Skip to content
Nawigacja

What the sandboxes, volumes and snapshots of the key's project used and kept

The node's GET /v1/usage (sandboxd/openapi/openapi.json) as the control plane answers it. Given none of from, to, group_by, metadata.<key>, kind, volume_id and snapshot_id, it is the node's list of sandboxes (UsageList), asked of every node and put together. Given any of them, it is a report (UsageReport) from the books the control plane keeps by the hour, a --usage-seconds behind the nodes at most and there while a node is away: prices are the nine prices, every group and totals have the quantities only its books hold (requests, state_gb_hours, storage_gb_hours, log_bytes, log_gb_hours, egress_eu_bytes, egress_ap_bytes, drive_write_bytes, drive_cold_read_bytes, browser_awake_seconds and cache_gb_hours), and bucket_seconds is 3600. A report by sandbox has one more group, of what no one sandbox used (sandbox_id null): what volumes and snapshots kept and what was written to volumes and read of them cold, the requests apps took and what they printed, what the export of the apps' logs sent (kind log_export), what the backups of volumes kept in the object store (kind backup, in state_gb_hours), and what Browsers' profiles keep (kind browser_profiles, in storage_gb_hours). An account that owes may read it. Takes read.

GET
https://api.glac.ai/v1/usage

Autoryzacja

  • apiKeyHTTPrequired

Parametry zapytania

  • fromoptionalstring

    From this time on (RFC 3339): an hour is in the report when it begins at or after it.

    format: date-time
  • tooptionalstring

    Up to this time: an hour is in the report when it begins before it.

    format: date-time
  • group_byoptionalstring

    What the groups are of, separated by commas: sandbox, hour or day, metadata.<key>, and here kind, volume (or drive: a Drive is a volume, and the groups say drive_id), snapshot and backup (each backup of a volume a group of its own, backup_id). Without it a report is by sandbox, by volume when it asks of a volume, by snapshot when it asks of a snapshot, by backup when it asks of a backup (backup_id). Or database (each database of the project a group: what the instances and the Drives of its branches used, its history among them; database_id) or branch (each branch of a database a group, database_id and branch_id), with hour or day or alone, and nothing else (slice DB7): what no database's thing used is the group whose database_id is null.

  • <key>optionalstring

    What was used under metadata with this value under this key, at the time it was used.

  • sandbox_idoptionalstring

    What one sandbox used: its id or its name (a deleted one by its id).

  • kindoptionalsandboxlubvolumelubdrivelubsnapshotlublog_exportlubbackup+1 więcej

    What one kind of thing used or kept: sandbox, volume (what volumes kept, and what was written to them and read of them cold), drive (the same, said of Drives: a Drive is a volume) or snapshot; log_export, what the nodes sent the destinations of the logs' export (/v1/destinations), which is booked under each destination (dst-...) and the app; or backup, what the backups of volumes kept in the object store (/v1/backups), which is booked under each backup (bak-...) on the meter of state (state_gb_hours): its stored_bytes from its ready_at to its delete, or its expiry where that came first, each hour to the hour it was kept in, up to the moment, the hour that has begun among it (booked every minute; one that is deleted, to its delete); or browser_profiles, what the Browsers' profiles of the project keep in the platform's store, which is booked under the bucket that holds them (bkt-...) as volume data (storage_gb_hours), each hour as the store says it. Another word is 400 invalid_field. The control plane's: a node that stands alone refuses it, as it does volume_id and snapshot_id.

  • volume_idoptionalstring

    What one volume kept: its id or its name (a deleted one by its id). One of sandbox_id, volume_id, drive_id, snapshot_id and backup_id at a time.

  • drive_idoptionalstring

    What one Drive kept, was written and read cold: its id or its name (a deleted one by its id). A Drive is a volume: the same as volume_id, and the groups say drive_id. One of sandbox_id, volume_id, drive_id and snapshot_id at a time.

  • snapshot_idoptionalstring

    What one snapshot kept: its id or its name (a deleted one by its id); a snapshot of a Drive by its id (dsnap-…, slice D7): what it kept alone, on the meter of storage.

  • backup_idoptionalstring

    What one backup of a volume kept in the object store (/v1/backups): its id (bak-…), whatever became of its volume, on the meter of state (state_gb_hours). One of sandbox_id, volume_id, drive_id, snapshot_id and backup_id at a time; grouped by backup unless group_by says otherwise. The control plane's: a node that stands alone refuses it.

  • limitoptionalinteger

    How many rows or groups a page holds: 1 to 1000, 100 unless given.

    maximum: 1000 · minimum: 1
  • cursoroptionalstring

    The page after the one whose next_cursor this is.

Returns

200

The node's UsageList, or its UsageReport with the control plane's quantities in it (sandboxd/openapi/openapi.json).

JSON

Jeden z poniższych:

  • UsageList
    • datatablicaobjectrequired
      • sandbox_idstringrequired
        pattern: ^sbx-[0-9a-hjkmnp-tv-z]{16}$
      • namestring | nullrequired

        The sandbox's name; for a deleted one, the name it had last.

