Set Grok Bot network policy with the Admin API

Network Controls decide which destinations team computers can reach. The dashboard walkthrough is Configure Grok Bot network controls. This guide covers GET / PUT https://api.cursor.com/grok-bot/network. Official references: Admin API → Grok Bot network policy; Grok Bot security → Network policy; Grok Bot for teams and enterprises.

Network policy writes are Enterprise only. Reads of the effective policy work on every plan; writes return 403 on Teams plans. Teams without a policy default to allow-all.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Reads need read:* or admin:*; writes need admin:*. Rate limit: 20 requests per minute per team per endpoint.

Read the current policy

curl -X GET https://api.cursor.com/grok-bot/network \
  -u YOUR_API_KEY:

Example response:

{
  "egressMode": "network_settings_only",
  "allowlist": ["linkedin.com", "*.crunchbase.com", "10.0.0.0/8", "54.85.223.0/24:3306"],
  "locked": true
}

Field	Meaning
egressMode	Policy mode (see table below)
allowlist	Allowed destinations
locked	When true, group policies cannot override the team policy

Replace the policy

PUT replaces the whole policy. Partial bodies, unknown modes, and invalid allowlist entries return 400.

curl -X PUT https://api.cursor.com/grok-bot/network \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "egressMode": "network_settings_only",
    "allowlist": ["linkedin.com", "*.crunchbase.com", "10.0.0.0/8", "54.85.223.0/24:3306"],
    "locked": true
  }'

egressMode values

Value	Effect
unset	Apply no policy
allow_all	Allow every destination
default_with_network_settings	Cursor defaults plus the allowlist
network_settings_only	The allowlist plus destinations required to run Grok Bot

Allowlist rules

• Up to 500 destinations, each 1–253 characters.
• Domains, wildcard domains, IP addresses, CIDR ranges, or host-or-CIDR:port (example: 54.85.223.0/24:3306).
• All three body fields (egressMode, allowlist, locked) are required on replace.

Apply timing

The network policy is applied when a computer is created or recreated. Recreate or restart a running computer so members pick up a new allowlist. The Grok Bot network policy is separate from Cloud Agent network settings.

Blocking a plugin does not block that service’s website. Connector policy and network policy are separate layers — close both paths when you need both closed.

Pitfalls

• Expecting an in-place allowlist edit without recreate/restart on already-running computers.
• Sending a partial PUT body — the route replaces the full policy.
• Using a read:* key for PUT — writes require admin:*.
• Confusing this allowlist with shared static egress source IPs (source ranges come from your account team; the product control here is destination allowlist).