Fork a volume
A new volume whose first version is the snapshot's (from_snapshot), that of the newest version of the volume's window of versions at or before a time (at; history_seconds, slice DB8) or, where neither is given, the volume's as it is now (a version made for the fork as a snapshot's is, and not kept). Nothing is copied: it is mounted at once, on any node of the volume's object store, and its blocks come from the store as its guest reads them; it is made on a node of the region its version is read in, the volume's (a snapshot keeps the region its volume was in, and its size, for when the volume is deleted). It is the volume's size, the project's, and says what it was made of (parent_volume_id, the volume; root_volume_id, the first volume of the line). A snapshot of a volume deleted since is forked by the volume's id. It is billed as any volume is, by what it holds (used_bytes), what the snapshot holds among it: a fork of a 10 GB snapshot is billed as a volume of 10 GB. Held to the plan's volumes as a create is (403 drive_limit_reached), and held back as a create is by a spend limit, or an account that has used up what it includes and holds nothing. Takes write.
https://api.glac.ai/v1/volumes/{id}/forkAutorizzazione
Parametri di percorso
Corpo della richiestaJSONfacoltativo
Returns
201
The new volume.
- used_bytesintegerrequired
What it holds, logically: the 4 KiB blocks written to it and not discarded since (a guest's
fstrim, which its node asks for every minute, gives them back), its file system's own among them. What it is billed by (storage_gb_hours, $0.05 a GB-month); a fork too, by all it holds, what its snapshot holds among it: a fork of a 10 GB snapshot is billed as a volume of 10 GB, whatever it shares with the snapshot and its volume in the object store. As its node said last; while no node holds it, the last the control plane heard.format: int64 · minimum: 0 - homerequired
The region whose object store holds its copy: the region it was made in (
region), until it moves to the region it is mounted in (POST /v1/volumes/{id}/home, or by itself after an hour there). Null where its node copies nothing to an object store. Null of a volume of another kind than a Drive (kind).}Uno dei seguenti:
- string
- null
- home_moveobject | nullrequired
A move of its home to the region it is held in, while one is under way: when it was asked and why (
user:POST /v1/volumes/{id}/home;away: held there for an hour;back: held in its home's region again, taken from another region's store before its home moved there: what it wrote there is copied home, and its home stays), how many of its objects and bytes are copied so far and how many objects are left, and the error it stopped at last, where it stopped (it goes on by itself). Null where none is under way. Null of a volume of another kind than a Drive (kind). - leaserequired
While a sandbox has it read-write; null otherwise. Null of a volume of another kind than a Drive (
kind).}Uno dei seguenti:
- VolumeLease
- node_idstringrequired
- epochintegerrequiredformat: int64 · minimum: 1
- expires_atstring | nullrequired
Null: the control plane has granted the node no lease since it started.
format: date-time
- null
- cache_bytesinteger | nullrequired
Its cache on its node's NVMe: the most of it the node keeps there, its size where that is all of it (the default); the rest is in the object store alone, and a read of it fetches it (the guest waits for the store) and keeps it, while what was used least long ago goes once the store holds it (never what it does not hold yet, which may take a volume past its cache for as long as the store takes to have it). Under 64 MiB it is held at 64 MiB, what a guest's read brings with its read-ahead. Billed by the hour as the volume's NVMe cache, up to what it holds (
cache_gb_hoursofGET /v1/usage), beside what it holds (used_bytes,storage_gb_hours): all of it cached costs both, none costs the second alone. A database's caches a quarter of it, 1 GiB at the least. A fork has the cache of the volume it was made of. Null of a volume of another kind than a Drive (kind).format: int64 · minimum: 0 - history_secondsinteger | nullrequired
How far back the volume can be restored, or forked, by a time (its window of versions, slice DB8: reports/storage/drives.md 4.7): 3600 to 86400 seconds (an hour to a day). Every window (30 seconds) a volume that was written gets a version that is the volume at one moment (its machine paused for the last of it, two seconds at the most), kept for this long; what they keep that the volume no longer needs is billed as a snapshot's is (
history.exclusive_bytes, on the meter of storage underdhist-<the volume's id without vol->). Null (or 0): none, the default; set to null, what it kept goes. Null of a volume of another kind than a Drive (kind).format: int64 · maximum: 86400 · minimum: 3600 - historyobject | nullrequired
Its window of versions while it has one (
history_seconds); null otherwise. Null of a volume of another kind than a Drive (kind).- exclusive_bytesintegerrequired
What its versions keep alone: the data they read from objects that the volume's newest version, its snapshots and every other volume need not, as the object store's collector last worked it out. What the window is billed for, as a snapshot is.
format: int64 · minimum: 0
- kindstringrequired
drive: a volume as this section says it, a disk one sandbox has at a time, copied into the object store (every volume made for a project's key but a shared one).shared: a file system a node keeps, any number of sandboxes have at once (POST /v1/volumeswithshared: true), which is none of the rest: no lease, no home, no snapshots, forks or versions, no cache of its own.plain: one the operator made (a file system on one node, never copied). - durabilityoptionalstring | null
How it is kept, decided when it is made (
DriveCreate.durability).standard: a guest's fsync returns at once (the write is on its node), and a host that is lost loses at most the last second of writes.strict: a guest's fsync, and every flush of its file system, returns once the object store holds every write before it: nothing a guest synced is lost with its host, and each fsync waits for a request to the store (tens of milliseconds). Null of a volume of another kind than a Drive (kind).
400
invalid_json, unknown_field, unknown_parameter; invalid_field: name or from_snapshot is no text, at no time, or from_snapshot and at are both given; invalid_name: name is no name; invalid_history (param at): the volume keeps no window of versions, or at is before it, before its first version, or after now (the message says the window).
