Request body.
Optionalexpires_at?: stringOptional eval sandbox expiry in ISO 8601 format. Must be paired with purpose: "eval".
Human-readable display name for the sandbox.
Optionalorg?: stringOrganization ID (org_...) to scope the sandbox to. Defaults to the authenticated viewer's organization when omitted.
Optionalpurpose?: stringOptional sandbox purpose marker. Only "eval" is accepted, and it must be paired with expires_at.
URL-safe identifier for the sandbox. Must be unique within the app.
The newly created sandbox.
Delete a sandbox Soft-deletes the specified sandbox. The sandbox is marked deleted and immediately hidden from list/get queries; all of its active keys are revoked. Hard deletion (child data cascade) is scheduled immediately via the background sandbox deletion worker — the same path used for developer-app soft-delete. The caller must authenticate with app-scoped credentials and be allowed to modify the sandbox. Returns 204 on success. If the sandbox is missing or already deleted, a 404 is returned.
Sandbox ID (dsb_...) of the sandbox to delete.
Empty response with HTTP 204 status on successful deletion.
Retrieve a sandbox
Returns the sandbox identified by sandbox that belongs to the caller's app.
The response includes the sandbox's associated keys (without full secret key
values — full keys are only available at creation time).
The caller must authenticate with app-scoped credentials. Org members may view
their org's sandboxes; developers and all-powerful callers may view app-level
and org-scoped sandboxes in their app. Returns 404 if the sandbox does not
exist or is not visible to the caller.
Sandbox ID (dsb_...) to retrieve.
The requested sandbox.
Create a sandbox key
Issues a new API key for the specified sandbox. Keys can be either
"publishable" (safe to embed in client-side code) or "secret" (server-side
only). The full key value is returned once in the full_key field of this
response and is never retrievable again — store it securely immediately.
The caller must authenticate with app-scoped credentials and be able to
modify the sandbox (org members for org sandboxes; developers / all-powerful
for app-level). If the sandbox does not belong to the caller's app or is not
visible, a 404 is returned. Multiple active keys per sandbox are supported;
revoke individual keys with the revoke key endpoint.
Sandbox ID (dsb_...). The key is created for this sandbox.
Request body.
Optionaltype?: stringKey type. One of "publishable" or "secret". Defaults to "publishable".
The newly created sandbox key, including the one-time full_key value.
Create a sandbox Creates a new sandbox for the caller's app. A sandbox is an isolated environment that can hold its own set of API keys, allowing you to test integrations without affecting production data. The caller must authenticate with app-scoped credentials. Org-scoped viewers may create sandboxes for their organization; developers and all-powerful callers may create app-level or org-scoped sandboxes. If
orgis supplied the sandbox is scoped to that organization; otherwise it defaults to the authenticated viewer's organization. Remote-eval sandboxes may setpurpose: "eval"withexpires_atat creation; TTL is the sole cleanup mechanism for those sandboxes. Returns the new sandbox with the auto-issued publishable key — use the create key endpoint to issue secret keys.