2026-10-22
Sandbox runs isolated environments for commands, files and HTTP services through /sandbox/v1, with an SDK-compatible face at /e2b. Concepts and behavior follow E2B (templates, sandboxes, envd files and commands, timeouts and pause/resume), so E2B experience applies. Differences: templateID resolves to your ready Environment or a public Base and must be supplied explicitly; light sandboxes are own-face only, preserve disk rather than memory on pause and provide a limited shell, line terminals and no metrics; port URLs use the returned sandboxID and domain, not an E2B hostname; network.httpsPorts is rejected; persistent sandboxes can resume on traffic even when autoResume is false. Files and command execution use the envd data plane; the sandbox management methods do not execute commands or write files. Start with praxis.sandbox.templates.list to choose an available template.
Loading…Call /sandbox/v1 directly over HTTP with the X-API-Key header. Use the E2B-compatible API with the official E2B SDK. Changing its API URL alone cannot make it call these endpoints.
HTTP base URL: .
| Method | Path | Description | Support |
|---|---|---|---|
| POST | /v1/sandboxes | Create a sandbox | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/upgrade | Upgrade to a full sandbox | ● Supported |
| GET | /v1/sandboxes | List running sandboxes | ● Supported |
| GET | /v1/sandboxes/{sandboxID} | Get a sandbox | ● Supported |
| PATCH | /v1/sandboxes/{sandboxID} | Rename a sandbox | ● Supported |
| GET | /v1/sandboxes/{sandboxID}/metrics | Get sandbox metrics | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/timeout | Set sandbox timeout | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/pause | Pause a sandbox | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/connect | Connect to a sandbox | ● Supported |
| DELETE | /v1/sandboxes/{sandboxID} | Kill a sandbox | ● Supported |
| GET | /v1/templates | List templates | ● Supported |
| POST | /v1/volumes | Create team volume | ● Supported |
| GET | /v1/volumes | List team volumes | ● Supported |
| GET | /v1/volumes/{volumeID} | Team volume | ● Supported |
| DELETE | /v1/volumes/{volumeID} | Delete team volume | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/fork | Fork a sandbox | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/snapshots | Create a snapshot | ● Supported |
| GET | /v1/snapshots | List snapshots | ● Supported |
| DELETE | /v1/snapshots/{snapshotID} | Delete a snapshot | ● Supported |
| PUT | /v1/sandboxes/{sandboxID}/network | Update sandbox network | ● Supported |
| GET | /v1/sandboxes/{sandboxID}/logs | Get sandbox logs | ● Supported |
| POST | /v1/sandboxes/{sandboxID}/extend | Extend a running sandbox without shortening its deadline | ● Supported |
| GET | /v1/sandboxes/{sandboxID}/processes | List live processes and retained observations | ● Supported |
| GET | /v1/sandboxes/{sandboxID}/processes/{processID}/output | Read bounded observed process output | ● Supported |
For authoritative parameter definitions, see the official E2B documentation.
Errors follow the E2B format, see errors; quotas and response headers are covered in rate limits.
/sandbox/v1/sandboxes● SupportedtemplateIDstring必填Template ID or alias from templates.list; resolves to your ready Environment first, then a public Base. Supply it explicitly.
timeoutinteger可选Lifetime of the new sandbox in seconds. Defaults to 300 seconds when omitted.
autoPauseboolean可选Automatically pauses the sandbox after the timeout
metadataany可选Your own string key/value pairs stored with the sandbox; usable as a filter in listSandboxes.
envVarsany可选Environment variables as name to value string pairs.
allow_internet_accessboolean可选Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config.
autoPauseMemoryboolean可选Controls the snapshot kind taken when the sandbox auto-pauses on timeout (only relevant when autoPause is true). When false, the auto-pause drops the in-memory state and persists only the filesystem (a filesystem-only snapshot); resuming it cold-boots (reboots) the sandbox from disk. Such a snapshot cannot be auto-resumed by traffic and must be resumed explicitly, so it cannot be combined with autoResume. Defaults to true (full memory snapshot).
autoResumeobject可选Auto-resume configuration for paused sandboxes.
enabledboolean必填Auto-resume enabled flag for paused sandboxes. Default false.
networkobject可选Network policy of the sandbox: public access, egress allow and deny lists and proxy.
allowPublicTrafficboolean可选Specify if the sandbox URLs should be accessible only with authentication.
