2026-08-01 and served below https://api.stackshift.cloud/api/v1. The dashboard, CLI, and SDKs consume this same contract.
HTTP conventions
Send a bearer token over HTTPS:data envelope; official SDKs unwrap it. Cursor collections contain items, has_more, and, when more data exists, next_cursor. The maximum page limit is 200.
Every mutating request that declares Idempotency-Key requires a stable non-empty value up to 200 characters. Generate one per logical action and reuse it only for an identical retry. Do not generate a new key after a timeout until you have checked the returned/stored operation.
Updates and sandbox destroy also require If-Match with the current quoted resource version. This prevents a stale client from overwriting or destroying a resource changed by another actor.
Create a sandbox over REST
The REST request supplies the normalized resource, lifecycle, and network contract. Profiles provide policy defaults but do not remove server-side validation.GET /api/v1/operations/{operationId} until terminal, or subscribe to events. Operation terminal states are succeeded, failed, and cancelled; clients also defensively recognize timed_out.
TypeScript SDK
Python SDK
Go SDK
Endpoint families
Use resource IDs as opaque UUIDs. URL-encode every path segment and never construct object-storage or WebSocket credentials yourself; request the corresponding transfer/download/ticket resource.
Events and webhooks
Sandbox SSE isGET /api/v1/sandboxes/{id}/events/stream?after_sequence=N. Persist the last fully processed sequence, reconnect after it, tolerate duplicates, and refetch current resources after a gap.
Webhook endpoint creation returns its signing secret only at creation or explicit rotation. Store it immediately in a secret manager. Verify signature, timestamp tolerance, endpoint ID, and delivery ID against the raw body before processing; deduplicate by event/delivery ID. Replay is a new delivery attempt, not a new lifecycle event.
Error object
code, request_id, and operation_id when present. Never log bearer tokens, secret request bodies, terminal tickets, port tokens, signed URLs, or volatile service credentials.
CLI reference
Use the supported command surface.
Troubleshooting
Handle each stable error class safely.