---
title: "Machine-readable description of the sandbox surface"
method: GET
path: "/api/sandbox"
tags: ["auth"]
---

# Machine-readable description of the sandbox surface

`GET /api/sandbox`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/sandbox`
- Auth: none required

Public, no auth - the probe an agent can run to VERIFY that a sandbox exists rather than take prose for it. Derives its facts from the live fail-closed sandbox engine instead of restating them by hand, so it cannot drift from the behaviour it describes. Sandbox is a property of the TOKEN, not a separate host: the same endpoints, the same bearer scheme, with WRITE verbs returning a simulated receipt and reads serving real data.

## Response `200`

How to get a sandbox token and what it changes.

- SandboxInfoResponse: Derived from the live sandbox engine, not restated by hand, so it cannot drift from the behaviour it describes.
  - `sandbox` true, required
  - `summary` string, required
  - `how_to` string
  - `self_serve` object: The no-human path: one unauthenticated POST returns a narrow, short-lived sandbox token.
    - `endpoint` string
    - `method` string
    - `auth` string
    - `scopes` string[]
    - `expires_in` integer
    - `rate_limit` string

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)