feat: Deprecate datacenter proxies in the API

Stainless-Generated-From: 93ad1fda4dfb667b50676addc3ff6c415d10cc06

Author: kernel-internal[bot]

api.md

@@ -120,6 +120,7 @@ from kernel.types import (
     BrowserMemory,
     BrowserMemoryRequest,
     BrowserNetworkConfig,
+    BrowserNetworkUpdate,
     BrowserPoolRef,
     BrowserProxy,
     BrowserProxyConfig,

src/kernel/resources/browsers/browsers.py

@@ -112,6 +112,7 @@
 from ...types.browser_retrieve_response import BrowserRetrieveResponse
 from ...types.browser_proxy_config_param import BrowserProxyConfigParam
 from ...types.browser_network_config_param import BrowserNetworkConfigParam
+from ...types.browser_network_update_param import BrowserNetworkUpdateParam
 from ...types.shared_params.browser_profile import BrowserProfile
 from ...types.shared_params.browser_viewport import BrowserViewport
 from ...types.shared_params.browser_extension import BrowserExtension
@@ -241,7 +242,8 @@ def create(
               the dashboard. Must be unique among active sessions within the project. Can be
               changed later via PATCH /browsers/{id_or_name}.
 
-          network: Network configuration for the browser session. Cannot be changed after creation.
+          network: Network configuration for the browser session. Only allowed_hosts can be changed
+              after creation, with PATCH /browsers/{id_or_name}.
 
           profile: Profile selection for the browser session. Provide either id or name. If
               specified, the matching profile will be loaded into the browser session.
@@ -393,6 +395,7 @@ def update(
         *,
         disable_default_proxy: bool | Omit = omit,
         name: Optional[str] | Omit = omit,
+        network: BrowserNetworkUpdateParam | Omit = omit,
         profile: BrowserProfile | Omit = omit,
         proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: Optional[str] | Omit = omit,
@@ -418,6 +421,8 @@ def update(
               empty string to clear the name. When set, must be unique among active sessions
               within the project.
 
+          network: Network configuration changes to apply to the running browser session.
+
           profile: Profile to load into the browser session. Only allowed if the session does not
               already have a profile loaded.
 
@@ -464,6 +469,7 @@ def update(
                 {
                     "disable_default_proxy": disable_default_proxy,
                     "name": name,
+                    "network": network,
                     "profile": profile,
                     "proxy": proxy,
                     "proxy_id": proxy_id,
@@ -945,7 +951,8 @@ async def create(
               the dashboard. Must be unique among active sessions within the project. Can be
               changed later via PATCH /browsers/{id_or_name}.
 
-          network: Network configuration for the browser session. Cannot be changed after creation.
+          network: Network configuration for the browser session. Only allowed_hosts can be changed
+              after creation, with PATCH /browsers/{id_or_name}.
 
           profile: Profile selection for the browser session. Provide either id or name. If
               specified, the matching profile will be loaded into the browser session.
@@ -1097,6 +1104,7 @@ async def update(
         *,
         disable_default_proxy: bool | Omit = omit,
         name: Optional[str] | Omit = omit,
+        network: BrowserNetworkUpdateParam | Omit = omit,
         profile: BrowserProfile | Omit = omit,
         proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: Optional[str] | Omit = omit,
@@ -1122,6 +1130,8 @@ async def update(
               empty string to clear the name. When set, must be unique among active sessions
               within the project.
 
+          network: Network configuration changes to apply to the running browser session.
+
           profile: Profile to load into the browser session. Only allowed if the session does not
               already have a profile loaded.
 
@@ -1168,6 +1178,7 @@ async def update(
                 {
                     "disable_default_proxy": disable_default_proxy,
                     "name": name,
+                    "network": network,
                     "profile": profile,
                     "proxy": proxy,
                     "proxy_id": proxy_id,

src/kernel/resources/proxies.py

@@ -53,7 +53,7 @@ def with_streaming_response(self) -> ProxiesResourceWithStreamingResponse:
     def create(
         self,
         *,
-        type: Literal["datacenter", "isp", "residential", "mobile", "custom"],
+        type: Literal["isp", "residential", "mobile", "custom"],
         bypass_hosts: SequenceNotStr[str] | Omit = omit,
         config: proxy_create_params.Config | Omit = omit,
         name: str | Omit = omit,
@@ -69,12 +69,9 @@ def create(
         Create a new proxy configuration in the resolved project.
 
