The account of the key's project, and its traffic to the internet this month

The node's GET /v1/account (sandboxd/openapi/openapi.json) as the control plane answers it: which account and project the key is of, where the account's notices go and in which language, what it owes, whether it is held for its payments (payment_hold: the one call such an account is answered), where it pays from (billing_address, tax_id) and how what it buys is sold there (tax: control/README.md, 税), and its traffic to the internet added up over all its projects and all the nodes, against the allowance of the stretch it is in. An account that owes may read it. Takes read.

GET

https://api.glac.ai/v1/account

認証

apiKeyHTTPrequired

Returns

200

The account.

JSON

objectstringrequired
idstringrequired
pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
logsobjectrequired
The limits its apps' logs are held to.
- line_bytesintegerrequired
  The longest line of output, in bytes: what a line has beyond it is cut off, and the line says how much (cut_bytes). 16384 unless the machines say otherwise.
  
  minimum: 1
- lines_per_secondintegerrequired
  How many lines of one instance's output are kept for any one second: the lines beyond are dropped, and a line of the log says how many (output.dropped). 500.
  
  minimum: 1
- instance_bytesintegerrequired
  What a machine keeps of an instance that is there: at this many bytes of its file the older half goes. 4 MiB.
  
  format: int64 · minimum: 1
- deleted_instance_bytesintegerrequired
  What a machine keeps of an instance that was deleted: the last this many bytes of its file. 1 MiB.
  
  format: int64 · minimum: 0
- deleted_instance_daysnumberrequired
  For how many days that is kept, from when the instance was deleted. 7.
  
  minimum: 0
- app_bytes_per_nodeintegerrequired
  What a machine keeps of one app altogether: beyond it what is left of the instances deleted longest ago goes first. 1 GiB.
  
  format: int64 · minimum: 1
- followersintegerrequired
  How many readers may follow the logs of the account's apps at a time, every project's apps together (follow=true of GET /v1/apps/{app}/logs): its plan's figure (log_followers= of the plans' flags; 10 on Free and 100 on Paid as the control plane is started unless told otherwise). The one beyond is refused, 429 too_many_followers.
  
  minimum: 1
}
keepsobjectrequired
What the key's project keeps of volumes and Drives (a Drive is counted among its volumes; a database's own Drive is not, and a keyed instance's is in what they hold together and not in their number), by the numbers a create is held to (POST /v1/volumes, POST /v1/drives: 403 volume_limit_reached, drive_limit_reached), with what the project has beside each: the plan's numbers, or an operator's for the account (raised on request: POST /v1/limits/requests, volumes and volume_bytes). On Free 3, of at most 10 GiB each, 15 GiB together, and 5 GiB where a create gives no size; on a paid plan 500 (a soft limit), of at most 1 TiB each, no total, and a node's own 64 GiB where none is given.
- volumesobjectrequired
  limitintegerrequired
  How many volumes and Drives the project may have.
  
  minimum: 0
  usedintegerrequired
  How many it has now.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: the plan's, or an operator's for the account.
- volume_bytesobjectrequired
  limitintegerrequired
  How large one may be, in bytes.
  
  format: int64 · minimum: 0
  sourcestringrequired
  Whose number limit is: the plan's, or an operator's for the account.
- volumes_bytesobjectrequired
  limitinteger | nullrequired
  How large all of them may be together, in bytes; null: no limit (Paid, which bills what is stored).
  
  format: int64 · minimum: 0
  usedintegerrequired
  How large the project's are together now.
  
  format: int64 · minimum: 0
- unsized_bytesintegerrequired
  The size a volume or a Drive made with no size_bytes is given: the largest one may be, or where the plan holds them to a total, an even share of it (5 GiB on Free: 15 GiB for 3), or a node's own (64 GiB) where that is less.
  
  format: int64 · minimum: 0
}
capsobjectrequired
What the account may have at once and what it has of each now: the caps of CapLimits (the caps of GET /v1/billing), each with used beside limit and source (control/README.md, 同时能有多少).
- instancesobjectrequired
  Sandboxes and app instances awake at once.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- vcpusobjectrequired
  Their vCPUs together.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- memory_bytesobjectrequired
  Their memory together, in bytes.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- sleepingobjectrequired
  Sandboxes kept that do not run.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- app_instancesobjectrequired
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  The most instances any one version of one of the account's apps has now, awake or asleep, on all its nodes (what the nodes' inventories last showed).
  