allowOutarray可选List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
denyOutarray可选List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.
egressProxyobject可选SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain).
maskRequestHoststring可选Specify host mask which will be used for all sandbox requests
httpsPortsarray可选Unlike E2B, network.httpsPorts is rejected; omit it and serve plaintext HTTP inside the sandbox. The public port URL still uses HTTPS. The upstream field denotes HTTPS-speaking internal ports, permits self-signed certificates and excludes envd port 49983.
rulesobject可选Per-domain transform rules applied to matching outbound HTTPS requests. Keys may be exact DNS names (for example, "api.example.com") or a leading wildcard (for example, "*.example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "*" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination.
mcpobject可选MCP configuration for the sandbox
iamobject可选Sandbox workload identity configuration. A non-empty, valid tokens map enables workload identity for the sandbox.
tokensobject可选Named workload-token definitions, keyed by a caller-chosen token name.
volumeMountsarray可选Volumes to mount into the sandbox, each with the volume name and the path inside the sandbox.
namestring必填Name of the volume
pathstring必填Path of the volume
201
The platform does not provide E2B's default base template yet: Sandbox.create() without a template returns 404, so name a template explicitly (see List templates for what is available).
Errors follow the E2B format — see error codes
The sandbox was created successfully
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| sandboxID | string | Identifier of the sandbox |
| alias | string | Alias of the template |
| clientID | string | Identifier of the client |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| trafficAccessToken | string | Token required for accessing sandbox via proxy. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/upgrade● SupportedsandboxIDstring必填path: Sandbox ID.
templateIDstring可选Target template, default base (node22 alias). Requires an E2B image or returns INVALID_PARAMS. File, process and data-plane operations return 409 during upgrade.
200
Errors follow the E2B format — see error codes
Upgraded sandbox detail with a replacement access token
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| alias | string | Alias of the template |
| sandboxID | string | Identifier of the sandbox |
| clientID | string | Identifier of the client |
| startedAt | string | Time when the sandbox was started |
| endAt | string | Time when the sandbox will expire |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| allowInternetAccess | boolean | Whether internet access was explicitly enabled or disabled for the sandbox. Null means it was not explicitly set. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
| cpuCount | integer | CPU cores for the sandbox |
| memoryMB | integer | Memory for the sandbox in MiB |
| diskSizeMB | integer | Disk size for the sandbox in MiB |
| metadata | any | Your own string key/value pairs stored with the sandbox; usable as a filter in listSandboxes. |
| state | string | State of the sandbox |
| network | object | Network policy of the sandbox: public access, egress allow and deny lists and proxy. |
| network.allowPublicTraffic | boolean | Specify if the sandbox URLs should be accessible only with authentication. |
| network.allowOut | array<string> | List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries. |
| network.denyOut | array<string> | List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules. |
| network.egressProxy | object | SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain). |
| network.maskRequestHost | string | Specify host mask which will be used for all sandbox requests |
| network.httpsPorts | array<integer> | Unlike E2B, network.httpsPorts is rejected; omit it and serve plaintext HTTP inside the sandbox. The public port URL still uses HTTPS. The upstream field denotes HTTPS-speaking internal ports, permits self-signed certificates and excludes envd port 49983. |
| network.rules | object | Per-domain transform rules applied to matching outbound HTTPS requests. Keys may be exact DNS names (for example, "api.example.com") or a leading wildcard (for example, ".example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination. |
| lifecycle | object | Sandbox lifecycle policy returned by sandbox info. |
| lifecycle.autoResume | boolean | Whether the sandbox can auto-resume. |
| lifecycle.onTimeout | string | Action taken when the sandbox times out. |
| volumeMounts | array<object> | Volumes mounted into the sandbox. |
| volumeMounts[].name | string | Name of the volume |
| volumeMounts[].path | string | Path of the volume |
/sandbox/v1/sandboxes● Supportedmetadatastring可选query: Metadata query used to filter the sandboxes (e.g. "user=abc&app=prod"). Each key and values must be URL encoded.
statearray可选query: live: running; exited: finished; all: all retained observations. Defaults to live.
orderstring可选query: Sort direction by sandbox start time. Defaults to desc (newest first).
startedAfterstring可选query: Return sandboxes started at or after this timestamp.
templatestring可选query: Filter sandboxes by a template ID or alias.
nextTokenstring可选query: Cursor to start the list from
limitinteger可选query: Maximum number of items to return per page
namestring可选query: Case-insensitive literal name substring, 1–64 characters after trimming. Chinese, %, _ and backslash match literally. Combines with filters and pagination; historical NULL names do not match.