      • metadatamapastringrequired

        Free key-value pairs for the caller's own use; lists of sandboxes filter by them. At most 64 keys of 1 to 64 characters, values of up to 1024. Not a place for secrets: metadata are stored in clear, and every set of them a sandbox has had while it used something is kept with its usage for thirteen months, also after the sandbox is deleted (GET /v1/usage groups and filters by them).

      • cpu_secondsnumberrequired
        minimum: 0
      • memory_gib_secondsnumberrequired

        Memory in 128 MiB steps, integrated over time: GiB times seconds.

        minimum: 0
      • disk_bytesintegerrequired

        What the root disk takes now; 0 for a deleted sandbox.

        format: int64 · minimum: 0
      • egress_bytesintegerrequired

        Bytes it has sent to the internet. For a deleted sandbox, less its last second, which is only in the account's month.

        format: int64 · minimum: 0
      • created_atstringrequired
        format: date-time
      • deleted_atstring | nullrequired

        Null for a sandbox that exists.

        format: date-time
      • productoptionalbrowserslubdatabaseslubnull

        What the sandbox is sold as, by the control plane's own record (never its metadata): browsers for a Browsers session (POST /v1/browsers), databases for an instance of a database's branch (POST /v1/databases), null for any other sandbox.

    • next_cursorstring | nullrequired

      Pass it as cursor to get the next page. Null on the last page.

    • totalsobjectrequired

      Sums over every row the filter selects, not over this page.

      • cpu_secondsnumberrequired
        minimum: 0
      • memory_gib_secondsnumberrequired
        minimum: 0
      • egress_bytesintegerrequired
        format: int64 · minimum: 0
      • sandboxesintegerrequired
        minimum: 0
    • egressobjectrequired

      The account's month: what the allowance is measured against, whichever sandboxes sent it.

      • periodstringrequired

        The calendar month it is, in UTC.

        pattern: ^[0-9]{4}-[0-9]{2}$
      • fromstringrequired

        The stretch the allowance is for: the period of Paid the account is in, or Free's day (UTC).

        format: date-time
      • tostringrequired
        format: date-time
      • bytesintegerrequired

        Sent in the stretch.

        format: int64 · minimum: 0
      • allowance_bytesinteger | nullrequired

        What the stretch includes; null: whatever is sent is included.

        format: int64 · minimum: 0
      • overage_bytesinteger | nullrequired

        How far bytes is past the allowance; null without one.

        format: int64 · minimum: 0
      • overage_usdnumberrequired

        What the bytes past the allowance come to, at the list price: on Paid the account's balance pays it; on Free nothing is priced, and traffic stops at the day's quota.

        minimum: 0
      • regionsobjectrequired

        Of the traffic of the stretch, region by region: the region of the node it left from: na North America (and a node with no region), eu Europe, ap Asia-Pacific. The allowance takes the dearest region's bytes first; each region is priced and rounded on its own, and overage_usd is theirs added up.

        • naobjectrequired
          • bytesintegerrequired

            Sent from the region's nodes in the stretch.

            format: int64 · minimum: 0
          • overage_bytesinteger | nullrequired

            What of them is past the allowance; null without one.

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte.

          • overage_usdnumberrequired

            What overage_bytes comes to at that price, to the nearest millionth.

            minimum: 0
        • euobjectrequired
          • bytesintegerrequired

            Sent from the region's nodes in the stretch.

            format: int64 · minimum: 0
          • overage_bytesinteger | nullrequired

            What of them is past the allowance; null without one.

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte.

          • overage_usdnumberrequired

            What overage_bytes comes to at that price, to the nearest millionth.

            minimum: 0
        • apobjectrequired
          • bytesintegerrequired

            Sent from the region's nodes in the stretch.

            format: int64 · minimum: 0
          • overage_bytesinteger | nullrequired

            What of them is past the allowance; null without one.

            format: int64 · minimum: 0
          • unit_price_usdnumberrequired

            The region's price of a gigabyte.

          • overage_usdnumberrequired

            What overage_bytes comes to at that price, to the nearest millionth.

            minimum: 0
      • month_bytesintegerrequired

        Sent in the calendar month period: the account's own cap is held against this.

        format: int64 · minimum: 0
      • stoppedbooleanrequired

        Whether the account's traffic to the internet is stopped now.

      • stopped_reasonstring | nullrequired

        allowance_reached: the account has sent its allowance and holds no balance to pay for more; overage_cap_reached: it has sent as much in the calendar month as its own cap. Null when it is not stopped.

      • pricesobjectrequired
        • egress_gb_usdnumberrequired

          US dollars for a gigabyte (10^9 bytes) past the allowance.

          minimum: 0
        • egress_eu_gb_usdnumberrequired
        • egress_ap_gb_usdnumberrequired
        • provisionalbooleanrequired
      • project_bytesintegerrequired

        What the project of the calling key sent in the calendar month; the allowance is the account's.

        format: int64 · minimum: 0
      • countedbooleanrequired

        Whether every node asked is counting traffic.

