docs: document and un-gate allowedDomains session setting

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 27
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/browserbase/browserbase-a896c28015c625eaa4efd6319489dc91c932a6ab17780c5e1bf3648bd4bed9c7.yml
-openapi_spec_hash: a1ee972826c5331971d4d9b437f9e6d5
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/browserbase/browserbase-325727e382d1635cdcff3d81e93432c314290a644a5252095fc9d23350e8fbae.yml
+openapi_spec_hash: 1c0874c5d6253bdf144e617203d788c7
 config_hash: d4b0c534eaf7665ea25168e0e824c9d3

src/browserbase/types/session_create_params.py

@@ -90,6 +90,18 @@ class BrowserSettings(TypedDict, total=False):
     advanced_stealth: Annotated[bool, PropertyInfo(alias="advancedStealth")]
     """Advanced Browser Stealth Mode"""
 
+    allowed_domains: Annotated[SequenceNotStr[str], PropertyInfo(alias="allowedDomains")]
+    """An optional list of allowed domains for the session.
+
+    If you pass one or more domains, Browserbase restricts top-level (main-frame)
+    page navigations to the listed domains and their subdomains. For example,
+    `example.com` also permits `www.example.com` and `a.b.example.com`, but not
+    `notexample.com`. Matching is domain-based, not full-URL. An empty list (the
+    default) disables the restriction entirely. Browserbase enforces only main-frame
+    navigations; it does not block iframe/subframe loads or other in-page resource
+    requests (images, scripts, XHR, etc.).
+    """
+
     block_ads: Annotated[bool, PropertyInfo(alias="blockAds")]
     """Enable or disable ad blocking in the browser. Defaults to `false`."""
 

tests/api_resources/test_sessions.py

@@ -33,6 +33,7 @@ def test_method_create_with_all_params(self, client: Browserbase) -> None:
         session = client.sessions.create(
             browser_settings={
                 "advanced_stealth": True,
+                "allowed_domains": ["string"],
                 "block_ads": True,
                 "captcha_image_selector": "captchaImageSelector",
                 "captcha_input_selector": "captchaInputSelector",
@@ -269,6 +270,7 @@ async def test_method_create_with_all_params(self, async_client: AsyncBrowserbas
         session = await async_client.sessions.create(
             browser_settings={
                 "advanced_stealth": True,
+                "allowed_domains": ["string"],
                 "block_ads": True,
                 "captcha_image_selector": "captchaImageSelector",
                 "captcha_input_selector": "captchaInputSelector",