200
Errors follow the E2B format — see error codes
Successfully returned all running sandboxes
application/json
| Name | Type | Description |
|---|---|---|
| [].templateID | string | Identifier of the template from which is the sandbox created |
| [].alias | string | Alias of the template |
| [].sandboxID | string | Identifier of the sandbox |
| [].clientID | string | Identifier of the client |
| [].startedAt | string | Time when the sandbox was started |
| [].endAt | string | Time when the sandbox will expire |
| [].cpuCount | integer | CPU cores for the sandbox |
| [].memoryMB | integer | Memory for the sandbox in MiB |
| [].diskSizeMB | integer | Disk size for the sandbox in MiB |
| [].metadata | any | Your own string key/value pairs stored with the sandbox; usable as a filter in listSandboxes. |
| [].state | string | State of the sandbox |
| [].envdVersion | string | Version of the envd running in the sandbox |
| [].volumeMounts | array<object> | Volumes mounted into the sandbox. |
| [].volumeMounts[].name | string | Name of the volume |
| [].volumeMounts[].path | string | Path of the volume |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}● SupportedsandboxIDstring必填path: Sandbox ID.
200
Errors follow the E2B format — see error codes
Successfully returned the sandbox
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| alias | string | Alias of the template |
| sandboxID | string | Identifier of the sandbox |
| clientID | string | Identifier of the client |
| startedAt | string | Time when the sandbox was started |
| endAt | string | Time when the sandbox will expire |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| allowInternetAccess | boolean | Whether internet access was explicitly enabled or disabled for the sandbox. Null means it was not explicitly set. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
| cpuCount | integer | CPU cores for the sandbox |
| memoryMB | integer | Memory for the sandbox in MiB |
| diskSizeMB | integer | Disk size for the sandbox in MiB |
| metadata | any | Your own string key/value pairs stored with the sandbox; usable as a filter in listSandboxes. |
| state | string | State of the sandbox |
| network | object | Network policy of the sandbox: public access, egress allow and deny lists and proxy. |
| network.allowPublicTraffic | boolean | Specify if the sandbox URLs should be accessible only with authentication. |
| network.allowOut | array<string> | List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries. |
| network.denyOut | array<string> | List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules. |
| network.egressProxy | object | SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain). |
| network.maskRequestHost | string | Specify host mask which will be used for all sandbox requests |
| network.httpsPorts | array<integer> | Unlike E2B, network.httpsPorts is rejected; omit it and serve plaintext HTTP inside the sandbox. The public port URL still uses HTTPS. The upstream field denotes HTTPS-speaking internal ports, permits self-signed certificates and excludes envd port 49983. |
| network.rules | object | Per-domain transform rules applied to matching outbound HTTPS requests. Keys may be exact DNS names (for example, "api.example.com") or a leading wildcard (for example, ".example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination. |
| lifecycle | object | Sandbox lifecycle policy returned by sandbox info. |
| lifecycle.autoResume | boolean | Whether the sandbox can auto-resume. |
| lifecycle.onTimeout | string | Action taken when the sandbox times out. |
| volumeMounts | array<object> | Volumes mounted into the sandbox. |
| volumeMounts[].name | string | Name of the volume |
| volumeMounts[].path | string | Path of the volume |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}● SupportedsandboxIDstring必填path: Sandbox ID.
namestring必填New name: 1–64 characters after trimming. A duplicate within your team returns 409. Only name is accepted.
