---
title: "GET /api/ee/custom-viz-plugin/sandbox-host"
method: GET
path: "/api/ee/custom-viz-plugin/sandbox-host"
tags: ["/api/ee/custom-viz-plugin"]
---

# GET /api/ee/custom-viz-plugin/sandbox-host

`GET /api/ee/custom-viz-plugin/sandbox-host`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/custom-viz-plugin/sandbox-host`
- Auth: API key in header `X-API-Key`

Serve a minimal HTML document used as the iframe `src` for the near-membrane custom-viz
   sandbox. The response carries a per-document `Content-Security-Policy` that permits
   `'unsafe-eval'` only inside this iframe, so the main Metabase document keeps its strict
   nonce-based CSP. 404s unless the custom-viz kill switch is on and the request passes the
   fetch-metadata gate (see [[donor-load-allowed?]]).

## Request body

- object

## Response `2XX`

Successful response

- unknown

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/custom-viz-plugin/sandbox-host/get.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)