Skip to main content
The canonical Sandbox API is versioned 2026-08-01 and served below https://api.stackshift.cloud/api/v1. The dashboard, CLI, and SDKs consume this same contract.

HTTP conventions

Send a bearer token over HTTPS:
Successful JSON may be returned directly or in a data envelope; official SDKs unwrap it. Cursor collections contain items, has_more, and, when more data exists, next_cursor. The maximum page limit is 200. Every mutating request that declares Idempotency-Key requires a stable non-empty value up to 200 characters. Generate one per logical action and reuse it only for an identical retry. Do not generate a new key after a timeout until you have checked the returned/stored operation. Updates and sandbox destroy also require If-Match with the current quoted resource version. This prevents a stale client from overwriting or destroying a resource changed by another actor.

Create a sandbox over REST

The REST request supplies the normalized resource, lifecycle, and network contract. Profiles provide policy defaults but do not remove server-side validation.
The response is an operation, not a completed sandbox. Poll GET /api/v1/operations/{operationId} until terminal, or subscribe to events. Operation terminal states are succeeded, failed, and cancelled; clients also defensively recognize timed_out.

TypeScript SDK

SDK mutation methods generate UUID idempotency keys when omitted. Supply your own when the logical action may be retried across processes or jobs.

Python SDK

Go SDK

The Go client requires an absolute HTTPS base URL, except HTTP localhost for tests, and defaults to a 30-second HTTP timeout.

Endpoint families

Use resource IDs as opaque UUIDs. URL-encode every path segment and never construct object-storage or WebSocket credentials yourself; request the corresponding transfer/download/ticket resource.

Events and webhooks

Sandbox SSE is GET /api/v1/sandboxes/{id}/events/stream?after_sequence=N. Persist the last fully processed sequence, reconnect after it, tolerate duplicates, and refetch current resources after a gap. Webhook endpoint creation returns its signing secret only at creation or explicit rotation. Store it immediately in a secret manager. Verify signature, timestamp tolerance, endpoint ID, and delivery ID against the raw body before processing; deduplicate by event/delivery ID. Replay is a new delivery attempt, not a new lifecycle event.

Error object

Always log code, request_id, and operation_id when present. Never log bearer tokens, secret request bodies, terminal tickets, port tokens, signed URLs, or volatile service credentials.

CLI reference

Use the supported command surface.

Troubleshooting

Handle each stable error class safely.