  • UsageReport
    • datatablicaobjectrequired
      • cpu_secondsnumberrequired

        A whole number of microseconds, written in seconds.

        minimum: 0
      • memory_gib_secondsnumberrequired

        Memory in 128 MiB steps, integrated over time: a whole number of steps times milliseconds, written as GiB times seconds (a multiple of 0.000125).

        minimum: 0
      • egress_bytesintegerrequired

        Bytes sent to the internet.

        format: int64 · minimum: 0
      • requestsintegerrequired

        Through a control plane only (a node does not count them): requests into the sandboxes through the platform's ingress that a node took, an HTTP request, a WebSocket and an SSH session each one; what the platform refused itself is none. An app's requests are booked to the app itself, under the labels its instances carry and the region of the edge they came by: grouped by metadata.app or metadata.region they are with what the instances used, and grouped by sandbox they are in the group of no sandbox. control/README.md, 「套餐和账单」.

        format: int64 · minimum: 0
      • state_gb_hoursnumberrequired

        Through a control plane only: what the sandboxes kept of their own memory and disk while they slept, sampled once an hour; and what the backups of volumes kept in the object store, the bytes the store holds of each (stored_bytes) for as long as it is ready and not gone, booked under the backup's own id (kind backup: 0 in a group of a sandbox). In GB-hours (a whole number of byte-hours, written as 10^-9 of a GB-hour).

        minimum: 0
      • storage_gb_hoursnumberrequired

        Through a control plane only: what volumes and snapshots kept, in GB-hours (a whole number of byte-hours, written as 10^-9 of a GB-hour). A volume keeps its used_bytes and a snapshot its size_bytes, for as long as each is there, counted by its node from the moment it is made to the moment it is deleted. It is booked under the volume's or the snapshot's own id: 0 in a group of a sandbox.

        minimum: 0
      • log_bytesintegerrequired

        Through a control plane only: what apps' instances printed that their nodes kept, in bytes of the lines' text as they were printed. It is booked to the app itself, in the hour of the lines, under the app's own labels and its id (metadata.app), from what each node counted of the app's log: grouped by metadata.app it is with what the app's instances used, and grouped by sandbox it is in the group of no sandbox. No meter's: the logs are priced by log_gb_hours.

        format: int64 · minimum: 0
      • log_gb_hoursnumberrequired

        Through a control plane only: what apps' instances printed that their nodes kept, times the hours it was kept (each hour from the one it was printed in to the end of the days the account's plan keeps logs), in GB-hours: the logs (meters.logs of GET /v1/billing). Booked to the app as log_bytes is, to the hours it was kept in.

        minimum: 0
      • drive_write_bytesintegerrequired

        Through a control plane only: what was written to volumes, as their nodes count it, booked under the volume's own id (0 in a group of a sandbox).

        format: int64 · minimum: 0
      • drive_cold_read_bytesintegerrequired

        Through a control plane only: what was read of volumes from the object store (not from their node's disk), booked under the volume's own id; and what sandboxes read from it through their read-only mounts of Drives' snapshots (slice D7), booked under each sandbox, whose account pays for it.

        format: int64 · minimum: 0
      • browser_awake_secondsnumberrequired

        Through a control plane only: how long Browsers sessions were awake, in seconds to the millisecond, as their nodes count it, booked of a session and of no other sandbox. No meter prices it: a session is billed by its CPU time, memory and traffic, as any sandbox is.

        minimum: 0
      • cache_gb_hoursnumberrequired

        Through a control plane only: what volumes kept on their nodes' NVMe (the less of the cache each is set to, cache_bytes, and the data it holds), in GB-hours, hour by hour, as their nodes count it, booked under the volume's own id (0 in a group of a sandbox): the meter of the cache (volume_cache). A volume whose cache is all of it (the default) is counted what it holds.

        minimum: 0
      • egress_eu_bytesintegerrequired

        Through a control plane only: of egress_bytes, what left from a node in Europe, which is priced at egress_eu_gb_usd.

        format: int64 · minimum: 0
      • egress_ap_bytesintegerrequired

        Through a control plane only: of egress_bytes, what left from a node in Asia-Pacific, priced at egress_ap_gb_usd; the rest left from one in North America or with no region, priced at egress_gb_usd.

        format: int64 · minimum: 0
      • startoptionalstring

        With hour or day: when the hour or the day (UTC) of this group begins.

        format: date-time
      • sandbox_idoptionalstring | null

        With sandbox. Through a control plane, null in the one group of what no one sandbox used: what volumes and snapshots kept (and, where the report is also by volume or by snapshot, in every group of one of those), what the backups of volumes kept, and the requests that apps took, which are booked to the app and to none of its instances.

        pattern: ^sbx-[0-9a-hjkmnp-tv-z]{16}$
      • volume_idoptionalstring | null

        Through a control plane only, with volume: the volume this group is of, or the bucket of an installation of a Managed Application (ibk-, billed as volume data). Null in a group of what no volume kept.

        pattern: ^(vol|ibk)-[0-9a-hjkmnp-tv-z]{16}$
      • drive_idoptionalstring | null

        Through a control plane only, with drive (or drive_id, kind=drive): the Drive this group is of. Null in a group of what no Drive kept.

