Activate a sandbox
Returns the sandbox with a fresh access token. If the sandbox is paused, it is resumed first. Idempotent — calling it on an active sandbox just returns a new token.
Authorizations
Path Parameters
The unique identifier of the sandbox.
Public sandbox ID: a bare UUID, or the region-tagged form sb-<region>-<uuid> (e.g. sb-use-1b4e28ba-…). Treat as an opaque string; the tagged form routes the request to the sandbox's home region. Endpoints accept both forms interchangeably.
^(sb-[a-z0-9]+-)?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$Response
The sandbox is active.
Single-sandbox shape — SandboxListItem plus access_token and bound secrets.
Public sandbox ID: a bare UUID, or the region-tagged form sb-<region>-<uuid> (e.g. sb-use-1b4e28ba-…). Treat as an opaque string; the tagged form routes the request to the sandbox's home region. Endpoints accept both forms interchangeably.
^(sb-[a-z0-9]+-)?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$Current state of the sandbox. active means running; paused means paused and awaiting resume. resuming is a transient state observed while the platform restores a paused sandbox (e.g. via auto-resume on /exec); clients should retry shortly.
active, paused, resuming ID of the latest snapshot (present after a pause).
Auto-pause timeout in seconds, if configured. Absent when auto-pause is disabled.
Garbage-collection window for the paused state, if configured. Absent when auto-delete is disabled.
When the sandbox will be deleted. Present only while the sandbox is paused with auto_delete_seconds configured. The deadline is armed when the sandbox pauses (or when the setting is applied to an already-paused sandbox) and cleared on resume.
Current egress allow/deny rules, if any have been configured. Absent when the sandbox uses default network settings.
User-supplied tags attached at creation. Always present — sandboxes created without metadata return {} rather than being absent.
Per-sandbox access token for data-plane operations (file
upload/download, terminal). Pass as the X-Access-Token
header.
Credentials bound to this sandbox. Each entry maps an env-var name visible to the agent to the secret name it resolves to. revoked=true when the underlying secret has been soft-deleted (the env var still holds the now-useless proxy token).