200
Errors follow the E2B format — see error codes
Updated sandbox detail
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| alias | string | Alias of the template |
| sandboxID | string | Identifier of the sandbox |
| clientID | string | Identifier of the client |
| startedAt | string | Time when the sandbox was started |
| endAt | string | Time when the sandbox will expire |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| allowInternetAccess | boolean | Whether internet access was explicitly enabled or disabled for the sandbox. Null means it was not explicitly set. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
| cpuCount | integer | CPU cores for the sandbox |
| memoryMB | integer | Memory for the sandbox in MiB |
| diskSizeMB | integer | Disk size for the sandbox in MiB |
| metadata | any | Your own string key/value pairs stored with the sandbox; usable as a filter in listSandboxes. |
| state | string | State of the sandbox |
| network | object | Network policy of the sandbox: public access, egress allow and deny lists and proxy. |
| network.allowPublicTraffic | boolean | Specify if the sandbox URLs should be accessible only with authentication. |
| network.allowOut | array<string> | List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries. |
| network.denyOut | array<string> | List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules. |
| network.egressProxy | object | SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain). |
| network.maskRequestHost | string | Specify host mask which will be used for all sandbox requests |
| network.httpsPorts | array<integer> | Unlike E2B, network.httpsPorts is rejected; omit it and serve plaintext HTTP inside the sandbox. The public port URL still uses HTTPS. The upstream field denotes HTTPS-speaking internal ports, permits self-signed certificates and excludes envd port 49983. |
| network.rules | object | Per-domain transform rules applied to matching outbound HTTPS requests. Keys may be exact DNS names (for example, "api.example.com") or a leading wildcard (for example, ".example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "" is invalid. Exact rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination. |
| lifecycle | object | Sandbox lifecycle policy returned by sandbox info. |
| lifecycle.autoResume | boolean | Whether the sandbox can auto-resume. |
| lifecycle.onTimeout | string | Action taken when the sandbox times out. |
| volumeMounts | array<object> | Volumes mounted into the sandbox. |
| volumeMounts[].name | string | Name of the volume |
| volumeMounts[].path | string | Path of the volume |
| name | string | Current name of the sandbox. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/metrics● SupportedsandboxIDstring必填path: Sandbox ID.
startinteger可选query: Unix timestamp for the start of the interval, in seconds, for which the metrics
endinteger可选query: Unix timestamp in seconds at which the metrics window ends. Omit it to read up to the latest sample.
200
Errors follow the E2B format — see error codes
Successfully returned the sandbox metrics
application/json
| Name | Type | Description |
|---|---|---|
| [].timestamp | string | Timestamp of the metric entry |
| [].timestampUnix | integer | Timestamp of the metric entry in Unix time (seconds since epoch) |
| [].cpuCount | integer | Number of CPU cores |
| [].cpuUsedPct | number | CPU usage percentage |
| [].memUsed | integer | Memory used in bytes |
| [].memTotal | integer | Total memory in bytes |
| [].memCache | integer | Cached memory (page cache) in bytes |
| [].diskUsed | integer | Disk used in bytes |
| [].diskTotal | integer | Total disk space in bytes |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/timeout● SupportedsandboxIDstring必填path: Sandbox ID.
timeoutinteger必填New lifetime in seconds from now, replacing the current expiry rather than adding to it. May shorten the remaining lifetime.
204
Errors follow the E2B format — see error codes
Successfully set the sandbox timeout
No response body is declared.
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/pause● SupportedsandboxIDstring必填path: Sandbox ID.
memoryboolean可选Whether to capture a full memory snapshot. When false, only the filesystem is persisted and resuming the sandbox cold-boots (reboots) it from disk, losing in-memory state, running processes, and open connections. Resume it with an explicit request (connect or resume); auto-resume, which can be triggered by arbitrary traffic, refuses such a sandbox. Defaults to true.
204
Errors follow the E2B format — see error codes
The sandbox was paused successfully and can be resumed
No response body is declared.
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/connect● SupportedsandboxIDstring必填path: Sandbox ID.
timeoutinteger可选Requested remaining lifetime in seconds from the connection. Defaults to 300 seconds; an existing later expiry is preserved.
memoryboolean可选Defaults to true. When false and the sandbox is paused, resume from disk state only: the sandbox cold-boots fresh and any memory in the snapshot is ignored, never modified or deleted. Disk state has crash-recovery semantics — writes not flushed before the pause may be lost. A no-op for snapshots that contain no memory. Rejected with an error in environments where this capability is not enabled, never silently downgraded to a memory restore.
201
Errors follow the E2B format — see error codes
The sandbox was already running
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| sandboxID | string | Identifier of the sandbox |
| alias | string | Alias of the template |
| clientID | string | Identifier of the client |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| trafficAccessToken | string | Token required for accessing sandbox via proxy. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
The sandbox was resumed successfully
application/json
| Name | Type | Description |
|---|---|---|
| templateID | string | Identifier of the template from which is the sandbox created |
| sandboxID | string | Identifier of the sandbox |
| alias | string | Alias of the template |
| clientID | string | Identifier of the client |
| envdVersion | string | Version of the envd running in the sandbox |
| envdAccessToken | string | Access token used for envd communication |
| trafficAccessToken | string | Token required for accessing sandbox via proxy. |
| domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}● SupportedsandboxIDstring必填path: Sandbox ID.
