---
title: "Create a sandbox image"
method: POST
path: "/projects/{projectId}/images"
tags: ["Sandbox images"]
---

# Create a sandbox image

`POST /projects/{projectId}/images`

Create a personal-draft sandbox image from a blueprint and respond `201` with its detail. Build it (`POST .../build`) before a computer can boot from it. Guest callers are denied (a write).

## Path parameters

- `projectId` string, required

## Request body

- SandboxImageCreateRequest — Create a sandbox image from a blueprint YAML document: an allowlisted, `@sha256`-digest-pinned `base` image plus `initialize` steps baked into the image, and optional `maintenance`/`knowledge` delivered to the agent at runtime.
  - `name` string, required — Display name for the new sandbox image; must be non-empty after trimming.
  - `blueprint` string, required — Blueprint YAML defining the image. Validated server-side; use the validate endpoint for fast feedback.

## Response `201`

The sandbox image was created.

- SandboxImage — A project's custom Computer image: a digest-pinned blueprint plus its latest build.
  - `id` string, required
  - `projectId` string, required
  - `name` string, required
  - `contentHash` string, required
  - `sharing` 'user' | 'project', required — `user` = a personal draft; `project` = shared with the whole project.
  - `isOwner` boolean, required
  - `currentBuild` SandboxImageBuild, required — One build of a sandbox image's image.
    - `id` string, required
    - `status` 'queued' | 'building' | 'ready' | 'failed', required
    - `provider` 'e2b' | 'stub', required
    - `e2bBuildId` string
    - `baseImageDigests` string[], required — Resolved sha256 digest of every FROM base (the reproducibility pin).
    - `logPreview` string — Capped, ANSI-stripped tail of the build log.
    - `error` string
    - `createdAt` number, required
    - `startedAt` number
    - `finishedAt` number
  - `createdAt` number, required
  - `updatedAt` number, required
  - `blueprint` string, required — The image's blueprint YAML (base / initialize / maintenance / knowledge). `base` must be an allowlisted official image pinned by sha256 digest.

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.
- `502` — Could not connect to the target MCP server.

## Changes

- **2026-07-27** `c3f63a334176` — 2 breaking, 1 warning, 1 info
  - added the new required request property `blueprint`
  - removed the required property `dockerfile` from the response with the `201` status
  - removed the request property `dockerfile`
  - added the required property `blueprint` to the response with the `201` status
- **2026-07-25** `8e393fd5825f` — 7 warning
  - added the new `CONFLICT` enum value to the `code` response property for the response status `400`
  - added the new `CONFLICT` enum value to the `code` response property for the response status `401`
  - added the new `CONFLICT` enum value to the `code` response property for the response status `403`
  - added the new `CONFLICT` enum value to the `code` response property for the response status `404`
  - …3 more
- **2026-07-25** `302cc2d08c56` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mcpjam/apis/mcpjam-api/changes/projects/:projectId/images/post.md)

---

[API](https://skmtc.dev/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.dev/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/c628a0e95b06/schema)