A custom visual draws inside a sandbox: its own frame on the report tile, apart from the page around it. Everything it loads from the outside, images, links and embedded players, goes through the app and the list of hosts an administrator allows, and its code must pass the sandbox's checks. This page covers what the sandbox allows, which hosts a visual may reach, and what the checks refuse.
fetch are blocked, and browser storage calls such as document. and localStorage are refused.The Sandbox Allowed Hosts list decides where a visual may load images from, open links to and embed players from. An administrator keeps the list under Admin > System Configuration > Security; the panel and its rules are described in Scheduler, health, maps and connector safety.
example. allows that host and its subdomains. *. allows subdomains only, not example. itself, and * allows every host on the internet.localhost and internationalised names, kept in their punycode form, are valid patterns too.https addresses load. A plain http address is never loaded.A visual can put row values into the addresses it loads, so the host list also decides where report data may travel.
https addresses.* never opens straight away: the viewer is asked first, with Open this link? and Open link.https addresses on the list. The visual's own code cannot fetch them.https address whose host is on the list; the check uses the host the player finally loads from.A refused image is recorded for the tile, so open the tile's Diagnostics to read what the sandbox said; the messages a failing tile carries are listed in Troubleshooting custom visuals.
| The message | What it means |
|---|---|
Only https URLs can be loaded into a visual. | The address is not https. |
{host} is not in the sandbox allowlist. | The host is missing from the Sandbox Allowed Hosts list. |
The image host does not resolve to a reachable public address. | The host has no publicly reachable address. |
The image host did not return the image. | The host answered with an error, or the load could not be finished. |
The image host did not answer within 10 seconds. | The host was too slow. |
The URL did not return an image. | The answer was not an image file, or an SVG that could not be cleaned. |
The image is larger than 10 MB. | The file is over the size limit. |
Too many image requests. | Too many fetches arrived at once. |
The Studio runs the checks while you edit, and publishing a visual to the library runs them again. Each finding carries a code, such as forbidden-api, external-url, javascript-url, base-element, missing-ready, literal-color or password-field.
http address draws uses an http URL; only https URLs on an allowlisted host are loaded, and an address that would leave the frame draws references an external URL; the sandbox has no network.data-uni-src or an image's src, the host must be on the list; otherwise the finding names it, such as cdn.example.com is not in the sandbox allowlist.javascript: addresses. They are refused: uses a javascript: URL.<base> element, no inline event attributes. Both are refused: uses <base>, which is refused and uses an inline onclick handler; register listeners from visual.js.uni. or uni. is flagged with visual.js never calls uni.render() or uni.ready(); the host waits for a ready signal./, on the line itself or the line before.The visual tried to reach a host that is not on the allowlist, so it was refused with Link blocked. An administrator can add the host under Admin > System Configuration > Security; see Scheduler, health, maps and connector safety.
The host is allowed only by the * pattern, which permits any host on the internet. Instead of opening it straight away, the app asks the viewer first: Open link continues, and anything else leaves it closed.
Three things must be true: the author switched on Allow links for the visual, the address is https, and the viewer acted inside the visual just before. If the host is not on the allowlist, the report shows Link blocked instead.
Yes. A bare pattern allows the host and its subdomains. To allow subdomains only, and not the host itself, use *.. When several patterns match, the most specific one decides.
Three surfaces: images a visual loads, links it opens and players it embeds. Only https addresses count, and the check uses the host the content finally loads from, not the address written in the code.
Either the address is not https, or the host the player loads from is not on the list; a shared video link can resolve to a player on another host, so allow that host too. A refused embed reads Embed blocked, and one visual can carry only a limited number of embeds.
The sandbox has no network of its own, and browser storage is refused. Load outside content through the app instead: images through the addresses the template loads, such as data-uni-src or a plain image src, and links through Allow links. The checks name the call they refuse, with the sandbox CSP blocks it.
The host waits until the code says it has finished drawing: call uni. or uni.. Without it, the finding reads visual.js never calls uni.render() or uni.ready(); the host waits for a ready signal.
Library visuals must use theme tokens, so literal colours block publishing. Replace the colour with the token the finding suggests, or mark the line with / when the colour is brand artwork on purpose. See Custom visuals and the visual library.
No. DataPrism never asks for credentials inside a report tile, and the checks flag fields that look like a password prompt. Do not type credentials into a visual.
An administrator, through the Sandbox Allowed Hosts list under Admin > System Configuration > Security. The permission that changes the list is an administration permission, not a DataPrism one; ask an administrator to add a host for you. See Scheduler, health, maps and connector safety.