    },
    {
      "domain": "*.npmjs.org",
      "action": "allow"
    }
  ]
}

{
  "rules": [
    {
      "domain": "api.github.com",
      "action": "allow"
    },
    {
      "domain": "*.npmjs.org",
      "action": "allow"
    }
  ]
}

{
  "rules": [
    {
      "domain": "api.github.com",
      "action": "allow"
    },
    {
      "domain": "*.npmjs.org",
      "action": "allow"
    }
  ]
}

{
  "rules": [
    {
      "domain": "api.github.com",
      "action": "allow"
    },
    {
      "domain": "*.npmjs.org",
      "action": "allow"
    }
  ]
}

Set Network Policy

POST /v1/sprites/{name}/policy/network

Update the network policy configuration.

Request Body

application/json

rules* NetworkPolicyRule[]

List of network policy rules

domain string

Domain pattern (e.g., *.github.com)

action string

allow or deny

include string

Include rules from preset

Response

application/json

Response Codes

200

Success

400

Bad Request - Invalid request body

404

Not Found - Resource not found

500

Internal Server Error

bash

curl -X POST \
  "https://api.sprites.dev/v1/sprites/{name}/policy/network" \
  -H "Authorization: Bearer $SPRITES_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rules":[{"action":"allow","domain":"github.com"},{"action":"allow","domain":"*.npmjs.org"}]}'

token := os.Getenv("SPRITE_TOKEN")
spriteName := os.Getenv("SPRITE_NAME")

client := sprites.New(token)
sprite := client.Sprite(spriteName)

policy := &sprites.NetworkPolicy{
	Rules: []sprites.NetworkPolicyRule{
		{Domain: "api.github.com", Action: "allow"},
		{Domain: "*.npmjs.org", Action: "allow"},
	},
}

err := sprite.UpdateNetworkPolicy(context.Background(), policy)
if err != nil {
	log.Fatal(err)
}

fmt.Println("Network policy updated")

// Example: Set Network Policy
// Endpoint: POST /v1/sprites/{name}/policy/network


const token = process.env.SPRITE_TOKEN!;
const spriteName = process.env.SPRITE_NAME!;

const client = new SpritesClient(token);
const sprite = client.sprite(spriteName);

await sprite.updateNetworkPolicy({
  rules: [
    { domain: 'api.github.com', action: 'allow' },
    { domain: '*.npmjs.org', action: 'allow' },
  ],
});

console.log('Network policy updated');

import os

from sprites import NetworkPolicy, PolicyRule, SpritesClient

token = os.environ["SPRITE_TOKEN"]
sprite_name = os.environ["SPRITE_NAME"]

client = SpritesClient(token)
sprite = client.sprite(sprite_name)

policy = NetworkPolicy(
    rules=[
        PolicyRule(domain="api.github.com", action="allow"),
        PolicyRule(domain="*.npmjs.org", action="allow"),
    ]
)

sprite.update_network_policy(policy)

print("Network policy updated")

token = System.get_env("SPRITE_TOKEN")
sprite_name = System.get_env("SPRITE_NAME")

client = Sprites.new(token)
sprite = Sprites.sprite(client, sprite_name)

policy = %Sprites.Policy{
  rules: [
    %Sprites.Policy.Rule{domain: "api.github.com", action: "allow"},
    %Sprites.Policy.Rule{domain: "*.npmjs.org", action: "allow"}
  ]
}

:ok = Sprites.update_network_policy(sprite, policy)

IO.puts("Network policy updated")

200 Response

{
  "rules": [
    {
      "action": "allow",
      "domain": "github.com"
    }
  ]
}

Network policy updated

Network policy updated

Network policy updated

Network policy updated