Network Profiles

Network profiles are named, per-organization allow-lists of egress domains used by the Firetiger bash tool to gate outbound HTTPS and DNS. Each agent references one profile; agents with no explicit profile fall back to network-profiles/default, seeded on first access with a curated list of common research domains (search engines, package ecosystems, source control, reference docs).

Domains are managed as the AllowedDomain sub-resource with standard AIP CRUD (PUT/PATCH/DELETE on the URL path segment) so a human-in-the-loop approval UI can allow or deny individual hostnames per conversation turn. Each AllowedDomain carries an allow boolean: true means the domain is in the active allow-list; false records a persistent user denial so the approval flow doesn’t re-prompt.

Service: firetiger.networkprofiles.v1.NetworkProfilesService

Resource name pattern: network-profiles/{network_profile} and network-profiles/{network_profile}/allowed-domains/{domain}

Access: Read-write (default profile cannot be deleted; all other profiles freely editable)

Example flow

Create a profile and add a domain. The bash tool consumes the allow-list via GetShellEnvironment on the connections service, which folds the profile’s domains into the allowed_domains it already returns for configured connections — no separate fetch needed.

1. Create a profile

curl -X POST "https://api.cloud.firetiger.com/firetiger.networkprofiles.v1.NetworkProfilesService/CreateNetworkProfile" \
  -u "$USERNAME:$PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{
    "networkProfileId": "research",
    "networkProfile": {
      "displayName": "Research",
      "description": "Agents doing open-web research"
    }
  }'

{
  "networkProfile": {
    "name": "network-profiles/research",
    "displayName": "Research",
    "description": "Agents doing open-web research"
  }
}

2. Add a domain to the allow-list

CreateAllowedDomain is strict: a duplicate live row returns AlreadyExists. A previously-deleted row is revived transparently.

curl -X PUT "https://api.cloud.firetiger.com/v1/network-profiles/research/allowed-domains/api.example.com" \
  -u "$USERNAME:$PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"allow": true}'

{
  "allowedDomain": {
    "name": "network-profiles/research/allowed-domains/api.example.com",
    "allow": true
  }
}

Match semantics

Domains use the implicit-subdomain matcher from internal/fireshell: listing example.com allows the host and every subdomain (api.example.com, cdn.example.com, a.b.c.example.com). The legacy *.example.com form is still accepted as an alias for the same thing. One entry per hostname you want to allow; no need for pairs.

Methods

Method Description
CreateNetworkProfile Create a new profile
GetNetworkProfile Retrieve a profile by name
UpdateNetworkProfile Update a profile
DeleteNetworkProfile Soft-delete a profile (except default)
ListNetworkProfiles List profiles with filtering + pagination
CreateAllowedDomain Add a domain to a profile’s allow-list
UpdateAllowedDomain Toggle the allow flag on an existing domain
DeleteAllowedDomain Remove a domain from a profile’s allow-list
GetAllowedDomain Check whether a domain is in a profile’s allow-list
ListAllowedDomains List the domains in a profile

The agent runtime does not fetch the allow-list separately: the connections service’s GetShellEnvironment RPC folds the requested profile’s domains into its allowed_domains response, so one RPC returns everything a bash call needs.

CreateNetworkProfile

Create a new network profile. The ID must match ^[a-zA-Z0-9][a-zA-Z0-9-]{3,62}$ (alphanumeric or -, 4-63 characters, no underscores, no leading dash).

POST /firetiger.networkprofiles.v1.NetworkProfilesService/CreateNetworkProfile

Request body

Field Type Required Description
networkProfileId string Yes ID for the new profile
networkProfile NetworkProfile Yes Profile fields (displayName, description)

GetNetworkProfile

Retrieve a profile by resource name. Accessing network-profiles/default lazily seeds the profile and its starter allow-list if they don’t exist.

POST /firetiger.networkprofiles.v1.NetworkProfilesService/GetNetworkProfile

Request body

Field Type Required Description
name string Yes Resource name (network-profiles/{id})

UpdateNetworkProfile

Partial update via update_mask. Output-only fields (name, createTime, updateTime, deleteTime) are filtered out automatically.

POST /firetiger.networkprofiles.v1.NetworkProfilesService/UpdateNetworkProfile

DeleteNetworkProfile

Soft-delete a profile. network-profiles/default cannot be deleted — it is the fallback for every unconfigured agent and returns FAILED_PRECONDITION.

POST /firetiger.networkprofiles.v1.NetworkProfilesService/DeleteNetworkProfile

ListNetworkProfiles

AIP-158 paginated list. Supports filter, orderBy, pageSize, pageToken, showDeleted.

POST /firetiger.networkprofiles.v1.NetworkProfilesService/ListNetworkProfiles

CreateAllowedDomain

Add a domain pattern to a profile’s allow-list. Strict: a duplicate live row returns AlreadyExists. A previously-deleted row is revived in place, with the allow flag updated to whatever the caller sent.

PUT /v1/network-profiles/{parent}/allowed-domains/{domain}

Or over Connect:

POST /firetiger.networkprofiles.v1.NetworkProfilesService/CreateAllowedDomain

Request body

Field Type Required Description
parent string Yes Parent profile resource name
domain string Yes Hostname pattern (see match semantics)
allow bool No true (default) approves the domain; false records a persistent denial

UpdateAllowedDomain

Toggle the allow flag on an existing domain. Use update_mask to restrict writes to specific fields (allow is the only writable path today). Refuses tombstoned rows with NotFound.

PATCH /v1/network-profiles/{parent}/allowed-domains/{domain}

Or over Connect:

POST /firetiger.networkprofiles.v1.NetworkProfilesService/UpdateAllowedDomain

Request body

Field Type Required Description
parent string Yes Parent profile resource name
domain string Yes Hostname pattern
allow bool Yes New value for the allow flag
updateMask FieldMask Yes Fields to update (typically "allow")

DeleteAllowedDomain

Remove a domain pattern from a profile’s allow-list. Soft-delete; the row can be revived by a subsequent CreateAllowedDomain with the same {parent}/{domain}.

DELETE /v1/network-profiles/{parent}/allowed-domains/{domain}

GetAllowedDomain

Check whether a specific domain is present in a profile’s allow-list. Returns the full AllowedDomain row including the allow flag — callers that care about the distinction between “approved” and “persistently denied” should read the field directly.

POST /firetiger.networkprofiles.v1.NetworkProfilesService/GetAllowedDomain

Request body

Field Type Required Description
parent string Yes Parent profile resource name
domain string Yes Hostname pattern to look up

ListAllowedDomains

Structured list of domains in a profile (AIP-paginated JSON).

POST /firetiger.networkprofiles.v1.NetworkProfilesService/ListAllowedDomains

The agent runtime does not call this directly — it receives the merged allow-list from GetShellEnvironment on the connections service, which folds the profile’s domains into the connection-derived list before returning.

This site uses Just the Docs, a documentation theme for Jekyll.