Skip to main content
Your TEE contract does not declare which hosts it may call. A tenant contract’s outbound HTTP egress is resolved, on every call, from the calling user’s authorization grant — the allowed hosts the user grants when they delegate to your agent or contract:
  • Delegated call → the subject user’s grant.
  • Direct (self) call → the caller’s own self-grant.
If the target host (for example api.duffel.com) isn’t on the grant’s allowed-hosts list, the contract still runs but the outbound call is denied with host/http.egress_denied.
This is the most common reason a working contract can’t reach its API: the code is fine, but no grant authorizes the host. Set the grant before you invoke — see Invoke your contract and Delegate access.