---
title: "Create a bounded 24-hour sandbox Form without an account"
method: POST
path: "/v1/public/sandboxes"
tags: ["discovery"]
---

# Create a bounded 24-hour sandbox Form without an account

`POST /v1/public/sandboxes`

## Request

- Base URL: `https://postbag.dev`
- URL: `https://postbag.dev/v1/public/sandboxes`
- Auth: none required

Requires a canonical UUIDv4 Idempotency-Key. Creates an inert sandbox Form that can accept at most five test Submissions and cannot create Destinations, Routes, Deliveries, Events or outbound traffic.

## Headers

- `idempotency-key` string, required: Canonical lowercase UUIDv4 generated with a CSPRNG.

## Request body

- object
  - `name` string, required
  - `origin` string, uri: The site origin allowed to submit, canonicalized before storage.
  - `claim_email` string, email: Optional verified-email binding. Include only when the user explicitly supplied it.

## Response `201`

created or idempotently replayed

- object
  - `sandbox` object, required
    - `id` string, required
    - `name` string, required
    - `status` 'active' | 'claimed' | 'expired' | 'blocked', required
    - `submit_url` string, required
    - `expires_at` string, required
    - `accepted_count` integer, required
    - `remaining` integer, required
  - `sandbox_token` string, required: Shown only in this response. Treat it as a secret.
  - `authorization` object, required
    - `scheme` 'Sandbox', required
    - `example` string, required
  - `embed` object, required
    - `html` string, required
    - `fetch` string, required
    - `react` string, required
    - `astro` string, required
    - `nextjs_action` string, required
  - `verify` object, required
    - `curl` string, required
    - `then` string, required
  - `claim_url` string, required
  - `next` object[], required
    - `why` string, required
    - `method` string, required
    - `path` string, required
    - `headers` object
    - `body` object

## Other responses

- `409`: Idempotency conflict
- `422`: Invalid input
- `429`: Source allowance exhausted
- `503`: Disabled or globally full

---

[API](https://skmtc.dev/postbag/apis/postbag-api.md) · [All operations](https://skmtc.dev/postbag/apis/postbag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postbag/apis/postbag-api/revisions/3da976524695?raw)