The account of the key's project, and its traffic to the internet this month
The node's GET /v1/account (sandboxd/openapi/openapi.json) as the control plane answers it: which account and project the key is of, where the account's notices go and in which language, what it owes, whether it is held for its payments (payment_hold: the one call such an account is answered), where it pays from (billing_address, tax_id) and how what it buys is sold there (tax: control/README.md, 税), and its traffic to the internet added up over all its projects and all the nodes, against the allowance of the stretch it is in. An account that owes may read it. Takes read.
https://api.glac.ai/v1/accountAutorisation
Returns
200
The account.
- logsobjectrequired
The limits its apps' logs are held to.
- followersintegerrequired
How many readers may follow the logs of the account's apps at a time, every project's apps together (
follow=trueofGET /v1/apps/{app}/logs): its plan's figure (log_followers=of the plans' flags; 10 on Free and 100 on Paid as the control plane is started unless told otherwise). The one beyond is refused, 429too_many_followers.minimum: 1
- keepsobjectrequired
What the key's project keeps of volumes and Drives (a Drive is counted among its volumes; a database's own Drive is not, and a keyed instance's is in what they hold together and not in their number), by the numbers a create is held to (
POST /v1/volumes,POST /v1/drives: 403volume_limit_reached,drive_limit_reached), with what the project has beside each: the plan's numbers, or an operator's for the account (raised on request:POST /v1/limits/requests,volumesandvolume_bytes). On Free 3, of at most 10 GiB each, 15 GiB together, and 5 GiB where a create gives no size; on a paid plan 500 (a soft limit), of at most 1 TiB each, no total, and a node's own 64 GiB where none is given. - capsobjectrequired
What the account may have at once and what it has of each now: the caps of
CapLimits(thecapsofGET /v1/billing), each withusedbesidelimitandsource(control/README.md, 同时能有多少). - email_verifiedbooleanrequired
Whether
emailis verified: only a verified address is written to. An address the account sets is verified at once where it is the verified one the account has, or the verified address of a user who is a member of the account; otherwise a link that verifies it is mailed to it (verify_account_email, a week), and its notices wait until it is opened (POST /v1/auth/account-email/verify), as an account's with no address do, and so does what is counted from them (the days of a debt). An operator's address is verified by its word; a user's verification verifies the address of the accounts whose notices go to it. False with no address. - email_undeliverablerequired
Mail to
emailbounced, or was complained of, as the sender said after it took it: no notice goes to it (they wait, as an account's with no address do), until the account sets an address again (the same one too). Null while mail goes to it.}L’une des variantes suivantes :
- object
- null
- languageobjectrequired
The language the account's notices are written in, and what says so (control/README.md, 通知的语言). The acknowledgement of a withdrawal and the confirmation of a purchase are written in it; a notice the language has no words for, in English.
- sourcestringrequired
account: the account chose it (PATCH /v1/accountwithlanguage).billing_address: it chose none, and this is the language most people of its billing address's country read first.default: neither says (no choice, and no billing address, or one whose country's language the notices are not written in): English.
- egress_overagestringrequired
What happens at the allowance, as things stand:
payfor an account on Paid that holds a balance (what is past what its period includes is taken from it),stopfor any other: one on Free, whose traffic stops at the day's quota whatever it holds, and one that holds nothing. - egressobjectrequired
What the account's sandboxes have sent to the internet, over all its projects and all the nodes, against the allowance: the
egressofGET /v1/account, and ofGET /v1/usagewhen it lists sandboxes. The node'sAccountEgresswith the stretch, the calendar month, the project, what is past the allowance comes to, and why traffic is stopped.- regionsobjectrequired
Of the traffic of the stretch, region by region: the region of the node it left from:
naNorth America (and a node with no region),euEurope,apAsia-Pacific. The allowance takes the dearest region's bytes first; each region is priced and rounded on its own, andoverage_usdis theirs added up.}
- debtrequired
What the account owes, the same as the
debtofGET /v1/billing; null for an account that owes nothing.}L’une des variantes suivantes :
- Debt
- objectstringrequired
- idstringrequired
- stateowingoudeletingoupaidoudeletedrequired
owing: the account owes, and nothing of it can be used.deleting: its date is past, and what it stores is being deleted. An account is shown a debt of these two only.paid: it was paid, or what it owes came to less than a debt is.deleted: what the account stored was deleted, and what it owed was written off. - in_debt_sincestringrequired
When the account was found to owe as much as a debt is.
format: date-time - owed_usdnumberrequired
What it owes now: what its balance is below zero by. Of a debt that has ended, 0.
- data_deleted_atstring | nullrequired
When what the account stores is deleted if it still owes: the latest date a notice the sender accepted has said. Null while no notice of the debt has been accepted (nothing is deleted then), and while an operator holds the account. Of a debt that ended with the deletion, when that was.
format: date-time - notice_daysintegerrequired
How many days an account that owes is given from its first notice (
--debt-days). - on_holdbooleanrequired
An operator holds the account: nothing of it is deleted, and the count of its days stands still.
- charge_atstring | nullrequired
When what it owes is charged to the account's card next: 00:00 UTC on its first billing day after the debt began, or after it was last charged (a billing day is the day of the month the account's subscription began on, or, without one, the day its first top-up was collected; the last day of a month that has no such day). A time that has come is one to charge at the next look. Null: nothing is to be charged, as the account has no card on record (
Balance.card) or no billing day, an operator holds it, its deletion has begun, or it owes less than a debt is. What is charged is what it owes then, rounded up to the cent, and no more than the account's spend limit leaves in the calendar month (Balance.reload_left_usd): what that leaves owed is charged on the next billing day; where the limit leaves less than a debt is, nothing is charged that month, and the first look of the next month charges it (this time stays the one that has come until then).format: date-time - last_chargerequired
The last charge of what it owes to the account's card, and how it went; null before the first.
