Set where the account's notices go and their language, its billing address and tax id, and its cap on traffic to the internet
What is given changes, and nothing else. email: where the account's notices are sent; null takes the address away. It is verified at once where it is the verified one the account has, or the verified address of a member of the account; otherwise a link that verifies it is mailed to it, and the account's notices wait until it is opened (email_verified, POST /v1/auth/account-email/verify); setting it again mails another. Those links are three of an account, then one every ten minutes (429 rate_limited, before anything of the call is done). language: the language the notices are written in, one of theirs (en, de, fr; 400 invalid_field otherwise), or null for the one most people of its billing address's country read first (language of GET /v1/account says which, and why). An account that owes may change these two, and its billing address and tax id, when they are all the body holds (402 account_in_debt otherwise): paying needs them where only businesses are sold to. egress_overage_cap_bytes: the most bytes in a calendar month the account sends, counted from the month's first byte on any plan and whatever it holds; null takes the cap away. egress_overage says how things stand and is not the account's to choose: what it is now changes nothing; pay from an account that is not on Paid or holds no balance is 403 needs_balance, stop from one on Paid that holds one is 400 invalid_field (a cap is what stops traffic at a number of bytes). billing_address: where the account pays from, which its payments are taxed by (control/README.md, 税): country (two letters, ISO 3166-1) and as many of line1, line2, city, state and postal_code as there are (of the US the state and the ZIP code, of Canada the province or the postal code, which the tax there goes by); null takes it away. tax_id: a business's tax id as Stripe names it, type (eu_vat, gb_vat, au_abn, ...) and value (an EU VAT number with its country's two letters before it: DE123456789); null takes it away. Where Stripe collects, both are set on the account's customer at Stripe first, and what Stripe refuses of them is refused (400 invalid_field) and not set; Stripe verifies the tax id with its authority (VIES, HMRC, the ABR): it is pending until Stripe says what it came to (tax_id.updated), and a tax id that is not verified is taken off the customer again. Where what stands in for a collector collects, it verifies the tax id at once, as it is told to (PATCH /internal/charges/collector). An account whose tax id is verified, or still being verified, is a business: it can pay where only businesses are sold to (tax.can_pay), and where the platform is registered what it pays is reverse charged (no tax is added). The account's own word for its address confirms it for the payments it was asked to confirm it for (the notice tax_address_confirm). Takes admin.
https://api.glac.ai/v1/accountהרשאה
גוף הבקשהJSONחובה
Returns
200
The account, as it is now.
- logsobjectrequired
The limits its apps' logs are held to.
- followersintegerrequired
How many readers may follow the logs of the account's apps at a time, every project's apps together (
follow=trueofGET /v1/apps/{app}/logs): its plan's figure (log_followers=of the plans' flags; 10 on Free and 100 on Paid as the control plane is started unless told otherwise). The one beyond is refused, 429too_many_followers.minimum: 1
- keepsobjectrequired
What the key's project keeps of volumes and Drives (a Drive is counted among its volumes; a database's own Drive is not, and a keyed instance's is in what they hold together and not in their number), by the numbers a create is held to (
POST /v1/volumes,POST /v1/drives: 403volume_limit_reached,drive_limit_reached), with what the project has beside each: the plan's numbers, or an operator's for the account (raised on request:POST /v1/limits/requests,volumesandvolume_bytes). On Free 3, of at most 10 GiB each, 15 GiB together, and 5 GiB where a create gives no size; on a paid plan 500 (a soft limit), of at most 1 TiB each, no total, and a node's own 64 GiB where none is given. - capsobjectrequired
What the account may have at once and what it has of each now: the caps of
CapLimits(thecapsofGET /v1/billing), each withusedbesidelimitandsource(control/README.md, 同时能有多少). - email_verifiedbooleanrequired
Whether
emailis verified: only a verified address is written to. An address the account sets is verified at once where it is the verified one the account has, or the verified address of a user who is a member of the account; otherwise a link that verifies it is mailed to it (verify_account_email, a week), and its notices wait until it is opened (POST /v1/auth/account-email/verify), as an account's with no address do, and so does what is counted from them (the days of a debt). An operator's address is verified by its word; a user's verification verifies the address of the accounts whose notices go to it. False with no address. - languageobjectrequired
The language the account's notices are written in, and what says so (control/README.md, 通知的语言). The acknowledgement of a withdrawal and the confirmation of a purchase are written in it; a notice the language has no words for, in English.
- sourcestringrequired
account: the account chose it (PATCH /v1/accountwithlanguage).billing_address: it chose none, and this is the language most people of its billing address's country read first.default: neither says (no choice, and no billing address, or one whose country's language the notices are not written in): English.
