Run an allowlisted, sandboxed, non-root command via a service token

Runs argv (an exec-style argument vector, NOT a shell string) on the machine the presenting SERVICE TOKEN is pinned to, as a SANDBOXED NON-ROOT user. The token also carries an allowlist of command basenames; argv[0]'s basename must be on it or the call is refused. This is the deliberate OPPOSITE of /api/v1/exec: that one runs an arbitrary shell string as root on a machine named by code; this one runs only a fixed set of non-root commands on a single pinned machine, with no shell. Auth is a SERVICE TOKEN ONLY (Bearer aics_…) — an account API key, an admin token, or anonymous are all rejected 401. A service token bypasses the 24h dormancy gate (it's a server-to-server credential) and is revoke-only. Output is buffered and capped at 8 MiB. Create service tokens manually in the dashboard; list/revoke/audit them via /api/v1/secure-tokens and /api/v1/secure-exec/audit.

post/api/v1/secure-exec

Request

  • Base URL: https://aicommander.dev
  • URL: https://aicommander.dev/api/v1/secure-exec
  • Auth: HTTP bearer

Request body

argvstring[] required

Non-empty argument vector with at most 256 elements and at most 128 KiB of total string content (argv[0] is the program; its basename must be on the token's allowlist). No shell is involved — arguments are passed verbatim.

inputstring

Optional standard input, base64-encoded. Capped at the secure-exec input limit.

cwdstring

Optional working directory (absolute path, maximum 4,096 characters).

timeout_msnumber

Requested timeout in milliseconds; the server normalizes it rather than rejecting out-of-range values. An omitted, non-number, or non-finite value uses the 300000 ms (5 min) default. Any finite number below 1000 is raised to 1000 ms; any finite number above 3600000 is capped at 3600000 ms (1 hr); a finite value inside that range is kept as supplied.

Example request

{
  "argv": [
    "git",
    "status",
    "--porcelain"
  ]
}

Response

Command completed (any exit code).

oktrue required
exitCodeinteger required
durationMsinteger required
stdoutstring required
stderrstring required
truncatedboolean required

True when output hit the 8 MiB cap and was truncated.

Changes

No recorded changes to this operation across all 1 revision of this API.