  minimum: 0
  defaultintegerrequired
  What an app has when it asks for no scale.max_instances.
  
  minimum: 0
- creates_per_minuteobjectrequired
  Sandboxes made in the last minute.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- creates_per_hour_per_projectobjectrequired
  Sandboxes one project made in the last hour: used is the most of any project of the account.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
- app_creates_per_hourobjectrequired
  Apps and versions of apps made in the last hour.
  
  limitintegerrequired
  What the account may have.
  
  minimum: 0
  sourcestringrequired
  Whose number limit is: its plan's, or one an operator set for the account.
  
  usedintegerrequired
  What it has now, as the last look found it and the calls since have changed it.
  
  minimum: 0
}
namestringrequired
projectobjectrequired
The project the key is of.
- idstringrequired
- namestringrequired
}
emailstring | nullrequired
Where the account's notices are sent: what it owes, what is to be deleted for it. Null: nowhere yet, and they wait until it has an address. Only a verified one is written to (email_verified).
email_verifiedbooleanrequired
Whether email is verified: only a verified address is written to. An address the account sets is verified at once where it is the verified one the account has, or the verified address of a user who is a member of the account; otherwise a link that verifies it is mailed to it (verify_account_email, a week), and its notices wait until it is opened (POST /v1/auth/account-email/verify), as an account's with no address do, and so does what is counted from them (the days of a debt). An operator's address is verified by its word; a user's verification verifies the address of the accounts whose notices go to it. False with no address.
email_undeliverablerequired
Mail to email bounced, or was complained of, as the sender said after it took it: no notice goes to it (they wait, as an account's with no address do), until the account sets an address again (the same one too). Null while mail goes to it.
次のいずれか：
object
null
}
languageobjectrequired
The language the account's notices are written in, and what says so (control/README.md, 通知的语言). The acknowledgement of a withdrawal and the confirmation of a purchase are written in it; a notice the language has no words for, in English.
- codestringrequired
  ISO 639-1: one of the languages the notices are written in.
- sourcestringrequired
  account: the account chose it (PATCH /v1/account with language). billing_address: it chose none, and this is the language most people of its billing address's country read first. default: neither says (no choice, and no billing address, or one whose country's language the notices are not written in): English.
}
egress_overagestringrequired
What happens at the allowance, as things stand: pay for an account on Paid that holds a balance (what is past what its period includes is taken from it), stop for any other: one on Free, whose traffic stops at the day's quota whatever it holds, and one that holds nothing.
egress_overage_cap_bytesinteger | nullrequired
The most bytes the account sends in a calendar month; null: no cap.

format: int64 · minimum: 0
egressobjectrequired
What the account's sandboxes have sent to the internet, over all its projects and all the nodes, against the allowance: the egress of GET /v1/account, and of GET /v1/usage when it lists sandboxes. The node's AccountEgress with the stretch, the calendar month, the project, what is past the allowance comes to, and why traffic is stopped.
- periodstringrequired
  The calendar month it is, in UTC.
  
  pattern: ^[0-9]{4}-[0-9]{2}$
- fromstringrequired
  The stretch the allowance is for: the period of Paid the account is in, or Free's day (UTC).
  
  format: date-time
- tostringrequired
  format: date-time
- bytesintegerrequired
  Sent in the stretch.
  
  format: int64 · minimum: 0
- allowance_bytesinteger | nullrequired
  What the stretch includes; null: whatever is sent is included.
  
  format: int64 · minimum: 0
- overage_bytesinteger | nullrequired
  How far bytes is past the allowance; null without one.
  
  format: int64 · minimum: 0
- overage_usdnumberrequired
  What the bytes past the allowance come to, at the list price: on Paid the account's balance pays it; on Free nothing is priced, and traffic stops at the day's quota.
  