         Args:
-          type: Proxy type to use. In terms of quality for avoiding bot-detection, from best to
-              worst: `mobile` > `residential` > `isp` > `datacenter`.
-
           bypass_hosts: Hostnames that should bypass the parent proxy and connect directly.
 
-          config: Configuration specific to the selected proxy `type`.
+          config: Configuration for an ISP proxy.
 
           name: Readable name of the proxy.
 
@@ -292,25 +289,25 @@ def check(
         """Run a health check on the proxy to verify it's working.
 
         Optionally specify a URL
-        to test reachability against a specific target. For ISP and datacenter proxies,
-        this reliably tests whether the target site is reachable from the proxy's stable
-        exit IP. For residential and mobile proxies, the exit node varies between
-        requests, so this validates proxy configuration and connectivity rather than
-        guaranteeing site-specific reachability.
+        to test reachability against a specific target. For ISP proxies, this reliably
+        tests whether the target site is reachable from the proxy's stable exit IP. For
+        residential and mobile proxies, the exit node varies between requests, so this
+        validates proxy configuration and connectivity rather than guaranteeing
+        site-specific reachability.
 
         Args:
           url: An optional URL to test reachability against. If provided, the proxy check will
               test connectivity to this URL instead of the default test URLs. Only HTTP and
               HTTPS schemes are allowed, and the URL must resolve to a public IP address. For
-              ISP and datacenter proxies, the exit IP is stable, so a successful check
-              reliably indicates that subsequent browser sessions will reach the target site
-              with the same IP. For residential and mobile proxies, the exit node changes
-              between requests, so a successful check validates proxy configuration but does
-              not guarantee that a subsequent browser session will use the same exit IP or
-              reach the same site — it is useful for verifying credentials and connectivity,
-              not for predicting site-specific behavior. When provided, the check result does
-              not update the proxy's health status, since a failure may indicate a problem
-              with the target site rather than the proxy itself.
+              ISP proxies, the exit IP is stable, so a successful check reliably indicates
+              that subsequent browser sessions will reach the target site with the same IP.
+              For residential and mobile proxies, the exit node changes between requests, so a
+              successful check validates proxy configuration but does not guarantee that a
+              subsequent browser session will use the same exit IP or reach the same site — it
+              is useful for verifying credentials and connectivity, not for predicting
+              site-specific behavior. When provided, the check result does not update the
+              proxy's health status, since a failure may indicate a problem with the target
+              site rather than the proxy itself.
 
           extra_headers: Send extra headers
 
@@ -357,7 +354,7 @@ def with_streaming_response(self) -> AsyncProxiesResourceWithStreamingResponse:
     async def create(
         self,
         *,
-        type: Literal["datacenter", "isp", "residential", "mobile", "custom"],
+        type: Literal["isp", "residential", "mobile", "custom"],
         bypass_hosts: SequenceNotStr[str] | Omit = omit,
         config: proxy_create_params.Config | Omit = omit,
         name: str | Omit = omit,
@@ -373,12 +370,9 @@ async def create(
         Create a new proxy configuration in the resolved project.
 
         Args:
-          type: Proxy type to use. In terms of quality for avoiding bot-detection, from best to
-              worst: `mobile` > `residential` > `isp` > `datacenter`.
-
           bypass_hosts: Hostnames that should bypass the parent proxy and connect directly.
 
-          config: Configuration specific to the selected proxy `type`.
+          config: Configuration for an ISP proxy.
 
           name: Readable name of the proxy.
 
@@ -596,25 +590,25 @@ async def check(
         """Run a health check on the proxy to verify it's working.
 
         Optionally specify a URL
-        to test reachability against a specific target. For ISP and datacenter proxies,
-        this reliably tests whether the target site is reachable from the proxy's stable
-        exit IP. For residential and mobile proxies, the exit node varies between
-        requests, so this validates proxy configuration and connectivity rather than
-        guaranteeing site-specific reachability.
+        to test reachability against a specific target. For ISP proxies, this reliably
+        tests whether the target site is reachable from the proxy's stable exit IP. For
+        residential and mobile proxies, the exit node varies between requests, so this
+        validates proxy configuration and connectivity rather than guaranteeing
+        site-specific reachability.
 