        pattern: ^vol-[0-9a-hjkmnp-tv-z]{16}$
      • snapshot_idoptionalstring | null

        Through a control plane only, with snapshot: the snapshot this group is of. Null in a group of what no snapshot kept.

        pattern: ^snap-[0-9a-hjkmnp-tv-z]{16}$
      • backup_idoptionalstring | null

        Through a control plane only, with backup (or backup_id): the backup of a volume this group is of. Null in a group of what no backup kept. Its name is null: a backup has none.

        pattern: ^bak-[0-9a-z]+$
      • kindoptionalstring

        Through a control plane only, with kind (drive in place of volume where the question says Drives): the kind of thing this group is of. log_export: what the export of the apps' logs sent their destinations, which is traffic to the internet (egress_bytes) and nothing else. backup: what the backups of volumes kept in the object store, on the meter of state (state_gb_hours) and nothing else. browser_profiles: what the project's Browsers' profiles keep, as volume data (storage_gb_hours), and nothing else. volume: what volumes kept (storage_gb_hours), and what was written to them and read of them cold (drive_write_bytes, drive_cold_read_bytes).

      • nameoptionalstring | null

        With sandbox: what the sandbox is called now; for a deleted one, what it was called last. Through a control plane, with volume or snapshot, the same of the volume or the snapshot.

      • productoptionalbrowserslubdatabaseslubnull

        What the sandbox is sold as, by the control plane's own record (never its metadata): browsers for a Browsers session (POST /v1/browsers), databases for an instance of a database's branch (POST /v1/databases), null for any other sandbox. Through a control plane only, with sandbox.

      • database_idoptionalstring | null

        Through a control plane only, with sandbox or volume (drive): the database the thing of this group is of (slice DB7): an instance of one of its branches, or a branch's Drive, by the databases' own records (never metadata). Null for any other thing, and in a group of no thing. With database or branch: the database of this group, null in the group of what no database's thing used.

        pattern: ^db-[0-9a-hjkmnp-tv-z]{16}$
      • branch_idoptionalstring | null

        With database_id: the branch of the database the thing is of (the root's, main, or one of its own). Null where database_id is. With branch: the branch of this group.

        pattern: ^br-[0-9a-hjkmnp-tv-z]{16}$
      • metadataoptionalmapastring | null

        With metadata.<key>: each key grouped by, with the value the sandboxes of this group had for it while they used this. Null: they had no such key.

    • next_cursorstring | nullrequired

      Pass it as cursor to get the next page. Null on the last page.

    • totalsobjectrequired

      Sums over every group the call selects, not over this page, and how many sandboxes they are of (an app that requests are booked to is not one of them). They are of the moment this page was made. Over a range that includes the present, usage is still being booked: a later page's totals are ahead of an earlier page's, and the groups collected over several pages add up to less than the totals of the last. Over a range that has ended, every page says the same.

      • cpu_secondsnumberrequired
        minimum: 0
      • memory_gib_secondsnumberrequired
        minimum: 0
      • egress_bytesintegerrequired
        format: int64 · minimum: 0
      • requestsintegerrequired

        Through a control plane only, as in a group.

        format: int64 · minimum: 0
      • state_gb_hoursnumberrequired

        Through a control plane only, as in a group.

        minimum: 0
      • storage_gb_hoursnumberrequired

        Through a control plane only, as in a group.

        minimum: 0
      • log_bytesintegerrequired

        Through a control plane only, as in a group.

        format: int64 · minimum: 0
      • log_gb_hoursnumberrequired

        Through a control plane only, as in a group.

        minimum: 0
      • drive_write_bytesintegerrequired

        Through a control plane only, as in a group.

        format: int64 · minimum: 0
      • drive_cold_read_bytesintegerrequired

        Through a control plane only, as in a group.

        format: int64 · minimum: 0
      • browser_awake_secondsnumberrequired

        Through a control plane only, as in a group.

        minimum: 0
      • cache_gb_hoursnumberrequired

        Through a control plane only, as in a group.

        minimum: 0
      • egress_eu_bytesintegerrequired

        Through a control plane only, as in a group: of egress_bytes, what left from a node in Europe.

        format: int64 · minimum: 0
      • egress_ap_bytesintegerrequired

        Through a control plane only, as in a group: of egress_bytes, what left from a node in Asia-Pacific.

        format: int64 · minimum: 0
      • sandboxesintegerrequired

        How many sandboxes the groups are of. Volumes and snapshots are not counted here.

        minimum: 0
    • fromstring | nullrequired

      The beginning of the range as it holds: the first hour that begins at or after the from asked for. Null: none was asked for.

      format: date-time
    • tostring | nullrequired

      The end of the range as it holds: the first hour that begins at or after the to asked for; hours before it are in the range. Null: none was asked for.

      format: date-time
    • group_bytablicastringrequired

      What the groups are of, in the order of their keys: hour or day, sandbox, then each metadata.<key>. Through a control plane volume, snapshot and kind come after sandbox.