  minimum: 0
- regionsobjectrequired
  Of the traffic of the stretch, region by region: the region of the node it left from: na North America (and a node with no region), eu Europe, ap Asia-Pacific. The allowance takes the dearest region's bytes first; each region is priced and rounded on its own, and overage_usd is theirs added up.
  
  naobjectrequired
  bytesintegerrequired
  Sent from the region's nodes in the stretch.
  
  format: int64 · minimum: 0
  overage_bytesinteger | nullrequired
  What of them is past the allowance; null without one.
  
  format: int64 · minimum: 0
  unit_price_usdnumberrequired
  The region's price of a gigabyte.
  
  overage_usdnumberrequired
  What overage_bytes comes to at that price, to the nearest millionth.
  
  minimum: 0
  euobjectrequired
  bytesintegerrequired
  Sent from the region's nodes in the stretch.
  
  format: int64 · minimum: 0
  overage_bytesinteger | nullrequired
  What of them is past the allowance; null without one.
  
  format: int64 · minimum: 0
  unit_price_usdnumberrequired
  The region's price of a gigabyte.
  
  overage_usdnumberrequired
  What overage_bytes comes to at that price, to the nearest millionth.
  
  minimum: 0
  apobjectrequired
  bytesintegerrequired
  Sent from the region's nodes in the stretch.
  
  format: int64 · minimum: 0
  overage_bytesinteger | nullrequired
  What of them is past the allowance; null without one.
  
  format: int64 · minimum: 0
  unit_price_usdnumberrequired
  The region's price of a gigabyte.
  
  overage_usdnumberrequired
  What overage_bytes comes to at that price, to the nearest millionth.
  
  minimum: 0
- month_bytesintegerrequired
  Sent in the calendar month period: the account's own cap is held against this.
  
  format: int64 · minimum: 0
- stoppedbooleanrequired
  Whether the account's traffic to the internet is stopped now.
- stopped_reasonstring | nullrequired
  allowance_reached: the account has sent its allowance and holds no balance to pay for more; overage_cap_reached: it has sent as much in the calendar month as its own cap. Null when it is not stopped.
- pricesobjectrequired
  egress_gb_usdnumberrequired
  US dollars for a gigabyte (10^9 bytes) past the allowance.
  
  minimum: 0
  egress_eu_gb_usdnumberrequired
  egress_ap_gb_usdnumberrequired
  provisionalbooleanrequired
- project_bytesintegerrequired
  What the project of the calling key sent in the calendar month; the allowance is the account's.
  
  format: int64 · minimum: 0
- countedbooleanrequired
  Whether every node asked is counting traffic.
}
debtrequired
What the account owes, the same as the debt of GET /v1/billing; null for an account that owes nothing.
次のいずれか：
Debt
objectstringrequired
idstringrequired
stateowingまたはdeletingまたはpaidまたはdeletedrequired
owing: the account owes, and nothing of it can be used. deleting: its date is past, and what it stores is being deleted. An account is shown a debt of these two only. paid: it was paid, or what it owes came to less than a debt is. deleted: what the account stored was deleted, and what it owed was written off.

in_debt_sincestringrequired
When the account was found to owe as much as a debt is.

format: date-time
owed_usdnumberrequired
What it owes now: what its balance is below zero by. Of a debt that has ended, 0.

data_deleted_atstring | nullrequired
When what the account stores is deleted if it still owes: the latest date a notice the sender accepted has said. Null while no notice of the debt has been accepted (nothing is deleted then), and while an operator holds the account. Of a debt that ended with the deletion, when that was.

format: date-time
notice_daysintegerrequired
How many days an account that owes is given from its first notice (--debt-days).

on_holdbooleanrequired
An operator holds the account: nothing of it is deleted, and the count of its days stands still.

charge_atstring | nullrequired
When what it owes is charged to the account's card next: 00:00 UTC on its first billing day after the debt began, or after it was last charged (a billing day is the day of the month the account's subscription began on, or, without one, the day its first top-up was collected; the last day of a month that has no such day). A time that has come is one to charge at the next look. Null: nothing is to be charged, as the account has no card on record (Balance.card) or no billing day, an operator holds it, its deletion has begun, or it owes less than a debt is. What is charged is what it owes then, rounded up to the cent, and no more than the account's spend limit leaves in the calendar month (Balance.reload_left_usd): what that leaves owed is charged on the next billing day; where the limit leaves less than a debt is, nothing is charged that month, and the first look of the next month charges it (this time stays the one that has come until then).

format: date-time
last_chargerequired
The last charge of what it owes to the account's card, and how it went; null before the first.