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
401
missing_api_key, invalid_api_key, expired_api_key, invalid_token.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
402
account_in_debt: the account owes (its balance is below zero), and until it has paid nothing of it can be used: every call of its keys, and of the tokens of its sandboxes, is refused so, but those that read what it owes and pay it; those that list and read the backups of its volumes and make a volume from one (POST /v1/volumes with from_backup, but while what it stores is being deleted), what one that stopped paying wants most; and, unless the control plane is started with --debt-allows-delete false, those that list, read and delete the volumes, snapshots and sandboxes it stores, and delete its backups. Never a new backup. Before the key's scopes are looked at, and whatever the path. The message says how much is owed, since when, when what the account stores is deleted, how to pay, that it can delete what it stores to stop the amount from growing, and that a volume is still made from a backup (GET /v1/billing, debt).
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
403
key_scope, needs_api_key, account_held (as everywhere); volume_limit_reached: one more volume than the account's plan lets a project keep, or more than they may hold together, as for a create (param size_bytes of the second); spend_limit_reached, balance_used_up: the project is held back, as for a sandbox; account_share_reached: the account holds its share of the data drive of the node the fork is made on (a fork goes to a node where it has room for a gigabyte to write, where one has it), in the node's words.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
404
volume_not_found: no volume of this id or name (a volume deleted since is forked from one of its snapshots alone); snapshot_not_found (param from_snapshot): the volume has no snapshot of that id.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
409
name_taken: the project has a volume of the name; not_copied: the volume's node copies nothing to an object store, where a fork is made of a version of it.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
502
node_refused: a node refused in words the control plane has none of its own for (the message has the node's).
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null
503
node_unavailable: the volume's node, or the one chosen for the fork, cannot be reached, or does not hold the project's keys yet; drive_in_store: no node holds the volume at this moment (it is going to another); unavailable: no node that keeps volumes and copies to the object store can be called now, the volume's node could not make its version now, or the fork is made and not listed yet; drive_unreadable: the object store does not give every object of the version (one is not there): nothing was made. Ask again in a moment.
- moveoptionalobject
With
move_over,move_going_backandmove_taken_over(POST /internal/moves/{id}/cancel): the move, as it stands.- stepstringrequired
Where it stands:
releasing(the old node is asked to release it; the table has it there),taking_over(the new node is asked to take it over; the table has it there),reclaiming(the new node refused it, and the old one is asked to take it back),restoring(the old one kept nothing of it, and takes it over from the object store),done(on the new node),failed(where it was, or back there, or where a failure no time clears or an operator's cancel found it:errorsays why).
- reportoptionalobject
With
compose_refused: the import's report, which says what is refused, why, and what to change.- itemsarray diobjectrequired
The model's top-level elements:
name, each volume, network, config and secret, extensions.- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- servicesarray diobjectrequired
The services the import takes, in the model's order.
- itemsarray diobjectrequired
- treatmentdoneoppureadaptedoppureignoredoppurerefusedrequired
done: it means the same on the platform;adapted: the platform does the same another way;ignored: it matters to a local run alone (refused withstrict);refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
- appobjectrequired
The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
- sizeobjectrequired
What one instance may use at most. It is billed by what it uses.
- memory_bytesintegerrequired
An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400
invalid_field(paramsize.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node'sSandboxLimitsCreate.memory_bytes).minimum: 134217728
- scaleobjectrequired
- min_instancesintegerrequired
How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share
max_instances(two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At mostmax_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403plan_cap_reached.minimum: 0 - max_instancesinteger | nullrequired
How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (
caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number.null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), ormin_instanceswhere that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.minimum: 1 - concurrencyinteger | nullrequired
A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more.
null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.maximum: 1000 · minimum: 1 - sleep_after_msinteger | nullrequired
The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (
0: stops at once, always).null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node afterdelete_after_ms, and the next request that needs an instance gets a new one; the instancesmin_instanceskeeps awake are neither stopped nor deleted.maximum: 600000 · minimum: 0 - sleep_notice_msinteger | nullrequired
How long before an instance stops for being idle the programs connected to its guest's
/run/sbx/awakeare sent the linesleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).maximum: 60000 · minimum: 0 - sleep_hold_max_msintegerrequired
How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to
/run/sbx/awakeand sends+before it answers a request whose work goes on after the answer, and-(or closes the connection, or dies) when that work is done; the instance stopssleep_after_msafter the last hold is lowered. Past this time it stops whatever holds it, the programs connected toldsleep N capfirst wheresleep_notice_msasks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).maximum: 900000 · minimum: 0 - delete_after_msinteger | nullrequired
After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400
invalid_field), and an instance that is to stay warm is one ofmin_instances.null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, whichkeys.delete_after_idle_msis for.maximum: 3600000 · minimum: 1000 - suspend_after_msoptionalinteger | null
How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's
suspend_after_secondsis its app's.maximum: 86400000 · minimum: 1000 - wake_daily_atoptionalstring | null
A time of day in UTC,
HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server'spg_cronjobs, whatever this says. Null (the default): none. A database'swake_daily_atis its app's.pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
- egressobject | nullrequired
Egress rules as a sandbox has them (
default,allow,deny,http,inject), null when there are none; kept as the calls gave them (aPATCHmerges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).- deny_portsoptionalarray | null
Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
- runtimeoptional
Its runtime settings (
AppCreate.runtime).null: none.}Uno dei seguenti:
- Runtime
- ulimitsmappa diRuntimeLimitGivenrequired
- sysctlsmappa distringrequired
- tmpfsarray diobjectrequired
- pathstringrequired
- size_bytesinteger | nullrequired
- modeintegerrequired
- dnsobjectrequired
- serversarray distringrequired
- searcharray distringrequired
- optionsarray distringrequired
- shm_size_bytesinteger | nullrequired
- null