}L’une des variantes suivantes :
- DebtCharge
- null
- noticestableau deobjectrequired
The notices of this debt, the oldest first: the first one, and, once that is accepted, the reminders that are to come; and one of each charge of it that failed (
charge_failed).- idstringrequired
- objectstringrequired
- kindin_debtoureminder_7oureminder_14oureminder_21oureminder_27oureminder_29+8 autresrequired
in_debt: the first notice of a debt.reminder_<day>: on that day after it (the days are the control plane's,--debt-reminder-days).charge_failed: what it owes was charged to the account's card on its billing day, and the charge failed; one of each such charge.data_deleted: what the account stored has been deleted, and the debt is written off.storage_80,storage_100: before any debt, the storage the account's plan includes is used to four fifths, or used up, and it holds nothing.subscription_charge_failed: the fee of the period of its subscription that was due could not be charged; one of each such charge, the first and each one made again in the days of grace.reload_failed: an auto reload could not be charged; one of each.reload_no_card: auto reload is on and the balance below its line, and the account has no card on record to charge; once a calendar month while it is so.included_80,included_100: what its plan includes of CPU time, memory, requests or traffic is four fifths used, or all, and it holds nothing and auto reload will not top it up; once a meter, a mark and a stretch. - stateto_sendouacceptedoufailedoucancelledrequired
to_send: not handed to the sender yet, or handed over and not answered.accepted: the sender took it to deliver.failed: the sender said that it could not; of a debt's notice another is made after a while.cancelled: it is sent no more (the debt was paid; a later reminder said what it would have). An account is not shown its cancelled ones. - due_atstringrequired
From when it is handed to the sender.
format: date-time - sent_atstring | nullrequired
When it was handed to the sender, of one the sender accepted; null otherwise. Of a debt's first notice: the moment the debt's days are counted from.
format: date-time - subjectstring | nullrequired
Its subject, once it has been handed over.
- null
- payment_holdrequired
That the account is held for its payments, since when, and to write to support; null for one that is not. Nothing of why: that is the operator's (
GET /internal/accounts/{id},payment_hold).}L’une des variantes suivantes :
- AccountHoldShown
- objectstringrequired
- sincestringrequiredformat: date-time
- messagestringrequired
That nothing of the account can be used and nothing is charged to it until it is looked at, and to write to support.
- null
- billing_addressrequired
Where the account pays from, which its payments are taxed by; null: it gave none yet, and its payment page asks for it.
}L’une des variantes suivantes :
- BillingAddress
- line1string | nullrequired
- line2string | nullrequired
- citystring | nullrequired
- statestring | nullrequired
The state, province or region; of the US its two letters, by which the sales to each state are counted.
- postal_codestring | nullrequired
- countrystringrequired
ISO 3166-1 alpha-2.
pattern: ^[A-Z]{2}$ - sourcestring | nullrequired
Who gave it: the account, an operator (
PATCH /internal/accounts/{id}), the account on a payment page, Stripe (the customer portal, as Stripe'scustomer.updatedsays it). - set_atstring | nullrequiredformat: date-time
- null
- tax_idrequired
A business's tax id, with what its verification came to; null: none.
}L’une des variantes suivantes :
- TaxId
- typestringrequired
As Stripe names it:
eu_vat,gb_vat,au_abn, ... - valuestringrequired
- verificationobjectrequired
- statusstringrequired
pending: being verified (the account is a business meanwhile, and a payment taken so is held for an operator if it is then not verified);verified;unverified: its authority does not know it (the account is no business);unavailable: it could not be verified (no business either; its payments are flagged for an operator). - verified_namestring | nullrequired
The name the authority has for it, where it said.
- verified_addressstring | nullrequired
- checked_atstring | nullrequired
When its verification was last heard.
format: date-time
- sourcestringrequired
Who gave it: the account, an operator, the account on a payment page, Stripe (the customer portal).
- set_atstring | nullrequiredformat: date-time
- null
400
unknown_parameter.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicestableau deobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}L’une des variantes suivantes :
- Runtime
- ulimitsmap deRuntimeLimitGivenrequired
- sysctlsmap destringrequired
- tmpfstableau deobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serverstableau destringrequired
- searchtableau destringrequired
- optionstableau destringrequired
- shm_size_bytesinteger | nullrequired
- null
401
missing_api_key, invalid_api_key, expired_api_key, invalid_token.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicestableau deobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}L’une des variantes suivantes :
- Runtime
- ulimitsmap deRuntimeLimitGivenrequired
- sysctlsmap destringrequired
- tmpfstableau deobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serverstableau destringrequired
- searchtableau destringrequired
- optionstableau destringrequired
- shm_size_bytesinteger | nullrequired
- null
403
key_scope, needs_api_key, as everywhere. (An account held for its payments is answered this call, which says so: payment_hold.)
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicestableau deobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}L’une des variantes suivantes :
- Runtime
- ulimitsmap deRuntimeLimitGivenrequired
- sysctlsmap destringrequired
- tmpfstableau deobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serverstableau destringrequired
- searchtableau destringrequired
- optionstableau destringrequired
- shm_size_bytesinteger | nullrequired
- null