Set exact DNS names in browserSettings.allowedDomains at session creation. Up to 100 names are accepted; an entry also permits its subdomains.
curl -X POST "https://api.tooluse.net/v1/browsers/sessions" \
-H "Authorization: Bearer $TOOLUSE_API_KEY" \
-H "Idempotency-Key: tooluse-example-001" \
-H "Content-Type: application/json" \
-d '{"timeout":300,"browserSettings":{"allowedDomains":["example.com"]}}'
The service checks main-frame navigation, redirects and new tabs. This is navigation policy, not a network firewall; subframes and page resources are not filtered by this setting. Private, loopback, link-local and metadata destinations remain refused.
For an end-user session created with X-Tooluse.net-End-User, the same opaque end-user header is required on later calls. User handoffs and agent navigation have distinct rules; see the generated API description. Add domains to a restricted running session through a session update with allowedDomains. An unrestricted session cannot be converted to restricted after creation.