---
title: "Sandbox"
method: GET
path: "/sandboxes/{sandboxID}"
tags: ["sandboxes"]
---

# Sandbox

`GET /sandboxes/{sandboxID}`

Get a sandbox by id

## Path parameters

- `sandboxID` string, required

## Response `200`

Successfully returned the sandbox

- SandboxDetail
  - `templateID` string, required — Identifier of the template from which is the sandbox created
  - `alias` string — Alias of the template
  - `sandboxID` string, required — Identifier of the sandbox
  - `clientID` string, required — Identifier of the client
  - `startedAt` string, date-time, required — Time when the sandbox was started
  - `endAt` string, date-time, required — Time when the sandbox will expire
  - `envdVersion` string, required — Version of the envd running in the sandbox
  - `envdAccessToken` string — Access token used for envd communication
  - `allowInternetAccess` boolean, nullable — Whether internet access was explicitly enabled or disabled for the sandbox. Null means it was not explicitly set.
  - `domain` string, nullable — Base domain where the sandbox traffic is accessible
  - `cpuCount` integer, required — CPU cores for the sandbox
  - `memoryMB` integer, required — Memory for the sandbox in MiB
  - `diskSizeMB` integer, required — Disk size for the sandbox in MiB
  - `metadata` unknown
  - `state` 'running' | 'paused', required — State of the sandbox
  - `network` SandboxNetworkConfig
    - `allowPublicTraffic` boolean — Specify if the sandbox URLs should be accessible only with authentication.
    - `allowOut` string[] — List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
    - `denyOut` string[] — List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.
    - `egressProxy` SandboxEgressProxyConfig, nullable — SOCKS5 proxy for sandbox egress. Outbound TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use remote DNS (ATYP=domain).
      - `address` string, required — SOCKS5 proxy address in host:port format (e.g. "proxy.example.com:1080").
      - `username` string — Optional SOCKS5 username (RFC 1929), max 255 bytes.
      - `password` string — Optional SOCKS5 password (RFC 1929), max 255 bytes.
    - `maskRequestHost` string — Specify host mask which will be used for all sandbox requests
    - `rules` object — Per-domain transform rules applied to matching egress HTTP/HTTPS requests. Keys are domains (e.g. "api.example.com", "example.com"). A domain listed here is not automatically allowed - use allowOut to permit the traffic.
  - `lifecycle` SandboxLifecycle — Sandbox lifecycle policy returned by sandbox info.
    - `autoResume` boolean, required — Whether the sandbox can auto-resume.
    - `onTimeout` 'kill' | 'pause', required — Action taken when the sandbox times out.
  - `volumeMounts` SandboxVolumeMount[]
    - `name` string, required — Name of the volume
    - `path` string, required — Path of the volume

## Other responses

- `401` — Authentication error
- `404` — Not found
- `500` — Server error

## Changes

- **2026-08-20** `e01b3f5506fe` — 3 info
  - added the optional property `error_code` to the response with the `401` status
  - added the optional property `error_code` to the response with the `404` status
  - added the optional property `error_code` to the response with the `500` status
- **2026-08-19** `a264494323e1` — 2 breaking, 4 info
  - the response property `network/egressProxy` became nullable for the status `200`
  - the `network/egressProxy` response's property type/format changed from ``/`` to `object`/`` for status `200`
  - added the optional property `network/egressProxy/password` to the response with the `200` status
  - added the optional property `network/egressProxy/username` to the response with the `200` status
  - …2 more
- **2026-07-24** `93ed246a4c10` — 3 info
  - the endpoint scheme security `AdminApiKeyAuth AND AdminTeamAuth` was added to the API
  - the endpoint scheme security `Supabase1TokenAuth AND Supabase2TeamAuth` was removed from the API
  - added the optional property `network/egressProxy` to the response with the `200` status
- **2026-05-27** `e13ef89d456c` — 1 info
  - the endpoint scheme security `AuthProviderBearerAuth AND AuthProviderTeamAuth` was added to the API
- **2026-05-26** `6c40e6f50bad` — 1 info
  - added the optional property `network/rules` to the response with the `200` status

[Full history](https://skmtc.dev/e2b-dev/apis/e2b-api/changes/sandboxes/:sandboxID/get.md)

---

[API](https://skmtc.dev/e2b-dev/apis/e2b-api.md) · [All operations](https://skmtc.dev/e2b-dev/apis/e2b-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/e2b-dev/e2b-api/revisions/e01b3f5506fe/schema)