Skip to content

Upgraded connections aren't allowed to this destination

Code: egress.upgrade_not_allowed

The destination takes no upgraded connections, such as a WebSocket.

Awake’s answer says:

the box's egress policy doesn't allow upgraded connections to this destination

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

Ask your Awake admin to allow upgraded connections to this destination.

Over plain HTTP, such as a ws:// URL, the proxy never upgrades a connection, whatever the destination allows: use wss:// or https instead.

In the console, an Org admin opens Admin → Policies → Destinations.

There, a destination takes upgraded connections over https when every method on it is allowed, or when it’s tunneled.

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

Ask your Awake admin. Give them the code, egress.upgrade_not_allowed, and when it happened.