- egress_overagestringrequired
What happens at the allowance, as things stand:
payfor an account on Paid that holds a balance (what is past what its period includes is taken from it),stopfor any other: one on Free, whose traffic stops at the day's quota whatever it holds, and one that holds nothing. - egressobjectrequired
What the account's sandboxes have sent to the internet, over all its projects and all the nodes, against the allowance: the
egressofGET /v1/account, and ofGET /v1/usagewhen it lists sandboxes. The node'sAccountEgresswith the stretch, the calendar month, the project, what is past the allowance comes to, and why traffic is stopped.- regionsobjectrequired
Of the traffic of the stretch, region by region: the region of the node it left from:
naNorth America (and a node with no region),euEurope,apAsia-Pacific. The allowance takes the dearest region's bytes first; each region is priced and rounded on its own, andoverage_usdis theirs added up.}
- debtrequired
What the account owes, the same as the
debtofGET /v1/billing; null for an account that owes nothing.}אחת מהחלופות הבאות:
- Debt
- objectstringrequired
- idstringrequired
- stateowingאוdeletingאוpaidאוdeletedrequired
owing: the account owes, and nothing of it can be used.deleting: its date is past, and what it stores is being deleted. An account is shown a debt of these two only.paid: it was paid, or what it owes came to less than a debt is.deleted: what the account stored was deleted, and what it owed was written off. - in_debt_sincestringrequired
When the account was found to owe as much as a debt is.
format: date-time - owed_usdnumberrequired
What it owes now: what its balance is below zero by. Of a debt that has ended, 0.
- data_deleted_atstring | nullrequired
When what the account stores is deleted if it still owes: the latest date a notice the sender accepted has said. Null while no notice of the debt has been accepted (nothing is deleted then), and while an operator holds the account. Of a debt that ended with the deletion, when that was.
format: date-time - notice_daysintegerrequired
How many days an account that owes is given from its first notice (
--debt-days). - on_holdbooleanrequired
An operator holds the account: nothing of it is deleted, and the count of its days stands still.
- charge_atstring | nullrequired
When what it owes is charged to the account's card next: 00:00 UTC on its first billing day after the debt began, or after it was last charged (a billing day is the day of the month the account's subscription began on, or, without one, the day its first top-up was collected; the last day of a month that has no such day). A time that has come is one to charge at the next look. Null: nothing is to be charged, as the account has no card on record (
Balance.card) or no billing day, an operator holds it, its deletion has begun, or it owes less than a debt is. What is charged is what it owes then, rounded up to the cent, and no more than the account's spend limit leaves in the calendar month (Balance.reload_left_usd): what that leaves owed is charged on the next billing day; where the limit leaves less than a debt is, nothing is charged that month, and the first look of the next month charges it (this time stays the one that has come until then).format: date-time - last_chargerequired
The last charge of what it owes to the account's card, and how it went; null before the first.
}אחת מהחלופות הבאות:
- DebtCharge
- null
- noticesמערך שלobjectrequired
The notices of this debt, the oldest first: the first one, and, once that is accepted, the reminders that are to come; and one of each charge of it that failed (
charge_failed).- idstringrequired
- objectstringrequired
- kindin_debtאוreminder_7אוreminder_14אוreminder_21אוreminder_27אוreminder_29ועוד 8required
in_debt: the first notice of a debt.reminder_<day>: on that day after it (the days are the control plane's,--debt-reminder-days).charge_failed: what it owes was charged to the account's card on its billing day, and the charge failed; one of each such charge.data_deleted: what the account stored has been deleted, and the debt is written off.storage_80,storage_100: before any debt, the storage the account's plan includes is used to four fifths, or used up, and it holds nothing.subscription_charge_failed: the fee of the period of its subscription that was due could not be charged; one of each such charge, the first and each one made again in the days of grace.reload_failed: an auto reload could not be charged; one of each.reload_no_card: auto reload is on and the balance below its line, and the account has no card on record to charge; once a calendar month while it is so.included_80,included_100: what its plan includes of CPU time, memory, requests or traffic is four fifths used, or all, and it holds nothing and auto reload will not top it up; once a meter, a mark and a stretch. - stateto_sendאוacceptedאוfailedאוcancelledrequired
to_send: not handed to the sender yet, or handed over and not answered.accepted: the sender took it to deliver.failed: the sender said that it could not; of a debt's notice another is made after a while.cancelled: it is sent no more (the debt was paid; a later reminder said what it would have). An account is not shown its cancelled ones. - due_atstringrequired
From when it is handed to the sender.
format: date-time - sent_atstring | nullrequired
When it was handed to the sender, of one the sender accepted; null otherwise. Of a debt's first notice: the moment the debt's days are counted from.
format: date-time - subjectstring | nullrequired
Its subject, once it has been handed over.