    • bucket_secondsintegerrequired

      The grain of the books: 3600, an hour. (A node started for a test with --usage-bucket-seconds has a shorter one.)

      minimum: 1
    • metadata_atstringrequired

      Which metadata the groups and the filters go by. time_of_use: the ones a sandbox had while it used what a row holds.

    • metadata_approximatebooleanrequired

      True when something in the range (of the sandbox asked for, whatever the filters by metadata) may be booked under metadata other than the ones it was used under; metadata_approximate_reasons says why. The quantities are exact in every case; which group they are in is not, and a filter by metadata may leave some of them out.

    • metadata_approximate_reasonstablicastringrequired

      Why, when metadata_approximate is true: every reason that holds of something in the range, each once; empty when it is false. changed_often: a sandbox's metadata changed more than 60 times in one hour. The first 60 changes each end a row of the books; after that the hour's row goes on under the newest metadata. The others are a control plane's, which keeps the books of many nodes in one store. sets_in_an_hour: one sandbox has rows under at most 61 sets of metadata in an hour, and what it used under a further set is booked under no metadata. values_of_a_key: one metadata key had more distinct values in a calendar month than the books take in for a project (1 000). A value past that takes its key out of the set, and the use is booked under the rest of the set: a sandbox tagged with a team and the id of its job is booked under its team. Asked by that key, such use is under no value; asked by any other key, it is where it belongs. keys_in_a_month: the month's new sets already use 256 distinct key names; a further key is removed from a new set, preserving the other keys and all quantities. Existing sets remain exact. set_too_large: a set of metadata whose JSON text is longer than 4 096 bytes is not kept, and what is used under it is booked under no metadata. sets_in_a_month: the project had more new sets of metadata in a calendar month than the books take in (10 000); what is used under a further new set is booked under no metadata until the month turns. A set the books already have does not count again, and takes no place among a key's values either. sets_in_all: the project keeps as many sets of metadata as the books keep for one in all (130 000: a set is kept for thirteen months after its last use); what is used under a further new set is booked under no metadata until sets the project no longer uses have gone. booked_on_arrival: the sandbox's node gave a reading of the use but no hour and no metadata for it (a node that was cut off before it wrote them down, or one of an earlier version): it is booked in the hour the reading arrived in, under the metadata the sandbox had before or after. unspecified: the hour was marked by a version that did not keep the reason.

    • pricesobjectrequired

      What the quantities are multiplied by: the prices of the account's month, one a meter (and of traffic one a region).

      • cpu_ms_million_usdnumberrequired

        A million CPU-ms of CPU time: milliseconds of a busy vCPU ($0.01, which is $0.036 a vCPU-hour).

      • memory_gib_hour_usdnumberrequired

        A GiB-hour of memory held while awake, or paused in memory (the pause tier).

      • requests_million_usdnumberrequired

        A million requests: into apps, and into sandboxes through their preview URLs.

      • volume_data_gb_month_usdnumberrequired

        A GB-month of volume data: what volumes hold, what snapshots keep, what sleeping sandboxes keep of their own memory and disk, and what the backups of volumes keep in the object store (--price-volume-data-gb-month). Nothing is priced of what is written to a volume or read of it.

      • volume_cache_gb_month_usdnumberrequired

        A GB-month of a volume's NVMe cache: what its node keeps of it on its own disk, the less of the cache the volume is set to (all of it unless said) and the data it holds (--price-volume-cache-gb-month). A volume fully cached so costs this and volume_data_gb_month_usd together a GB-month of what it holds.

      • egress_gb_usdnumberrequired

        A gigabyte (10^9 bytes) sent to the internet from a node in North America, or from one with no region: traffic is priced by the region of the node it left from: na North America (and a node with no region), eu Europe, ap Asia-Pacific.

      • egress_eu_gb_usdnumberrequired

        A gigabyte sent to the internet from a node in Europe.

      • egress_ap_gb_usdnumberrequired

        A gigabyte sent to the internet from a node in Asia-Pacific.

      • logs_gb_month_usdnumberrequired

        A GB-month of what apps print that their nodes keep: the text of each line of output kept, counted as it was printed, for the hours it is kept (--price-logs-gb-month).

      • provisionalbooleanrequired
    • planstring | nullrequired

      The plan the project's account is on now (Billing.plan).

400

unknown_parameter; invalid_field: a time that is none, a range that ends before it begins, a group_by or kind that is none, two of sandbox_id, volume_id and snapshot_id.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      Jeden z poniższych:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionaltablicaobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilestablicastringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemstablicaobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdonelubadaptedlubignoredlubrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicestablicaobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedlubchangedlubunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindservicelubjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemstablicaobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdonelubadaptedlubignoredlubrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          Jeden z poniższych:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          Jeden z poniższych:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            Jeden z poniższych:

            • string
            • array<string>
        • envmapastringrequired
        • secretsmapastringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumestablicaobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filestablicaobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          Jeden z poniższych:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionstablicastringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msinteger | nullrequired

            The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          Jeden z poniższych:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowlubdenylubnull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamapastringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_ontablicaobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasestablicastringrequired
          • endpoint_modestringrequired
        • drivesoptionaltablicaobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionaltablicaobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          Jeden z poniższych:

