Outbound HTTP calls are authorized by the user, not the contract - Terminal 3 Documentation

Documentation Index

Fetch the complete documentation index at: /llms.txt

Use this file to discover all available pages before exploring further.

Your TEE contract does not declare which hosts it may call. A tenant contract’s outbound HTTP egress is resolved, on every call, from the calling user’s authorization grant — the allowed hosts the user grants when they delegate to your agent or contract:

• Delegated call → the subject user’s grant.
• Direct (self) call → the caller’s own self-grant.

If the target host (for example api.duffel.com) isn’t on the grant’s allowed-hosts list, the contract still runs but the outbound call is denied with host/http.egress_denied.

This is the most common reason a working contract can’t reach its API: the code is fine, but no grant authorizes the host. Set the grant before you invoke — see Invoke your contract and Delegate access.