204
Errors follow the E2B format — see error codes
The sandbox was killed successfully
No response body is declared.
/sandbox/v1/templates● SupportedteamIDstring可选query: Id of the team whose templates to list. Omit it to list the templates of your own team; a team you do not belong to answers 403.
nextTokenstring可选query: Cursor to start the list from
limitinteger可选query: Maximum number of items to return per page
200
Errors follow the E2B format — see error codes
Successfully returned all templates
application/json
| Name | Type | Description |
|---|---|---|
| [].templateID | string | Identifier of the template |
| [].buildID | string | Identifier of the last successful build for given template |
| [].cpuCount | integer | CPU cores for the sandbox |
| [].memoryMB | integer | Memory for the sandbox in MiB |
| [].diskSizeMB | integer | Disk size for the sandbox in MiB |
| [].public | boolean | Whether the template is public or only accessible by the team |
| [].aliases | array<string> | Aliases of the template |
| [].names | array<string> | Names of the template (namespace/alias format when namespaced) |
| [].createdAt | string | Time when the template was created |
| [].updatedAt | string | Time when the template was last updated |
| [].createdBy | object | User who created the template; null for templates created by the platform. |
| [].createdBy.id | string | Identifier of the user |
| [].createdBy.email | string | Email of the user |
| [].lastSpawnedAt | string | Time when the template was last used |
| [].spawnCount | integer | Number of times the template was used |
| [].buildCount | integer | Number of times the template was built |
| [].envdVersion | string | Version of the envd running in the sandbox |
| [].buildStatus | string | Status of the template build |
/sandbox/v1/volumes● Supportednamestring必填Volume name, unique within your team. Use one or more ASCII letters, digits, underscores or hyphens.
201
Errors follow the E2B format — see error codes
Successfully created a new team volume
application/json
| Name | Type | Description |
|---|---|---|
| volumeID | string | ID of the volume |
| name | string | Name of the volume |
| token | string | Auth token to use for interacting with volume content |
| domain | string | Domain to use as the destination for volume content requests, replacing the default `api.<E2B_DOMAIN>`. Only returned when the team is connected to a custom (BYOC) cluster; absent otherwise, in which case the default domain is used. |
The own endpoint adds createdAt (string, ISO 8601 UTC creation time) to the response, or each list row.
The gateway sets X-Praxis-Face: own-v1; clients need not send it. The /e2b compatibility endpoint strips this header and retains its vendor response shape.
/sandbox/v1/volumes● Supported200
Errors follow the E2B format — see error codes
Successfully listed all team volumes
application/json
| Name | Type | Description |
|---|---|---|
| [].volumeID | string | ID of the volume |
| [].name | string | Name of the volume |
The own endpoint adds createdAt (string, ISO 8601 UTC creation time) to the response, or each list row.
The gateway sets X-Praxis-Face: own-v1; clients need not send it. The /e2b compatibility endpoint strips this header and retains its vendor response shape.
/sandbox/v1/volumes/{volumeID}● SupportedvolumeIDstring必填path: Id of the team volume, the `volumeID` returned by createVolume or listVolumes.
200
Errors follow the E2B format — see error codes
Successfully retrieved a team volume
application/json
| Name | Type | Description |
|---|---|---|
| volumeID | string | ID of the volume |
| name | string | Name of the volume |
| token | string | Auth token to use for interacting with volume content |
| domain | string | Domain to use as the destination for volume content requests, replacing the default `api.<E2B_DOMAIN>`. Only returned when the team is connected to a custom (BYOC) cluster; absent otherwise, in which case the default domain is used. |
The own endpoint adds createdAt (string, ISO 8601 UTC creation time) to the response, or each list row.
The gateway sets X-Praxis-Face: own-v1; clients need not send it. The /e2b compatibility endpoint strips this header and retains its vendor response shape.
/sandbox/v1/volumes/{volumeID}● SupportedvolumeIDstring必填path: Id of the team volume, the `volumeID` returned by createVolume or listVolumes.
204
Errors follow the E2B format — see error codes
Successfully deleted a team volume
No response body is declared.