          • Runtime
            • ulimitsmapaRuntimeLimitGivenrequired
            • sysctlsmapastringrequired
            • tmpfstablicaobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serverstablicastringrequired
              • searchtablicastringrequired
              • optionstablicastringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumestablicaobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makelubmadelubtherelubexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_bytablicastringrequired
    • secretstablicaobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_bytablicastringrequired
    • left_outtablicaobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilestablicastringrequired
    • absenttablicastringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionaltablicaobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

401

missing_api_key, invalid_api_key, expired_api_key, invalid_token.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      Jeden z poniższych:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionaltablicaobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilestablicastringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemstablicaobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdonelubadaptedlubignoredlubrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicestablicaobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedlubchangedlubunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindservicelubjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemstablicaobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdonelubadaptedlubignoredlubrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          Jeden z poniższych:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          Jeden z poniższych:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            Jeden z poniższych:

            • string
            • array<string>
        • envmapastringrequired
        • secretsmapastringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumestablicaobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filestablicaobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          Jeden z poniższych:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionstablicastringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msinteger | nullrequired

            The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          Jeden z poniższych:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowlubdenylubnull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamapastringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_ontablicaobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasestablicastringrequired
          • endpoint_modestringrequired
        • drivesoptionaltablicaobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionaltablicaobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          Jeden z poniższych:

          • Runtime
            • ulimitsmapaRuntimeLimitGivenrequired
            • sysctlsmapastringrequired
            • tmpfstablicaobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serverstablicastringrequired
              • searchtablicastringrequired
              • optionstablicastringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumestablicaobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makelubmadelubtherelubexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_bytablicastringrequired
    • secretstablicaobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_bytablicastringrequired
    • left_outtablicaobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilestablicastringrequired
    • absenttablicastringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionaltablicaobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

403

key_scope: the key does not allow the scope the call takes (the message names it); needs_api_key: the operator's key, or the SSH gateway's; account_held: the account is held for its payments, and every call of its keys but GET /v1/account is refused so, before the scopes are looked at (x-error-codes); installation_key_scope: a key held to an installation of a Managed Application, on a call that is not about that installation's own things. (A sandbox token is passed to its node, which answers what it has no call for with 404 no_such_route.)
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      Jeden z poniższych:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionaltablicaobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilestablicastringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemstablicaobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdonelubadaptedlubignoredlubrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicestablicaobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedlubchangedlubunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindservicelubjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemstablicaobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdonelubadaptedlubignoredlubrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          Jeden z poniższych:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          Jeden z poniższych:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            Jeden z poniższych:

            • string
            • array<string>
        • envmapastringrequired
        • secretsmapastringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumestablicaobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filestablicaobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          Jeden z poniższych:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionstablicastringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msinteger | nullrequired

            The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          Jeden z poniższych:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowlubdenylubnull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamapastringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_ontablicaobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasestablicastringrequired
          • endpoint_modestringrequired
        • drivesoptionaltablicaobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionaltablicaobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          Jeden z poniższych:

          • Runtime
            • ulimitsmapaRuntimeLimitGivenrequired
            • sysctlsmapastringrequired
            • tmpfstablicaobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serverstablicastringrequired
              • searchtablicastringrequired
              • optionstablicastringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumestablicaobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makelubmadelubtherelubexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_bytablicastringrequired
    • secretstablicaobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_bytablicastringrequired
    • left_outtablicaobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilestablicastringrequired
    • absenttablicastringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionaltablicaobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

429

report_in_progress: another report of the same project was still being made after 2 seconds. retryable.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      Jeden z poniższych:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionaltablicaobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilestablicastringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemstablicaobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdonelubadaptedlubignoredlubrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicestablicaobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedlubchangedlubunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindservicelubjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemstablicaobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdonelubadaptedlubignoredlubrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          Jeden z poniższych:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          Jeden z poniższych:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            Jeden z poniższych:

            • string
            • array<string>
        • envmapastringrequired
        • secretsmapastringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumestablicaobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filestablicaobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          Jeden z poniższych:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionstablicastringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msinteger | nullrequired

            The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          Jeden z poniższych:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowlubdenylubnull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamapastringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_ontablicaobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasestablicastringrequired
          • endpoint_modestringrequired
        • drivesoptionaltablicaobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionaltablicaobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          Jeden z poniższych:

          • Runtime
            • ulimitsmapaRuntimeLimitGivenrequired
            • sysctlsmapastringrequired
            • tmpfstablicaobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serverstablicastringrequired
              • searchtablicastringrequired
              • optionstablicastringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumestablicaobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makelubmadelubtherelubexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_bytablicastringrequired
    • secretstablicaobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_bytablicastringrequired
    • left_outtablicaobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilestablicastringrequired
    • absenttablicastringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionaltablicaobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

503

report_too_long: the report took more than 5 seconds to make; ask for shorter stretches and add them up, or for whole calendar months. retryable.
JSON
  • errorobjectrequired
    • typestringrequired
    • codestringrequired
    • messagestringrequired
    • paramstring | nullrequired
    • retryablebooleanrequired
    • request_idstringrequired
    • docs_urlstring | nullrequired
  • move_idoptionalstring

    With already_moving: the move of the sandbox that is under way.