- null
- payment_holdrequired
That the account is held for its payments, since when, and to write to support; null for one that is not. Nothing of why: that is the operator's (
GET /internal/accounts/{id},payment_hold).}אחת מהחלופות הבאות:
- AccountHoldShown
- objectstringrequired
- sincestringrequiredformat: date-time
- messagestringrequired
That nothing of the account can be used and nothing is charged to it until it is looked at, and to write to support.
- null
- billing_addressrequired
Where the account pays from, which its payments are taxed by; null: it gave none yet, and its payment page asks for it.
}אחת מהחלופות הבאות:
- BillingAddress
- line1string | nullrequired
- line2string | nullrequired
- citystring | nullrequired
- statestring | nullrequired
The state, province or region; of the US its two letters, by which the sales to each state are counted.
- postal_codestring | nullrequired
- countrystringrequired
ISO 3166-1 alpha-2.
pattern: ^[A-Z]{2}$ - sourcestring | nullrequired
Who gave it: the account, an operator (
PATCH /internal/accounts/{id}), the account on a payment page, Stripe (the customer portal, as Stripe'scustomer.updatedsays it). - set_atstring | nullrequiredformat: date-time
- null
- tax_idrequired
A business's tax id, with what its verification came to; null: none.
}אחת מהחלופות הבאות:
- TaxId
- typestringrequired
As Stripe names it:
eu_vat,gb_vat,au_abn, ... - valuestringrequired
- verificationobjectrequired
- statusstringrequired
pending: being verified (the account is a business meanwhile, and a payment taken so is held for an operator if it is then not verified);verified;unverified: its authority does not know it (the account is no business);unavailable: it could not be verified (no business either; its payments are flagged for an operator). - verified_namestring | nullrequired
The name the authority has for it, where it said.
- verified_addressstring | nullrequired
- checked_atstring | nullrequired
When its verification was last heard.
format: date-time
- sourcestringrequired
Who gave it: the account, an operator, the account on a payment page, Stripe (the customer portal).
- set_atstring | nullrequiredformat: date-time
- null
400
invalid_json, unknown_field (of the body, or of billing_address or tax_id: param names which), unknown_parameter; invalid_field: email is not an address, egress_overage_cap_bytes not a whole number of bytes, egress_overage stop from an account that holds a balance, billing_address no address (of the US without its state and ZIP code, of Canada without its province or postal code), tax_id no type and value, or one of the two that Stripe takes not.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
401
missing_api_key, invalid_api_key, expired_api_key, invalid_token.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
402
account_in_debt: the account owes (its balance is below zero), and until it has paid nothing of it can be used: every call of its keys, and of the tokens of its sandboxes, is refused so, but those that read what it owes and pay it; those that list and read the backups of its volumes and make a volume from one (POST /v1/volumes with from_backup, but while what it stores is being deleted), what one that stopped paying wants most; and, unless the control plane is started with --debt-allows-delete false, those that list, read and delete the volumes, snapshots and sandboxes it stores, and delete its backups. Never a new backup. Before the key's scopes are looked at, and whatever the path. The message says how much is owed, since when, when what the account stores is deleted, how to pay, that it can delete what it stores to stop the amount from growing, and that a volume is still made from a backup (GET /v1/billing, debt).
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
403
key_scope, needs_api_key (as everywhere); needs_balance: egress_overage pay from an account on Free or that holds no balance, which takes Paid and a top-up first; account_held: the account is held for its payments, and may read its account and change nothing of it.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
429
rate_limited (retryable): too many links to verify an address of the account's notices for now (3, then one every ten minutes); nothing of the call is done.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
502
stripe_refused: Stripe refused the billing address or the tax id for a reason that is not its form; it is not set (what the call gave before it may be). The message has Stripe's words and the id of its request.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null
503
stripe_unavailable: Stripe could not be reached to set the billing address or the tax id, which is not set (what the call gave before it may be): the same call again does it. retryable.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- servicesמערך שלobjectrequired
The services the import takes, in the model's order.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}אחת מהחלופות הבאות:
- Runtime
- ulimitsמפה שלRuntimeLimitGivenrequired
- sysctlsמפה שלstringrequired
- tmpfsמערך שלobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversמערך שלstringrequired
- searchמערך שלstringrequired
- optionsמערך שלstringrequired
- shm_size_bytesinteger | nullrequired
- null