         Args:
           url: An optional URL to test reachability against. If provided, the proxy check will
               test connectivity to this URL instead of the default test URLs. Only HTTP and
               HTTPS schemes are allowed, and the URL must resolve to a public IP address. For
-              ISP and datacenter proxies, the exit IP is stable, so a successful check
-              reliably indicates that subsequent browser sessions will reach the target site
-              with the same IP. For residential and mobile proxies, the exit node changes
-              between requests, so a successful check validates proxy configuration but does
-              not guarantee that a subsequent browser session will use the same exit IP or
-              reach the same site — it is useful for verifying credentials and connectivity,
-              not for predicting site-specific behavior. When provided, the check result does
-              not update the proxy's health status, since a failure may indicate a problem
-              with the target site rather than the proxy itself.
+              ISP proxies, the exit IP is stable, so a successful check reliably indicates
+              that subsequent browser sessions will reach the target site with the same IP.
+              For residential and mobile proxies, the exit node changes between requests, so a
+              successful check validates proxy configuration but does not guarantee that a
+              subsequent browser session will use the same exit IP or reach the same site — it
+              is useful for verifying credentials and connectivity, not for predicting
+              site-specific behavior. When provided, the check result does not update the
+              proxy's health status, since a failure may indicate a problem with the target
+              site rather than the proxy itself.
 
           extra_headers: Send extra headers
 

src/kernel/types/__init__.py

@@ -132,6 +132,7 @@
 from .browser_pool_release_params import BrowserPoolReleaseParams as BrowserPoolReleaseParams
 from .config_registry_list_params import ConfigRegistryListParams as ConfigRegistryListParams
 from .browser_network_config_param import BrowserNetworkConfigParam as BrowserNetworkConfigParam
+from .browser_network_update_param import BrowserNetworkUpdateParam as BrowserNetworkUpdateParam
 from .deployment_retrieve_response import DeploymentRetrieveResponse as DeploymentRetrieveResponse
 from .invocation_retrieve_response import InvocationRetrieveResponse as InvocationRetrieveResponse
 from .audit_log_export_chunk_params import AuditLogExportChunkParams as AuditLogExportChunkParams

src/kernel/types/browser_create_params.py

@@ -74,7 +74,8 @@ class BrowserCreateParams(TypedDict, total=False):
     network: BrowserNetworkConfigParam
     """Network configuration for the browser session.
 
-    Cannot be changed after creation.
+    Only allowed_hosts can be changed after creation, with PATCH
+    /browsers/{id_or_name}.
     """
 
     profile: BrowserProfile

src/kernel/types/browser_network_config.py

@@ -50,8 +50,9 @@ class BrowserNetworkConfig(BaseModel):
     or reserved IP ranges are rejected, as are entries that overlap private_hosts.
     Enforced at Kernel's egress proxy only: destinations in private_hosts, and
     processes in the browser VM that do not use the browser's proxy, are not
-    filtered, and Kernel's own control traffic is always allowed. Requires proxy v3.
-    Not supported on browser pools.
+    filtered, and Kernel's own control traffic is always allowed. Can be replaced or
+    removed while the session runs with PATCH /browsers/{id_or_name}. Requires proxy
+    v3. Not supported on browser pools.
     """
 
     private_hosts: Optional[List[str]] = None

src/kernel/types/browser_network_config_param.py

@@ -53,8 +53,9 @@ class BrowserNetworkConfigParam(TypedDict, total=False):
     or reserved IP ranges are rejected, as are entries that overlap private_hosts.
     Enforced at Kernel's egress proxy only: destinations in private_hosts, and
     processes in the browser VM that do not use the browser's proxy, are not
-    filtered, and Kernel's own control traffic is always allowed. Requires proxy v3.
-    Not supported on browser pools.
+    filtered, and Kernel's own control traffic is always allowed. Can be replaced or
+    removed while the session runs with PATCH /browsers/{id_or_name}. Requires proxy
+    v3. Not supported on browser pools.
     """
 
     private_hosts: SequenceNotStr[str]