  • upgrade_idoptionalstring

    With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

    pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
  • moveoptionalobject

    With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.

    • objectstringrequired
    • idstringrequired
      pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
    • sandbox_idstringrequired
    • project_idstringrequired
    • fromobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • toobjectrequired
      • idstringrequired
      • namestring | nullrequired

        Its name; null for a node that is off the books since.

    • epochintegerrequired

      The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.

      minimum: 1
    • stepstringrequired

      Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).

    • whystringrequired

      What made it: the operator's move, an evacuation, a recovery.

    • wakebooleanrequired

      Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.

    • from_storebooleanrequired

      The new node takes it from the object store alone.

    • releaseobject | nullrequired

      What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.

    • takeoverobject | nullrequired

      What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.

    • errorrequired

      Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.

      Jeden z poniższych:

      • object
      • null
    • attemptsintegerrequired

      How many times the step it is at was asked without an answer that settles it.

      minimum: 0
    • next_attempt_atstring | nullrequired

      When that step is asked again; null where it is not waiting.

      format: date-time
    • batchstring | nullrequired

      The evacuation (evc-…) or recovery (rcv-…) it is of.

    • created_atstringrequired
      format: date-time
    • updated_atstringrequired
      format: date-time
    • ended_atstring | nullrequired
      format: date-time
  • lease_untiloptionalstring

    With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

    format: date-time
  • activeoptionalobject | null

    With standby: the active copy, as the standby last read the lease; null while no copy holds it.

    • namestringrequired
    • urlstringrequired
    • termintegerrequired
      minimum: 1
  • allowed_hostsoptionalarray | null

    With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).

  • problemsoptionaltablicaobject

    With invalid_definition: every problem of the definition, each where it is and what it is.

    • atstringrequired

      Where in the definition, a dotted path (services.web.port); empty for the whole of it.

    • messagestringrequired
  • reportoptionalobject

    With compose_refused: the import's report, which says what is refused, why, and what to change.

    • objectcompose_importrequired
    • namestring | nullrequired

      The model's name: each service's label compose.project. Null: it has none.

    • dry_runbooleanrequired
    • strictbooleanrequired
    • profilestablicastringrequired
    • treatmentsobjectrequired

      How many items of the report have each treatment.

      • doneintegerrequired
        minimum: 0
      • adaptedintegerrequired
        minimum: 0
      • ignoredintegerrequired
        minimum: 0
      • refusedintegerrequired
        minimum: 0
    • itemstablicaobjectrequired

      The model's top-level elements: name, each volume, network, config and secret, extensions.

      • atstringrequired

        Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

      • treatmentdonelubadaptedlubignoredlubrefusedrequired

        done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

      • whystringrequired
      • changestring | nullrequired

        Of one that is refused: what to change. Null otherwise.

    • servicestablicaobjectrequired

      The services the import takes, in the model's order.

      • namestringrequired

        The service's name, which is its app's.

      • app_idstring | nullrequired

        Its app. Null: a dry run of a service the project does not have.

        pattern: ^app-
      • statuscreatedlubchangedlubunchangedrequired

        What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.

      • kindservicelubjobrequired

        job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.

      • statefulbooleanrequired

        It mounts a volume of its own: one instance, which has the volume.

      • versionbooleanrequired

        Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.

      • itemstablicaobjectrequired
        • atstringrequired

          Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).

        • treatmentdonelubadaptedlubignoredlubrefusedrequired

          done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.

        • whystringrequired
        • changestring | nullrequired

          Of one that is refused: what to change. Null otherwise.

      • appobjectrequired

        The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.

        • imagestring | nullrequired

          What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.

        • image_pull_secretstring | nullrequired

          The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.

        • start_commandrequired

          Jeden z poniższych:

          • StartCommand
          • null
        • start_argsrequired

          What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.

          Jeden z poniższych:

          • array<string>
          • null
        • portinteger | nullrequired
        • readyobjectrequired

          How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).

          • httpoptionalstring

            A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.

          • tcpoptionaltrue

            The app's port takes a connection.

          • commandoptional

            A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.

            Jeden z poniższych:

            • string
            • array<string>
        • envmapastringrequired
        • secretsmapastringrequired

          Names of secrets. No answer has a value.

        • sizeobjectrequired

          What one instance may use at most. It is billed by what it uses.

          • vcpusintegerrequired
            minimum: 1
          • memory_bytesintegerrequired

            An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).

            minimum: 134217728
        • volumestablicaobjectrequired
          • volumestringrequired
          • pathstringrequired
          • read_onlybooleanrequired
          • nocopyoptionalunknown

            There only where it was given as true.

        • kindstringrequired
        • filestablicaobjectrequired
          • pathstringrequired
          • modeintegerrequired
          • uidintegerrequired
          • gidintegerrequired
          • contentoptionalstring
          • secretoptionalstring
        • userstring | nullrequired
        • working_dirstring | nullrequired
        • stoprequired

          Jeden z poniższych:

          • ServiceStop
            • signalstring | nullrequired
            • grace_msinteger | nullrequired
          • null
        • hostnamestring | nullrequired
        • regionstablicastringrequired

          In the order na, eu, ap.

