Make a Browsers session, or have the one of its name

A session is a sandbox of the node's browser image for its kind (the image --browser-images names, by digest in production), fixed at 1 vCPU and 2 GiB, made where region says as any sandbox is, and marked as a Browsers session in the control plane's own table: never by metadata, which no customer can set to make a plain sandbox one (reserved_metadata). Its id is its sandbox's: every call of /v1/sandboxes/{id}/… works on it, and DELETE /v1/sandboxes/{id} ends it. cdp_url is the signed address of its port 9222, which any CDP client (Playwright's connectOverCDP, Puppeteer's connect) takes. It is awake while a client is connected to its browser (or a headful one's screen), whatever its pages do, and falls asleep sleep_after_seconds after the last connection closed, with its pages; a connection that says nothing for connection_idle_seconds is closed by its node (its sandbox's awake_ports and connection_idle_seconds). Its egress never reaches ports 25, 465, 587 and the ports mining pools listen on (its rules' deny_ports, kept through any change of them). A name the project has for a session already answers that session, woken where it slept (200); one a plain sandbox has is refused (409 name_taken). On Free a session is held to Free's quotas of the day, of CPU time and memory, as any sandbox is (429 quota_used_up). How many are awake at once is held by the plan's caps on what is awake (5 on Free: 5 sandboxes, 10 GiB). A session made on a node that keeps no ready template of its image, which builds one for it (the first session of the image there), is answered once the build is over and its browser runs, with its ws_url: it can take as long as the build. Takes an Idempotency-Key. Takes write. With profile, the profile's version (the newest, or version) is loaded into the session before it is answered: the browser is started again on it, logged in where it was (a session made with save: true saves it when it is deleted). kind lightpanda is a session of Lightpanda (the image browser-lightpanda), a browser that runs a page's scripts and keeps its DOM and lays out and draws nothing: made, priced and held to the rules as the others are, with its cdp_url and ws_url; it has no live_url and keeps no profile (kind_unsupported); it has no layout engine, so its screenshots and PDFs over CDP hold the page's text alone (chromium-headless gives the page as it is drawn), and a screencast, which it has nothing for, is refused with an error that names chromium-headless.

POST

https://api.glac.ai/v1/browsers

Autoryzacja

apiKeyHTTPrequired

Parametry nagłówka

Idempotency-Keyoptionalstring
1 to 255 characters: the same key and body again gets the same answer, and nothing is made twice.

maxLength: 255 · minLength: 1

Treść żądaniaJSONopcjonalne

kindoptionalchromium-headlesslubchromiumlublightpandalubnull
chromium-headless (the default), chromium or lightpanda.
nameoptionalstring | null
Its sandbox's name: the project's for one sandbox at a time. A create with a name the project's session has answers that session.
regionoptionalstring | null
na, eu or ap; the control plane's own where none is given.
profileoptionalobject | null
A profile to load: its newest version, or version, put in place of the browser's own before the session is answered. save: true: the session saves it when it is deleted (and a profile that has no version yet is made by that save).
- namestringrequired
  pattern: ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
- saveoptionalboolean | null
  False when not given.
- versionoptionalstring | null
  One of its versions; the newest when not given.
}
proxyoptionalobject | null
Your own proxy (BR11), on a paid plan: {"url": ...}; null or not given: none. The session's TCP connections to ports 80 and 443 go out through it, by its node's relay: in the layer its egress rules are enforced in, which reads where each goes (the TLS handshake's server name, the HTTP request's Host) and asks the proxy for a tunnel there (CONNECT, the credentials in Basic). The browser is not told of it, and nothing in the guest holds the credentials; they are the node's to keep, and no answer has them. UDP to port 443 (QUIC) is refused, so the browser speaks HTTP over TCP; connections to other ports go as they went. What goes through it is counted both ways (usage.proxy_bytes) and is ordinary egress. A connection the proxy takes no tunnel for is told so: an HTTP request 502 proxy_failed, a TLS handshake an alert. 403 proxy_not_on_plan on the free plan; 400 invalid_proxy for what is no proxy of yours (param proxy.url; the message never says the URL); 400 unknown_field for a field of it other than url.
- urloptionalstring
  http://user:password@host:port (the port 80 where it names none; a user name and a password written %XX where they hold what a URL does not take, as @ or :): an HTTP proxy that takes CONNECT, at a host name or an address on the internet. Only http://: a proxy reached over TLS, and SOCKS, are not served.
  
  maxLength: 2048
}
sleep_after_secondsoptionalinteger | null
How long it is asleep after its last connection closed (or its last request): 10 when not given.

maximum: 3600 · minimum: 1
connection_idle_secondsoptionalinteger | null
How long a connection to its browser (or its screen) may say nothing either way before its node closes it: 600 when not given (null in a change: back to 600).

maximum: 86400 · minimum: 60
delete_after_idle_secondsoptionalinteger | null
How long it sleeps before it is deleted; null or not given: never for that.

maximum: 31622400 · minimum: 60
metadataoptionalobject | null
Free key-value pairs for the caller's own use; not product, which is the platform's.