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/fork● SupportedsandboxIDstring必填path: Sandbox ID.
timeoutinteger可选Time to live for each fork in seconds.
countinteger可选Number of independent forks from one snapshot; each entry reports its own result or error.
201
Errors follow the E2B format — see error codes
The sandbox was snapshotted and the forks were attempted; each entry reports one fork's outcome
application/json
| Name | Type | Description |
|---|---|---|
| [].sandbox | object | Sandbox created from a template. |
| [].sandbox.templateID | string | Identifier of the template from which is the sandbox created |
| [].sandbox.sandboxID | string | Identifier of the sandbox |
| [].sandbox.alias | string | Alias of the template |
| [].sandbox.clientID | string | Identifier of the client |
| [].sandbox.envdVersion | string | Version of the envd running in the sandbox |
| [].sandbox.envdAccessToken | string | Access token used for envd communication |
| [].sandbox.trafficAccessToken | string | Token required for accessing sandbox via proxy. |
| [].sandbox.domain | string | Domain returned for sandbox traffic. Build an HTTP service URL as https://<port>-<sandboxID>.<domain> using the returned values, without replacing or stripping the sandboxID suffix. |
| [].error | object | Error body: numeric code, machine-readable error_code and a message. |
| [].error.code | integer | Error code |
| [].error.error_code | string | Machine-readable semantic error code. Not a closed set; initial values: sandbox_capacity_unavailable, sandbox_placement_timeout, sandbox_no_compatible_node, sandbox_create_failed, internal_server_error. |
| [].error.message | string | Human-readable description of the error. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/snapshots● SupportedsandboxIDstring必填path: Sandbox ID.
namestring可选Optional alias. Reusing it within your subject updates the existing snapshot and retains its platform ID.
201
Errors follow the E2B format — see error codes
Snapshot created successfully
application/json
| Name | Type | Description |
|---|---|---|
| snapshotID | string | Identifier of the snapshot template including the tag. Uses namespace/alias when a name was provided (e.g. team-slug/my-snapshot:default), otherwise falls back to the raw template ID (e.g. abc123:default). |
| names | array<string> | Full names of the snapshot template including team namespace and tag (e.g. team-slug/my-snapshot:v2) |
The own endpoint adds createdAt (string, ISO 8601 UTC creation time) to the response, or each list row.
Snapshots also include sourceSandboxID (string, public source sandbox ID) and sourceSandboxName (string or null). If the name is unavailable, it is null; display the ID as fallback.
The gateway sets X-Praxis-Face: own-v1; clients need not send it. The /e2b compatibility endpoint strips this header and retains its vendor response shape.
Send {"name":"my-snapshot"} in the JSON body of POST /sandbox/v1/sandboxes/{sandboxID}/snapshots to name a snapshot. The name is persisted and returned in names.
/sandbox/v1/snapshots● SupportedsandboxIDstring可选query: Filter by source sandbox ID.
namestring可选query: Filter by the original user alias or platform snap_ snapshot ID.
limitinteger可选query: Maximum snapshots per page.
nextTokenstring可选query: Cursor from the previous response's X-Next-Token header.
200
Errors follow the E2B format — see error codes
Successfully returned snapshots
application/json
| Name | Type | Description |
|---|---|---|
| [].snapshotID | string | Identifier of the snapshot template including the tag. Uses namespace/alias when a name was provided (e.g. team-slug/my-snapshot:default), otherwise falls back to the raw template ID (e.g. abc123:default). |
| [].names | array<string> | Full names of the snapshot template including team namespace and tag (e.g. team-slug/my-snapshot:v2) |
The own endpoint adds createdAt (string, ISO 8601 UTC creation time) to the response, or each list row.
Snapshots also include sourceSandboxID (string, public source sandbox ID) and sourceSandboxName (string or null). If the name is unavailable, it is null; display the ID as fallback.
The gateway sets X-Praxis-Face: own-v1; clients need not send it. The /e2b compatibility endpoint strips this header and retains its vendor response shape.
/sandbox/v1/snapshots/{snapshotID}● SupportedsnapshotIDstring必填path: The snap_ snapshot ID returned by this platform.
204
Errors follow the E2B format — see error codes
The template was deleted successfully
No response body is declared.
