Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- For session creation/update 400, ensure tool allowed_domains fit environment allowed_hosts.
- url_not_allowed concerns the destination host; url_not_in_prior_context concerns eligible prior URL context.
- Omitting networking in API environment creation gives unrestricted. The Console form starts at Limited with no extra allowed hosts.
- A root domain does not include subdomains, and a wildcard subdomain does not include the root. Adding a host for web tools also opens it to the sandbox.
Separate failed session creation from a denied tool
A creation/update 400 is configuration validation. web_fetch url_not_allowed concerns host scope; url_not_in_prior_context concerns link origin. Opening all networking is not one solution for all three.
Anthropic documented changes in October 7, 2026 release notes for hosted Claude Managed Agents execution. It remains beta with managed-agents-2026-04-01, not automatically ordinary chat, browser-use SDK, or Amazon Bedrock.
These are current official rules, while account adoption and actual session configuration need separate checks. No real agent or account API was run here. Save existing configuration and exact errors before applying the matching change.
API and Console defaults differ: Make networking explicit
API environment creation without networking becomes unrestricted. Console starts at Limited without additional allowed hosts. Do not assume the same default for a task created through both paths.
limited permits listed targets only. Without other allowances, no hosts are accessible, but attached files, memory stores, and GitHub repositories remain available. Tasks needing only those resources need no unrelated website access.
Specify the intended mode and only required hosts in allowed_hosts. Evaluate unrestricted separately when destinations cannot be listed in advance; it is not the default fetch-error fix.
For 400, align both lists and host patterns
If an enabled web tool's allowed_domains includes a target outside environment allowed_hosts, session creation returns 400. Adding the same inconsistency during updates fails too. Locate the specific out-of-scope entry.
allowed_hosts accepts bare hosts or wildcards without protocol, port, or path. example.com matches the root only, not www.example.com. *.example.com matches subdomains but excludes the root. Include each scope when both are needed.
Hypothetically, a task needs only docs.example.com. Add that approved host to allowed_hosts, or remove an unnecessary mistaken allowed_domains entry. Decide from task scope, not whichever edit makes the error disappear.
A valid session can still return no web results
limited now constrains web_search and web_fetch running on Anthropic's servers. A disallowed host yields web_fetch url_not_allowed to the agent; search omits its results. Empty host lists produce neither pages nor search results.
allow_package_managers and allow_mcp_servers extend sandbox reachability, not these web tools' hosts. Put required websites in allowed_hosts; package or MCP access is insufficient.
Sandbox requests to disallowed hosts on ports 80/443 receive 403 identifying the blocked host. Separate this from session 400 and web_fetch errors, first identifying which call made the request.
An allowed host still needs an eligible URL source
web_fetch now requires URLs previously introduced through eligible content: user-message text, web_search results, or an earlier fetched page. Host permission does not authorize arbitrary links.
URLs appearing only in Claude output, system prompts, attachments, or bash, read, and MCP results do not qualify. The error is url_not_in_prior_context; changing domain lists repeatedly does not supply context.
For an approved public-document target, place the exact URL in a user.message event's text before fetching. This illustrates supplying an authorized target, not allowing an untrusted page to authorize itself or sending private material indiscriminately.
Verify the corresponding layer after changes
First confirm creation/update no longer fails on conflicting lists, then check host matching. For remaining url_not_in_prior_context, inspect introduction of the URL; for sandbox 403, inspect that request's host. Address the matching layer separately to establish cause.
Allowing a web-tool host also opens it to sandbox code. Host access is not read-only: code could upload data, call APIs, or change external state. Grant only needed hosts and enforce business-action permissions separately; instructions to only read are not technical control.
Finally check that the tool obtained the needed page or useful search results and answered the task. Session creation, disappearing errors, and HTTP success alone do not establish correctness. Save the verified configuration and results for later diagnosis.
Sources
Frequently Asked Questions
Do attached-file tasks need website permissions?
Not without a web requirement. limited with no additional hosts still allows attached files, memory stores, and GitHub repositories. Check whether external searching or fetching is actually necessary.
Do environment rules replace tool filters?
No. The environment sets network scope; allowed_domains or blocked_domains can further narrow web targets. Under limited, tool settings must agree with the environment.
Does self-hosting allow any URL?
The documentation says self-hosted or unrestricted environments do not constrain these tools with the environment host list. Tool filters and Managed Agents URL-context checks remain separate; execution location does not authorize arbitrary links.