src/kernel/types/browser_network_update_param.py

@@ -0,0 +1,32 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Optional
+from typing_extensions import TypedDict
+
+from .._types import SequenceNotStr
+
+__all__ = ["BrowserNetworkUpdateParam"]
+
+
+class BrowserNetworkUpdateParam(TypedDict, total=False):
+    """Network configuration changes for a running browser session.
+
+    Other network settings can only be set at creation.
+    """
+
+    allowed_hosts: Optional[SequenceNotStr[str]]
+    """
+    Replaces the session's egress allowlist, using the same entry rules as
+    network.allowed_hosts on create. Omit to leave the allowlist unchanged, or set
+    to null to remove it and return to unfiltered egress; an empty list is invalid.
+    The new list applies without restarting the browser: new requests to
+    destinations it no longer allows are refused within a few seconds, and open
+    connections to them are closed within about 30 seconds, or up to 10 minutes
+    during a Kernel deploy. Connections to destinations it still allows, such as
+    WebSockets, stay open. A start_url in the same request must be allowed by the
+    updated list, and is loaded only after the list takes effect. Requires a browser
+    created with proxy v3, and not supported on pooled browsers. If the request
+    fails, retry it: the new list may already apply to some requests.
+    """

src/kernel/types/browser_update_params.py

@@ -7,6 +7,7 @@
 
 from .tags_param import TagsParam
 from .browser_proxy_config_param import BrowserProxyConfigParam
+from .browser_network_update_param import BrowserNetworkUpdateParam
 from .shared_params.browser_profile import BrowserProfile
 from .shared_params.browser_viewport import BrowserViewport
 from .browsers.browser_telemetry_categories_config_param import BrowserTelemetryCategoriesConfigParam
@@ -36,6 +37,9 @@ class BrowserUpdateParams(TypedDict, total=False):
     must be unique among active sessions within the project.
     """
 
+    network: BrowserNetworkUpdateParam
+    """Network configuration changes to apply to the running browser session."""
+
     profile: BrowserProfile
     """Profile to load into the browser session.
 

src/kernel/types/proxy.py

@@ -12,7 +12,6 @@
     "ConfigRegistryManagedProxy",
     "ConfigRegistryManagedProxyCreate",
     "ConfigRegistryManagedProxyCreateConfig",
-    "ConfigRegistryManagedProxyCreateConfigDatacenterProxyConfig",
     "ConfigRegistryManagedProxyCreateConfigIspProxyConfig",
     "ConfigRegistryManagedProxyCreateConfigResidentialProxyConfig",
     "ConfigRegistryManagedProxyCreateConfigMobileProxyConfig",
@@ -26,13 +25,6 @@ class ConfigRegistryDirectProxy(BaseModel):
     mode: Literal["direct"]
 
 
-class ConfigRegistryManagedProxyCreateConfigDatacenterProxyConfig(BaseModel):
-    """Configuration for a datacenter proxy."""
-
-    country: Optional[str] = None
-    """ISO 3166 country code. Defaults to US if not provided."""
-
-
 class ConfigRegistryManagedProxyCreateConfigIspProxyConfig(BaseModel):
     """Configuration for an ISP proxy."""
 
@@ -111,7 +103,6 @@ class ConfigRegistryManagedProxyCreateConfigCreateCustomProxyConfig(BaseModel):
 
 
 ConfigRegistryManagedProxyCreateConfig: TypeAlias = Union[
-    ConfigRegistryManagedProxyCreateConfigDatacenterProxyConfig,
     ConfigRegistryManagedProxyCreateConfigIspProxyConfig,
     ConfigRegistryManagedProxyCreateConfigResidentialProxyConfig,
     ConfigRegistryManagedProxyCreateConfigMobileProxyConfig,
@@ -122,18 +113,13 @@ class ConfigRegistryManagedProxyCreateConfigCreateCustomProxyConfig(BaseModel):
 class ConfigRegistryManagedProxyCreate(BaseModel):
     """Configuration for routing traffic through a proxy."""
 
-    type: Literal["datacenter", "isp", "residential", "mobile", "custom"]
-    """Proxy type to use.
-
-    In terms of quality for avoiding bot-detection, from best to worst: `mobile` >
-    `residential` > `isp` > `datacenter`.
-    """
+    type: Literal["isp", "residential", "mobile", "custom"]
 
     bypass_hosts: Optional[List[str]] = None
     """Hostnames that should bypass the parent proxy and connect directly."""
 
     config: Optional[ConfigRegistryManagedProxyCreateConfig] = None
-    """Configuration specific to the selected proxy `type`."""
+    """Configuration for an ISP proxy."""
 
     name: Optional[str] = None
     """Readable name of the proxy."""