The destination isn't allowed

Code: egress.not_allowed

What happened

No destination the box may reach covers the host.

Awake’s answer says:

the box's egress policy doesn't allow this destination

Why Awake does this

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

What you can do

Ask for it in Requests where your org lets you, or ask your Awake admin to add it.

Check the host’s name first: a typo reads the same as a host nobody allowed. If it’s the one you meant, ask for it in Requests where your org lets members ask; the answer names who approves it.

Some tools, such as some Node.js clients, send an http:// request as a tunnel to port 80, which the proxy refuses with this code even for a host your box may reach. Use https instead.

What your admin can do

In the console, an Org admin opens Admin → Policies → Destinations.

An Org admin adds the host as a destination in Admin → Policies → Destinations, for the methods and paths your work needs, and publishes the policy. To cover every host under a domain, such as every Google API, a destination can be a wildcard, *.googleapis.com, which is tunneled.

For agents

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

Where Awake records it

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

egress.needs_approval: The destination needs an approval
egress.method_not_allowed: The method isn’t allowed on this destination
egress.path_not_allowed: The path isn’t allowed on this destination
egress.exception: Your org’s exceptions refuse this host

Still stuck

Ask your Awake admin. Give them the code, egress.not_allowed, and when it happened.