Returns

200

The session of the name, which the project had: woken where it slept.

JSON

objectstringrequired
idstringrequired
Its sandbox's id.

pattern: ^sbx-[0-9a-hjkmnp-tv-z]{16}$
namestring | nullrequired
kindchromium-headlesslubchromiumlublightpandarequired
chromium-headless: Chromium's headless shell; chromium: the full browser on a screen, watched at live_url; lightpanda: Lightpanda, which runs a page's scripts and keeps its DOM and has no layout engine (its screenshots and PDFs hold the page's text alone; no live_url, no profile).
statusawakelubasleeplubunavailablelubfailedrequired
awake while its sandbox runs, asleep while it sleeps (or is held asleep), unavailable where its node cannot be reached, failed where its sandbox failed after its create was answered (its browser stopped and did not come back, say): error says why. One that fails before it runs is no session: its create is refused (503 session_failed).
errorobject | nullrequired
Why it failed, as its node says it (its sandbox's failure_code and failure); null unless status is failed.
- codestringrequired
- messagestringrequired
}
regionnalubeulubaplubnullrequired
The region of the node that holds it; null where that node is in none.
cdp_urlstring | nullrequired
Where CDP clients connect: the signed address of its port 9222 (https://9222-<id>-<signature>.<preview domain>), the credential in its host name. Null for a key without the url scope, or where its node has no preview domain.
ws_urlstring | nullrequired
The browser's own WebSocket address (wss://9222-<id>-<signature>.<preview domain>/devtools/browser/<browser id>), for the clients that take nothing else (Puppeteer's browserWSEndpoint, chromedp's remote allocator): the path of the browser its node recorded when the session's template was built (the sandbox's devtools) at cdp_url, whose credential it carries. Null where cdp_url is, or where the node recorded no browser. cdp_url serves every CDP client that asks /json/version.
live_urlstring | nullrequired
Where its page is watched and driven, live, at a signed address (rotated with cdp_url): a headless session's /live on its CDP port (the image's page drawing the tab's screencast, the viewer's mouse and keyboard passed on), a headful one's screen (noVNC on port 6080). The read-only address is GET /v1/browsers/{id}/live?interactive=false. Null without the url scope, or where its node has no preview domain, and always for a lightpanda session, which has nothing to stream.
profileobject | nullrequired
The profile it was made with, or saved last: null for none.
- namestringrequired
- savebooleanrequired
  Whether it saves the profile when it is deleted.
- versionstring | nullrequired
  The version it holds: the one it loaded, or saved last; null for a profile it has not saved yet.
}
proxyrequired
Its own proxy (BR11), as its node shows it: its address and the user name it is asked with, never its password. Null for none.
Jeden z poniższych:
object
null
}
connectionsinteger | nullrequired
The connections to its browser (its live page's among them), to a headful one's screen and to the read-only view, open now through its preview addresses: it is awake while there is one (its sandbox's awake_connections). Null from a node that does not count them.

minimum: 0
sleep_after_secondsinteger | nullrequired
How long after its last connection closed (and its last request) it falls asleep.

maximum: 3600 · minimum: 0
connection_idle_secondsinteger | nullrequired
How long a connection to it may say nothing either way before its node closes it; null from a node that does not close them.

minimum: 1
delete_after_idle_secondsinteger | nullrequired
How long it sleeps before it is deleted; null: it is never deleted for that.

minimum: 1
metadatamapastringrequired
Its sandbox's metadata: the caller's own. Never what it is sold as, which is the control plane's record.
created_atstringrequired
format: date-time
usageobjectrequired
- awake_secondsnumberrequired
  How long it has been awake since it was made, in seconds to the millisecond: what the books have of it on the meter of the sessions, as its node counts it, which is what it is billed by.
  
  minimum: 0
- proxy_bytesintegerrequired
  What went through its own proxy since it was made, both ways: proxy_sent_bytes and proxy_received_bytes together, as its node's relay counted them, byte by byte. Ordinary egress: what left the node for the proxy is among its sandbox's egress_bytes.
  
  minimum: 0
- proxy_sent_bytesintegerrequired
  Of it, what the session sent through its proxy's tunnels.
  
  minimum: 0
- proxy_received_bytesintegerrequired
  Of it, what came back to the session through them.
  
  minimum: 0
}

201

The session, made.