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/network● SupportedsandboxIDstring必填path: Sandbox ID.
allow_internet_accessboolean可选Allow internet access; false is equivalent to denyOut containing 0.0.0.0/0.
allowOutarray可选Allowed egress CIDRs, IPs or domains; allow rules take precedence over deny rules.
denyOutarray可选Denied egress CIDRs or IPs; domains are not supported.
egressProxyobject可选Upstream proxy configuration; not currently applied by this platform.
addressstring必填SOCKS5 proxy address in host:port format (e.g. "proxy.example.com:1080").
usernamestring可选Optional SOCKS5 username (RFC 1929), max 255 bytes.
passwordstring可选Optional SOCKS5 password (RFC 1929), max 255 bytes.
rulesobject可选Upstream per-domain transform rules; not currently applied by this platform.
204
Errors follow the E2B format — see error codes
Successfully updated the sandbox network configuration
No response body is declared.
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/logs● SupportedsandboxIDstring必填path: Sandbox ID.
cursorinteger可选query: Starting timestamp in Unix milliseconds.
limitinteger可选query: Maximum log entries to return.
directionstring可选query: Read forward or backward in time.
levelstring可选query: Minimum log level to return.
searchstring可选query: Case-sensitive substring filter on log messages.
200
Errors follow the E2B format — see error codes
Successfully returned the sandbox logs
application/json
| Name | Type | Description |
|---|---|---|
| logs | array<object> | Sandbox logs structured |
| logs[].timestamp | string | Timestamp of the log entry |
| logs[].message | string | Log message content |
| logs[].level | string | State of the sandbox |
| logs[].fields | object | Structured key/value fields attached to the log line. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/extend● SupportedsandboxIDstring必填path: Sandbox ID.
timeoutnumber必填Seconds from now: 900, 1800, or 3600. Must extend the existing deadline.
200
Errors follow the E2B format — see error codes
Authoritative extended deadline
application/json
| Name | Type | Description |
|---|---|---|
| endAt | string | New expiry time of the sandbox, UTC. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/processes● SupportedsandboxIDstring必填path: Sandbox ID.
statestring可选query: live: running; exited: finished; all: all retained observations. Defaults to live.
200
Errors follow the E2B format — see error codes
Bounded observation with explicit completeness
application/json
| Name | Type | Description |
|---|---|---|
| processes | array<object> | Processes of the sandbox: running ones and retained observations of exited ones, newest first. |
| processes[].processId | string | Id of the process: `obs-<n>` for a process whose start was observed, `live-<pid>` for one that was only seen running. |
| processes[].pid | integer | Operating-system process id inside the sandbox. |
| processes[].tag | string | Tag the process was started with; absent when none. |
| processes[].config | object | Command the process was started with. |
| processes[].pty | boolean | Whether the process runs in a pseudo-terminal; present for observed processes. |
| processes[].startedAt | string | Time at which the process start was observed, UTC. |
| processes[].exitedAt | string | Time at which the process exit was observed, UTC; absent until an exit was witnessed. |
| processes[].exitCode | integer | Exit code; present only when the exit was witnessed. |
| processes[].state | string | Current state of the process. |
| processes[].observed | boolean | Whether the platform watched this process start. False for a process that was only seen running. |
| processes[].observationGap | boolean | True when observation was interrupted, so output or the exit may be missing; the state can then be unknown. |
| processes[].outputTruncated | boolean | True when old output chunks were dropped to stay within the retention limits. |
Call Create sandbox first and replace sbx_123 with its returned sandboxID.
/sandbox/v1/sandboxes/{sandboxID}/processes/{processID}/output● SupportedsandboxIDstring必填path: Sandbox ID.
processIDstring必填path: The processId returned by List processes.
200
Errors follow the E2B format — see error codes
Bounded observation with explicit completeness
application/json
| Name | Type | Description |
|---|---|---|
| chunks | array<object> | Retained output chunks of the process, oldest first. |
| chunks[].seq | integer | Sequence number of the chunk; it increases with time and orders chunks. |
| chunks[].stream | string | Which stream the chunk came from. |
| chunks[].data | string | Output bytes of the chunk, base64 encoded. |
| chunks[].timestamp | number | Time at which the chunk was recorded, in Unix milliseconds. |
| complete | boolean | True when the output is whole: the exit was witnessed, no gap occurred and nothing was truncated. |
| gap | boolean | True when observation was interrupted, so chunks or the exit may be missing. |
| truncated | boolean | True when old chunks were dropped to stay within the retention limits. |
| exitCode | integer | null | Exit code of the process; null until an exit was witnessed. |