---
title: "Expose a port inside a sandbox at a public HTTPS URL - the preview URL for a dev server [rate class: sandbox_api_rps]"
method: POST
path: "/preview/sandboxes/{id}/expose"
tags: ["sandboxes"]
---

# Expose a port inside a sandbox at a public HTTPS URL - the preview URL for a dev server \[rate class: sandbox_api_rps\]

`POST /preview/sandboxes/{id}/expose`

## Request

- Base URL: `https://autoresearch.sfcompute.com`
- URL: `https://autoresearch.sfcompute.com/preview/sandboxes/{id}/expose`
- Auth: HTTP bearer

Expose a port inside one of your SANDBOXES at a public HTTPS URL - the preview URL for a dev server, so the page an agent just wrote can be looked at (or curled, or driven by a browser) from outside. Returns {endpoint_id, url, sandbox, port, auth, expires_at}. Default auth is the capability URL itself: the hostname carries an unguessable secret, so anyone holding the URL reaches the port - treat it like a password. auth:"bearer" additionally requires `Authorization: Bearer <token>` at the edge; that token rides the response ONCE. THE SERVER HAS TO BE RUNNING AND ON LOOPBACK: bind 127.0.0.1 (the dev-server default) on a port in 1024-65535, and background it WITH ITS OUTPUT REDIRECTED - `(npm run dev > /tmp/dev.log 2>&1 &)` - because sandbox_exec waits for a command's output to end, so a bare `npm run dev &` hangs the exec and then dies with it. Exposing a port nothing listens on succeeds; the URL then answers 502 naming the port, so start the server first. Idempotent per (sandbox, port): the same call returns the same URL with a refreshed expiry, which makes it cheap to call in a loop. The endpoint belongs to THIS sandbox: a fork does not inherit it (a fork is a new sandbox - expose its own port), and deleting the sandbox kills the URL. An inbound request wakes a parked sandbox, so traffic puts it back on the active RAM tier. Raw byte pipe behind the URL: streaming, SSE and WebSocket all pass through. No vanity hostnames on sandbox endpoints (nodes have those); works even on a sandbox with egress:"none", because nothing dials out to serve it.

## Path parameters

- `id` string, required: The sandbox whose port to expose. Opaque - pass back the exact string create_sandbox / fork_sandbox gave you.

## Query parameters

- `workspace` string

## Request body

- object
  - `auth` string, nullable: "capability-url" (the default: the unguessable URL is the secret) or "bearer" (also require `Authorization: Bearer <token>` at the edge; the token rides the response once).
  - `port` integer, required: The port the server inside the sandbox listens on, 1024-65535 (a dev server's 3000, 5173, 8000). It must be bound on the sandbox's LOOPBACK, which is what dev servers bind by default.

## Response `200`

The capability's JSON result.

- Result: The capability's result: the same object the MCP tool returns as structuredContent. Resources carry an `object` type discriminator and an immutable id; money is integer micro-dollars in `*_usd_micros` fields.
  - `object` string: The resource type, when the result is one resource.

## Other responses

- `400`: Malformed request: bad JSON, a parameter that does not parse, or a value outside its range. Code `invalid`.
- `401`: No bearer token, or one this API cannot verify. Code `unauthenticated`.
- `403`: Authenticated, but the token's scopes or the account's role do not reach this operation. The message names the scope word to request. Code `forbidden`.
- `404`: No such route. Code `not_found`; the body names the OpenAPI document.
- `422`: A well-formed request the platform declined: no such node, a cap reached, a state that forbids the move. The message says which, and what to do instead. Code `refused`.
- `429`: Over this door's per-customer budget. Wait `Retry-After` seconds. Code `rate_limited`.
- `500`: Our fault. Retry; if it persists, quote the request-id. Code `internal`.

---

[API](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api.md) · [All operations](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/revisions/f88dcb70ac6c?raw)