        • scaleobjectrequired
          • min_instancesintegerrequired

            How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.

            minimum: 0
          • max_instancesinteger | nullrequired

            How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on Free, 500 on Paid): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2 on Free, 50 on Paid), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.

            minimum: 1
          • concurrencyinteger | nullrequired

            A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.

            maximum: 1000 · minimum: 1
          • sleep_after_msinteger | nullrequired

            The most an instance waits without a request before it stops, in milliseconds. Below it, its node picks the wait by the app's own traffic: the wait that would have cost least over the app's last gaps between a request's end and the next one, a second up and idle against a stop and the resume after it in CPU time, so that an app whose requests come closer together than a stop pays for stays up through them, and one whose requests are far apart stops as soon as its last answer has ended (0: stops at once, always). null, which is what it is when nothing is said: the platform's most, three seconds. An app that said 100, the default before 2026-10-28, says null from then on. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.

            maximum: 600000 · minimum: 0
          • sleep_notice_msinteger | nullrequired

            How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).

            maximum: 60000 · minimum: 0
          • sleep_hold_max_msintegerrequired

            How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).

            maximum: 900000 · minimum: 0
          • delete_after_msinteger | nullrequired

            After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.

            maximum: 3600000 · minimum: 1000
          • suspend_after_msoptionalinteger | null

            How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.

            maximum: 86400000 · minimum: 1000
          • wake_daily_atoptionalstring | null

            A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.

            pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
        • keysrequired

          Jeden z poniższych:

          • object
          • null
        • egressobject | nullrequired

          Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).

          • defaultoptionalallowlubdenylubnull
          • allowoptionalarray | null
          • denyoptionalarray | null
          • httpoptionalarray | null
          • injectoptionalarray | null
          • deny_portsoptionalarray | null

            Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.

        • metadatamapastringrequired
        • logsobjectrequired

          What the app's log has, each part as it was given or at its default (AppLogSettings).

          • outputbooleanrequired
          • keepbooleanrequired
          • requestsobjectrequired
            • sample_ratenumberrequired
              maximum: 1 · minimum: 0
            • keep_errorsbooleanrequired
        • publicbooleanrequired

          Whether it answers at its default domain (url).

        • depends_ontablicaobjectrequired
          • servicestringrequired
          • conditionstringrequired
        • networkobjectrequired
          • aliasestablicastringrequired
          • endpoint_modestringrequired
        • drivesoptionaltablicaobject

          The Drives its instance mounts (AppCreate.drives): none, [], where it names none.

          • drivestringrequired
          • pathstringrequired
          • modestringrequired
        • key_drivesoptionaltablicaobject

          The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.

          • namestringrequired
          • pathstringrequired
          • size_bytesinteger | nullrequired
            format: int64
          • nocopyoptionalunknown

            There only where it was given as true.

        • runtimeoptional

          Its runtime settings (AppCreate.runtime). null: none.

          Jeden z poniższych:

          • Runtime
            • ulimitsmapaRuntimeLimitGivenrequired
            • sysctlsmapastringrequired
            • tmpfstablicaobjectrequired
              • pathstringrequired
              • size_bytesinteger | nullrequired
              • modeintegerrequired
            • dnsobjectrequired
              • serverstablicastringrequired
              • searchtablicastringrequired
              • optionstablicastringrequired
            • shm_size_bytesinteger | nullrequired
          • null
        • tracesoptionalobject

          What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.

          • sample_ratenumberrequired
            maximum: 1 · minimum: 0
          • trust_incomingbooleanrequired
    • volumestablicaobjectrequired

      The volumes of the project the services mount.

      • modelstring | nullrequired

        Its name in the model. Null: made for a path a stateful service mounts with no volume named.

      • namestringrequired

        Its name in the project.

      • idstring | nullrequired

        Null: not made yet (to_make).

        pattern: ^vol-
      • sharedbooleanrequired

        Several services mount it, or one with several instances: every instance of each mounts it at once.

      • statusto_makelubmadelubtherelubexternalrequired

        to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.

      • used_bytablicastringrequired
    • secretstablicaobjectrequired

      The secrets of the model that services are granted.

      • modelstringrequired

        Its name in the model.

      • namestringrequired

        The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.

      • therebooleanrequired

        Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.

      • used_bytablicastringrequired
    • left_outtablicaobjectrequired

      The services of profiles that are not turned on, which the import does not touch.

      • namestringrequired
      • profilestablicastringrequired
    • absenttablicastringrequired

      The project's services that the model does not have: kept as they are.

    • deploystring | nullrequired

      The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.

      pattern: ^dpl-
  • accountsoptionaltablicaobject

    With sole_owner: the accounts the user is the only owner of.

    • idstringrequired
      pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
    • namestringrequired

Zacznij pisać, aby wyszukać…

↑↓ nawiguj↵ wybierzEsc zamknij