# Enable network access for custom tasks

> Enable network access for custom tasks - Configure custom tasks to access public networks.

This Markdown file sits beside the HTML page at the same path (with a `.md` suffix). It summarizes the topic and lists links for tools and LLM context.

Companion generated at `2026-04-24T16:03:56.603800+00:00` (UTC).

## Primary page

- [Enable network access for custom tasks](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html): Full documentation for this topic (HTML).

## Sections on this page

- [Get the credentials ID](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#get-the-credentials-id): In-page section heading.
- [Set credentials](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#set-credentials): In-page section heading.
- [Enable public IP address access](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#enable-public-ip-address-access): In-page section heading.
- [Test locally with DRUM](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#test-locally-with-drum): In-page section heading.
- [Example command](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#example-command): In-page section heading.
- [Secrets details](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/custom-task-network-access.html#secrets-details): In-page section heading.

## Related documentation

- [Classic UI documentation](https://docs.datarobot.com/en/docs/classic-ui/index.html): Linked from this page.
- [Modeling](https://docs.datarobot.com/en/docs/classic-ui/modeling/index.html): Linked from this page.
- [Specialized workflows](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/index.html): Linked from this page.
- [Composable ML](https://docs.datarobot.com/en/docs/classic-ui/modeling/special-workflows/cml/index.html): Linked from this page.
- [credentials](https://docs.datarobot.com/en/docs/platform/acct-settings/stored-creds.html#credentials-management): Linked from this page.

## Documentation content

# Enable network access for custom tasks

You can set up custom tasks to have public network access. The code examples on this page showcase a binary estimator task that uses an API endpoint with credentials to gain network access.

## Get the credentials ID

Before configuring network access, you must be able to provide your credentials ID. After setting up your own [credentials](https://docs.datarobot.com/en/docs/platform/acct-settings/stored-creds.html#credentials-management), open your DataRobot user profile and select Credentials Management.

Select your credentials. Once selected, you can copy the credentials ID. The ID is the string that follows `/credentials-management/` in the URL.

## Set credentials

Review the example below of how to add credentials to `model-metadata.yaml`. You can access the example file [in the DRUM repo](https://github.com/datarobot/datarobot-user-models/tree/master/task_templates/2_estimators/13_python_credentials_and_internet_access/model-metadata.yaml). The `typeSchema` is copied from [another example](https://github.com/datarobot/datarobot-user-models/tree/master/task_templates/2_estimators/4_python_binary_classification) in the DRUM repo.

```
# Example: model-metadata.yaml
name: 13_python_credentials_and_internet_access
type: training
environmentID: 5e8c889607389fe0f466c72d
targetType: binary

# These must be actual DataRobot credentials that the author owns
userCredentialSpecifications:
  - key: MY_CREDENTIAL  # A legal POSIX env var key
    valueFrom: 655270e368a555f026e2512d  # A credential ID from DataRobot for which you are the owner
    reminder: my super-cool.com/api api-token  # Optional: any string value that you for a reminder

typeSchema:
  input_requirements:
    - field: data_types
      condition: IN
      value:
        - NUM
    - field: number_of_columns
      condition: NOT_LESS_THAN
      value: 2
    - field: sparse
      condition: EQUALS
      value: SUPPORTED
# This requirement is only ignored because this is an example using test data
```

## Enable public IP address access

In order to have network access from within a custom task, you need to specifically enable it in the Custom Task Version using the `outgoingNetworkPolicy` field. Any new versions will inherit the previous version's `outgoingNetworkPolicy` unless you specify a different one. To do so, you must the REST API.

> [!NOTE] Availability information
> Network access for custom tasks requires usage of DataRobot's early access Python client. You can install the early access client using `pip install datarobot_early_access`.

```
from datarobot.enums import CustomTaskOutgoingNetworkPolicy

task_version = dr.CustomTaskVersion.create_clean(
    custom_task_id=custom_task_id,
    base_environment_id=execution_environment.id,
    folder_path=custom_task_folder,
    outgoing_network_policy=CustomTaskOutgoingNetworkPolicy.PUBLIC,
)
```

For more information, reference the [Python client documentation](https://datarobot-public-api-client.readthedocs-hosted.com/en/early-access/reference/modeling/spec/custom_task.html#create-custom-task-version).

## Test locally with DRUM

If you want to test in DRUM with your credentials, you can fake the data by making a secrets directory and putting all of your secrets there. You can view [the example](https://github.com/datarobot/datarobot-user-models/tree/master/task_templates/2_estimators/13_python_credentials_and_internet_access/secrets) in the DRUM repo.

### Example command

```
drum fit -cd task_templates/2_estimators/13_python_credentials_and_internet_access/ \
--input tests/testdata/10k_diabetes.csv --target-type binary --target readmitted \
--user-secrets-mount-path task_templates/2_estimators/13_python_credentials_and_internet_access/ \
--verbose --logging-level info --show-stacktrace
```

### Secrets details

Each secret file should have corresponding credentials with the same name. The contents of a secret file should be a JSON string that can be cast to one of the secrets objects. All secrets objects are in `custom_model_runner/datarobot_drum/custom_task_interfaces/user_secrets.py`. Your secret response must contain a `credential_type`, which is another name for `datarobot_drum.custom_task_interfaces.user_secrets.SecretType`; however, the value must be all lowercase ( `SecretType.SNOWFLAKE_KEY_PAIR_USER_ACCOUNT` corresponds to `{"credential_type": "snowflake_key_pair_user_account"}`).

For example:

```
@dataclass(frozen=True)
class SnowflakeKeyPairUserAccountSecret(AbstractSecret):
    username: Optional[str]
    private_key_str: Optional[str]
    passphrase: Optional[str] = None
    config_id: Optional[str] = None
```

would be:

```
{
  "credential_type": "snowflake_key_pair_user_account",
  "username": "bob@bob.com",
  "private_key_str": "shhhhhhhh"
}
```