JSON

objectstringrequired
idstringrequired
Its sandbox's id.

pattern: ^sbx-[0-9a-hjkmnp-tv-z]{16}$
namestring | nullrequired
kindchromium-headlesslubchromiumlublightpandarequired
chromium-headless: Chromium's headless shell; chromium: the full browser on a screen, watched at live_url; lightpanda: Lightpanda, which runs a page's scripts and keeps its DOM and has no layout engine (its screenshots and PDFs hold the page's text alone; no live_url, no profile).
statusawakelubasleeplubunavailablelubfailedrequired
awake while its sandbox runs, asleep while it sleeps (or is held asleep), unavailable where its node cannot be reached, failed where its sandbox failed after its create was answered (its browser stopped and did not come back, say): error says why. One that fails before it runs is no session: its create is refused (503 session_failed).
errorobject | nullrequired
Why it failed, as its node says it (its sandbox's failure_code and failure); null unless status is failed.
- codestringrequired
- messagestringrequired
}
regionnalubeulubaplubnullrequired
The region of the node that holds it; null where that node is in none.
cdp_urlstring | nullrequired
Where CDP clients connect: the signed address of its port 9222 (https://9222-<id>-<signature>.<preview domain>), the credential in its host name. Null for a key without the url scope, or where its node has no preview domain.
ws_urlstring | nullrequired
The browser's own WebSocket address (wss://9222-<id>-<signature>.<preview domain>/devtools/browser/<browser id>), for the clients that take nothing else (Puppeteer's browserWSEndpoint, chromedp's remote allocator): the path of the browser its node recorded when the session's template was built (the sandbox's devtools) at cdp_url, whose credential it carries. Null where cdp_url is, or where the node recorded no browser. cdp_url serves every CDP client that asks /json/version.
live_urlstring | nullrequired
Where its page is watched and driven, live, at a signed address (rotated with cdp_url): a headless session's /live on its CDP port (the image's page drawing the tab's screencast, the viewer's mouse and keyboard passed on), a headful one's screen (noVNC on port 6080). The read-only address is GET /v1/browsers/{id}/live?interactive=false. Null without the url scope, or where its node has no preview domain, and always for a lightpanda session, which has nothing to stream.
profileobject | nullrequired
The profile it was made with, or saved last: null for none.
- namestringrequired
- savebooleanrequired
  Whether it saves the profile when it is deleted.
- versionstring | nullrequired
  The version it holds: the one it loaded, or saved last; null for a profile it has not saved yet.
}
proxyrequired
Its own proxy (BR11), as its node shows it: its address and the user name it is asked with, never its password. Null for none.
Jeden z poniższych:
object
null
}
connectionsinteger | nullrequired
The connections to its browser (its live page's among them), to a headful one's screen and to the read-only view, open now through its preview addresses: it is awake while there is one (its sandbox's awake_connections). Null from a node that does not count them.

minimum: 0
sleep_after_secondsinteger | nullrequired
How long after its last connection closed (and its last request) it falls asleep.

maximum: 3600 · minimum: 0
connection_idle_secondsinteger | nullrequired
How long a connection to it may say nothing either way before its node closes it; null from a node that does not close them.

minimum: 1
delete_after_idle_secondsinteger | nullrequired
How long it sleeps before it is deleted; null: it is never deleted for that.

minimum: 1
metadatamapastringrequired
Its sandbox's metadata: the caller's own. Never what it is sold as, which is the control plane's record.
created_atstringrequired
format: date-time
usageobjectrequired
- awake_secondsnumberrequired
  How long it has been awake since it was made, in seconds to the millisecond: what the books have of it on the meter of the sessions, as its node counts it, which is what it is billed by.
  
  minimum: 0
- proxy_bytesintegerrequired
  What went through its own proxy since it was made, both ways: proxy_sent_bytes and proxy_received_bytes together, as its node's relay counted them, byte by byte. Ordinary egress: what left the node for the proxy is among its sandbox's egress_bytes.
  
  minimum: 0
- proxy_sent_bytesintegerrequired
  Of it, what the session sent through its proxy's tunnels.
  