次のいずれか：
DebtCharge
null
notices配列objectrequired
The notices of this debt, the oldest first: the first one, and, once that is accepted, the reminders that are to come; and one of each charge of it that failed (charge_failed).

idstringrequired
objectstringrequired
kindin_debtまたはreminder_7またはreminder_14またはreminder_21またはreminder_27またはreminder_29ほか 8 件required
in_debt: the first notice of a debt. reminder_<day>: on that day after it (the days are the control plane's, --debt-reminder-days). charge_failed: what it owes was charged to the account's card on its billing day, and the charge failed; one of each such charge. data_deleted: what the account stored has been deleted, and the debt is written off. storage_80, storage_100: before any debt, the storage the account's plan includes is used to four fifths, or used up, and it holds nothing. subscription_charge_failed: the fee of the period of its subscription that was due could not be charged; one of each such charge, the first and each one made again in the days of grace. reload_failed: an auto reload could not be charged; one of each. reload_no_card: auto reload is on and the balance below its line, and the account has no card on record to charge; once a calendar month while it is so. included_80, included_100: what its plan includes of CPU time, memory, requests or traffic is four fifths used, or all, and it holds nothing and auto reload will not top it up; once a meter, a mark and a stretch.

stateto_sendまたはacceptedまたはfailedまたはcancelledrequired
to_send: not handed to the sender yet, or handed over and not answered. accepted: the sender took it to deliver. failed: the sender said that it could not; of a debt's notice another is made after a while. cancelled: it is sent no more (the debt was paid; a later reminder said what it would have). An account is not shown its cancelled ones.

due_atstringrequired
From when it is handed to the sender.

format: date-time
sent_atstring | nullrequired
When it was handed to the sender, of one the sender accepted; null otherwise. Of a debt's first notice: the moment the debt's days are counted from.

format: date-time
subjectstring | nullrequired
Its subject, once it has been handed over.

null
}
payment_holdrequired
That the account is held for its payments, since when, and to write to support; null for one that is not. Nothing of why: that is the operator's (GET /internal/accounts/{id}, payment_hold).
次のいずれか：
AccountHoldShown
objectstringrequired
sincestringrequired
format: date-time
messagestringrequired
That nothing of the account can be used and nothing is charged to it until it is looked at, and to write to support.

null
}
billing_addressrequired
Where the account pays from, which its payments are taxed by; null: it gave none yet, and its payment page asks for it.
次のいずれか：
BillingAddress
line1string | nullrequired
line2string | nullrequired
citystring | nullrequired
statestring | nullrequired
The state, province or region; of the US its two letters, by which the sales to each state are counted.

postal_codestring | nullrequired
countrystringrequired
ISO 3166-1 alpha-2.

pattern: ^[A-Z]{2}$
sourcestring | nullrequired
Who gave it: the account, an operator (PATCH /internal/accounts/{id}), the account on a payment page, Stripe (the customer portal, as Stripe's customer.updated says it).

set_atstring | nullrequired
format: date-time
null
}
tax_idrequired
A business's tax id, with what its verification came to; null: none.
次のいずれか：
TaxId
typestringrequired
As Stripe names it: eu_vat, gb_vat, au_abn, ...

valuestringrequired
verificationobjectrequired
statusstringrequired
pending: being verified (the account is a business meanwhile, and a payment taken so is held for an operator if it is then not verified); verified; unverified: its authority does not know it (the account is no business); unavailable: it could not be verified (no business either; its payments are flagged for an operator).

verified_namestring | nullrequired
The name the authority has for it, where it said.

verified_addressstring | nullrequired
checked_atstring | nullrequired
When its verification was last heard.

format: date-time
sourcestringrequired
Who gave it: the account, an operator, the account on a payment page, Stripe (the customer portal).

