> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terminal3.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Outbound HTTP calls are authorized by the user, not the contract

Your TEE contract does not declare which hosts it may call. A tenant contract's outbound HTTP egress is resolved, on every call, from the **calling user's authorization grant** — the *allowed hosts* the user grants when they delegate to your agent or contract:

* **Delegated call** → the subject user's grant.
* **Direct (self) call** → the caller's own self-grant.

If the target host (for example `api.duffel.com`) isn't on the grant's allowed-hosts list, the contract still runs but the outbound call is denied with `host/http.egress_denied`.

<Warning>
  This is the most common reason a working contract can't reach its API: the code is fine, but no grant authorizes the host. Set the grant before you invoke — see [Invoke your contract](/developers/adk/get-started/walkthrough/invoke-contract) and [Delegate access](/t3n/data-owner-guide/delegate-access).
</Warning>