  minimum: 0
- proxy_received_bytesintegerrequired
  Of it, what came back to the session through them.
  
  minimum: 0
}

400

invalid_json, unknown_field, unknown_parameter; invalid_field: sleep_after_seconds from 1 to 3600, connection_idle_seconds from 60 to 86400, delete_after_idle_seconds from 60 to a year (or null), metadata an object of strings; invalid_name: name is no name; unknown_kind: kind is not chromium-headless, chromium or lightpanda; kind_unsupported: a profile asked of a lightpanda session, which keeps none (param profile); unknown_region; reserved_metadata: metadata names the key product, which is the platform's; invalid_proxy: proxy is no proxy of yours (proxy.url is no http:// URL of an HTTP proxy, or names an address no sandbox reaches: param proxy.url, and the message never says the URL); invalid_idempotency_key; invalid_field, unknown_field of profile (param profile.name, profile.save, profile.version: a name of 1 to 63 lower-case letters, digits and hyphens); objects_not_served: a profile is named, and this control plane has no object gateway, where profiles are kept; invalid_name also for the name profiles, which is the profiles' list.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

401

missing_api_key, invalid_api_key, expired_api_key, invalid_token.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

402

account_in_debt: the account owes (its balance is below zero), and until it has paid nothing of it can be used: every call of its keys, and of the tokens of its sandboxes, is refused so, but those that read what it owes and pay it; those that list and read the backups of its volumes and make a volume from one (POST /v1/volumes with from_backup, but while what it stores is being deleted), what one that stopped paying wants most; and, unless the control plane is started with --debt-allows-delete false, those that list, read and delete the volumes, snapshots and sandboxes it stores, and delete its backups. Never a new backup. Before the key's scopes are looked at, and whatever the path. The message says how much is owed, since when, when what the account stores is deleted, how to pay, that it can delete what it stores to stop the amount from growing, and that a volume is still made from a backup (GET /v1/billing, debt).

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

403

key_scope, needs_api_key, account_held (as everywhere); proxy_not_on_plan: a proxy asked for on the free plan, which has none; plan_cap_reached: one more awake would pass what the plan lets the account have awake at once (instances, vcpus, memory_bytes), or made in a minute or an hour; spend_limit_reached, balance_used_up: the project is held back, as for a sandbox. product_not_open: Browsers is not open on this platform yet (--products): nothing new of it is made.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

404

profile_not_found: the profile named has no version saved and the session does not save it (save: true makes the profile with the session's first save), or it has no version of that name (param profile.name, profile.version); also where its archive could not be read where it is kept, and the session made for it was deleted.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

409

name_taken: a plain sandbox of the project has the name (no sandbox becomes a session), or a session of another kind; idempotency_key_reused, idempotency_in_progress.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

503

not_served_here: this control plane was given no image for the kind (param kind); no_capacity: no node has room for it now; node_unavailable, unavailable: the node chosen for it could not be reached, or did not answer in time; creation_cancelled: the session could not be marked as one, and its sandbox was deleted. session_failed: its sandbox failed before it ran (its image could not be had, its browser did not come up), and was deleted; message has its node's code and words, and no session is left of it. profile_transfer_failed: the profile could not be loaded into the session (the object store was not reached from it, or its browser did not come back), and the session made for it was deleted: the same call again makes another. retryable.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  Jeden z poniższych:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionaltablicaobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilestablicastringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemstablicaobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicestablicaobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedlubchangedlubunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindservicelubjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemstablicaobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdonelubadaptedlubignoredlubrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  Jeden z poniższych:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  Jeden z poniższych:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  Jeden z poniższych:
  string
  array<string>
  envmapastringrequired
  secretsmapastringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumestablicaobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filestablicaobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  Jeden z poniższych:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionstablicastringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msinteger | nullrequired
  The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  Jeden z poniższych:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowlubdenylubnull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamapastringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_ontablicaobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasestablicastringrequired
  endpoint_modestringrequired
  drivesoptionaltablicaobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionaltablicaobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  Jeden z poniższych:
  Runtime
  ulimitsmapaRuntimeLimitGivenrequired
  sysctlsmapastringrequired
  tmpfstablicaobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serverstablicastringrequired
  searchtablicastringrequired
  optionstablicastringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumestablicaobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makelubmadelubtherelubexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_bytablicastringrequired
- secretstablicaobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_bytablicastringrequired
- left_outtablicaobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilestablicastringrequired
- absenttablicastringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionaltablicaobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}