A custom visual draws in a sandboxed frame with no network of its own. When its code wants an outside image, it asks, and DataMind fetches the image for it. Every fetch passes a short set of checks, and a refusal comes back as a message. This page covers those checks, the limits a fetch meets, and the messages the sandbox shows. For the frame's own rules, links and embeds, see Sandbox, network and the allowlist.
https. A plain http address is never loaded.When a fetch is refused, the message says why. A refused image is recorded for the tile, so open the tile's Diagnostics to read what the sandbox said; the messages a failing tile carries are listed in Troubleshooting custom visuals.
| The message | What it means |
|---|---|
Only https URLs can be loaded into a visual. | The address is not https. |
{host} is not in the sandbox allowlist. | The host is missing from the Sandbox Allowed Hosts list. |
The image host does not resolve to a reachable public address. | The host has no publicly reachable address. |
The image host did not return the image. | The host answered with an error, or the load could not be finished. |
The image host did not answer within 10 seconds. | The host was too slow. |
The URL did not return an image. | The answer was not an image file, or an SVG that could not be cleaned. |
The image is larger than 10 MB. | The file is over the size limit. |
Too many image requests. | Too many fetches arrived at once. |
The allowlist's own checks answer in these words:
| The message | What it means |
|---|---|
Enter a host such as example. | The pattern is not a valid host pattern. |
This host pattern is already in the allowlist. | The pattern is already on the list. |
Host pattern not found | The pattern you tried to remove is no longer there. |
DataMind fetches it. The visual's frame has no network of its own, so its code cannot reach the internet directly; it asks, and the fetch runs from DataMind under the checks above. That is why the same rules apply to every viewer, whatever browser or network they use.
Only https addresses are loaded, so a plain http address is never loaded and reads Only https URLs can be loaded into a visual. Use an https address for the image.
Usually because its host is not on the Sandbox Allowed Hosts list. An administrator adds it under Admin > System Configuration > Security; see Scheduler, health, maps and connector safety. If the image is reachable only from inside your network, the sandbox will not reach it either, because it loads from public addresses only.
No. The fetch runs from DataMind and loads from hosts that answer on the public internet only, so an address that resolves only inside your network reads The image host does not resolve to a reachable public address. Host the file publicly and allow that host, or add the file to the visual as an asset; see Custom visual options, data and limits.
Every address in a redirect chain is checked against the list again, so the address the image finally comes from must be allowed too. A chain longer than three redirects stops the load. Allow the final host as well, and shorten the chain where you can.
10 MB. A larger file is refused and reads The image is larger than 10 MB. Serve a smaller version of the image.
About ten seconds. A host that stays silent reads The image host did not answer within 10 seconds. A host that answers with an error, or a load that cannot be finished, reads The image host did not return the image. Try again; if it keeps failing, check the address.
Real image files, judged by their contents. A page, or a file that is not actually an image, reads The URL did not return an image. An SVG is cleaned before it is served, and one that cannot be cleaned is refused the same way.
Too many image fetches arrived in a short time, so the sandbox paused them. Wait a minute and try again, and load fewer images at once.