HYhyperbrowser
Sandboxes

Start a sandbox process with secrets

Changed on

Starts a process in a running sandbox with secrets as environment variables for that process only. Pass secrets, a vault, onePassword fields, or any of them together: the vault's variables come first and secrets is merged over them, while a 1Password variable can't also come from another source. Values are decrypted on the sandbox's host and never returned; a totp secret sets the code current when the process starts, and onePassword fields are read from 1Password at that moment. Not supported on GPU sandboxes. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need both the sandboxes.read and secrets.use scopes. Don't retry blindly after a 502 SECRET_PROCESS_OUTCOME_UNKNOWN: the process may have started, so check the sandbox's process list first.

post/api/sandbox/{id}/processes

Request

Path parameters

idstring uuid required

Sandbox ID.

Request body

commandstring required

Shell command to run.

cwdstring

Working directory.

envobject

Plain environment variables. A variable that vault, secrets or onePassword sets can't also be in env (400 SECRET_SOURCES_INVALID).

timeoutMsinteger

Process timeout in milliseconds.

runAsstring

User to run the process as.

secretsSecretReferences

Environment variables to set from secrets, keyed by variable name (letters, digits and _, not starting with a digit), at most 32. {} is the same as none. An op_token secret returns 409 SECRET_TYPE_MISMATCH, an unknown secret 404 SECRET_NOT_FOUND, and a missing version 404 SECRET_VERSION_NOT_FOUND.

Example request

{
  "secrets": {
    "OPENAI_API_KEY": {
      "name": "openai-key"
    }
  },
  "onePassword": {
    "fields": {
      "SC_USER": {
        "item": "scrapingcourse login",
        "field": "username"
      },
      "SC_OTP": {
        "item": "scrapingcourse login",
        "section": "Security",
        "field": "one-time password?attribute=otp"
      }
    }
  }
}

Response

Success

Changes

  • 94dc06948680Revision changes
    • breaking

      added to the request property allOf list

    • breaking

      the ///// request property type changed from string to no type

    • breaking

      the request property type changed from string to no type

    • info

      added the new optional request property //////

    • info

      added subschema #1 to the ///// request property oneOf list

    • info

      removed the pattern ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ from the request property /////

    • info

      removed the pattern ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$ from the request property

  • 225d94fe61a0Revision changes
    • warning

      added the new onePassword enum value to the //// response property for the response status

    • warning

      added the new onePassword enum value to the /// response property for the response status

    • info

      added the new optional request property