Network policies

A network policy decides which sites a browser may reach. Give an agent that should only shop at one store a policy that allows that store alone: a link elsewhere simply fails to load.

{
  "name": "Checkout agent",
  "defaultAction": "block",
  "allow": { "domains": ["shop.example.com", "stripe.com"] }
}

{
  "name": "No trackers",
  "defaultAction": "allow",
  "block": { "domains": ["doubleclick.net", "facebook.com"] }
}

How a host is decided

• An entry covers its domain and its subdomains: stripe.com covers js.stripe.com.
• The most specific entry wins: allow example.com and block ads.example.com, and ads.example.com is blocked.
• A host no entry covers gets defaultAction.
• Datum’s own rules come first: a browser never reaches private or local addresses.

Entries are cleaned as Browser Use does: trimmed, lower case, no trailing dot, international names as punycode, a leading *. dropped, duplicates removed. A URL, a path, a port, an IP address, any other wildcard, or a domain in both lists is refused with 422. A policy holds up to 10,000 domains; an organization up to 100 policies.

Use one

Name it when you create a browser:

browser = client.browsers.create(network_policy_id=policy.id)

A change to a policy reaches the browsers using it within a second, and connections it newly blocks are closed. Deleting a policy lifts it from its running browsers.

Manage policies on the dashboard’s Network policies page, or with the API.