set_atstring | nullrequired
format: date-time
null
}
taxobjectrequired
How what the account buys is sold where it is: by its billing address, and nothing known without one (its payment page asks for it).
- countrystring | nullrequired
  Its billing address's.
- regionstring | nullrequired
  The region that is so: eu-oss (the EU), a country's two letters in lower case (au, gb), us-<state>.
- sold_asstring | nullrequired
  registered: the platform is registered for tax there, and the tax is added (a business with a verified tax id is reverse charged instead); business_only: it is not, and sells only to businesses there; sold: it is not, and sells to everyone there, with no tax.
- businessbooleanrequired
  Whether the account is a business: its tax id is verified, or being verified.
- can_paybooleanrequired
  Whether it can pay where it is: false only where only businesses are sold to and it is none, when a top-up, a payment page and a paid plan are refused (403 tax_region_business_only) and auto reload makes nothing.
}

400

unknown_parameter.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  次のいずれか：
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptional配列object
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profiles配列stringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- items配列objectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- services配列objectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedまたはchangedまたはunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindserviceまたはjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  items配列objectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  次のいずれか：
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  次のいずれか：
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  次のいずれか：
  string
  array<string>
  envマップstringrequired
  secretsマップstringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumes配列objectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  files配列objectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  次のいずれか：
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regions配列stringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  次のいずれか：
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowまたはdenyまたはnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadataマップstringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_on配列objectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliases配列stringrequired
  endpoint_modestringrequired
  drivesoptional配列object
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptional配列object
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  次のいずれか：
  Runtime
  ulimitsマップRuntimeLimitGivenrequired
  sysctlsマップstringrequired
  tmpfs配列objectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  servers配列stringrequired
  search配列stringrequired
  options配列stringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumes配列objectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makeまたはmadeまたはthereまたはexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_by配列stringrequired
- secrets配列objectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_by配列stringrequired
- left_out配列objectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profiles配列stringrequired
- absent配列stringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptional配列object
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

401

missing_api_key, invalid_api_key, expired_api_key, invalid_token.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  次のいずれか：
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptional配列object
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profiles配列stringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- items配列objectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- services配列objectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedまたはchangedまたはunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindserviceまたはjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  items配列objectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  次のいずれか：
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  次のいずれか：
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  次のいずれか：
  string
  array<string>
  envマップstringrequired
  secretsマップstringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumes配列objectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  files配列objectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  次のいずれか：
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regions配列stringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  次のいずれか：
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowまたはdenyまたはnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadataマップstringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_on配列objectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliases配列stringrequired
  endpoint_modestringrequired
  drivesoptional配列object
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptional配列object
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  次のいずれか：
  Runtime
  ulimitsマップRuntimeLimitGivenrequired
  sysctlsマップstringrequired
  tmpfs配列objectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  servers配列stringrequired
  search配列stringrequired
  options配列stringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumes配列objectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makeまたはmadeまたはthereまたはexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_by配列stringrequired
- secrets配列objectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_by配列stringrequired
- left_out配列objectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profiles配列stringrequired
- absent配列stringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptional配列object
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

403

key_scope, needs_api_key, as everywhere. (An account held for its payments is answered this call, which says so: payment_hold.)

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  次のいずれか：
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptional配列object
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profiles配列stringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- items配列objectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- services配列objectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedまたはchangedまたはunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindserviceまたはjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  items配列objectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneまたはadaptedまたはignoredまたはrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  次のいずれか：
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  次のいずれか：
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  次のいずれか：
  string
  array<string>
  envマップstringrequired
  secretsマップstringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumes配列objectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  files配列objectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  次のいずれか：
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regions配列stringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  次のいずれか：
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowまたはdenyまたはnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadataマップstringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_on配列objectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliases配列stringrequired
  endpoint_modestringrequired
  drivesoptional配列object
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptional配列object
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  次のいずれか：
  Runtime
  ulimitsマップRuntimeLimitGivenrequired
  sysctlsマップstringrequired
  tmpfs配列objectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  servers配列stringrequired
  search配列stringrequired
  options配列stringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumes配列objectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makeまたはmadeまたはthereまたはexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_by配列stringrequired
- secrets配列objectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_by配列stringrequired
- left_out配列objectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profiles配列stringrequired
- absent配列stringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptional配列object
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}