---
title: "Mint a connect token for a sandbox file transfer"
method: POST
path: "/sandboxes/{sandboxId}/files/{operation}/token"
tags: ["Sandboxes"]
---

# Mint a connect token for a sandbox file transfer

`POST /sandboxes/{sandboxId}/files/{operation}/token`

## Request

- Base URL: `https://api.render.com/v1`
- URL: `https://api.render.com/v1/sandboxes/{sandboxId}/files/{operation}/token`
- Auth: HTTP bearer

Mint a short-lived, capability-scoped connect token that authorizes a
single file upload or download against the sandbox, and return the
sandbox-proxy endpoint to invoke with it. The caller streams the file
bytes directly to (or from) that endpoint with the token as a bearer
credential. `application/octet-stream` carries a single file and
`application/x-tar` a directory archive, with compression carried
separately by `Content-Encoding: gzip` in either direction; directory
downloads return `application/x-tar` with `Content-Encoding: gzip`. The
token is bound to this sandbox, operation, and path, and expires
shortly after issuance.

409 with `code: sandbox_group_suspended` if the sandbox group is suspended.

## Query parameters

- `path` string, required

## Parameters

- `#/paths/~1sandboxes~1{sandboxId}/get/parameters/0` (unresolved $ref)

## Response `201`

Connect token minted.

- Schema (unresolved $ref)

## Other responses

- `400`: The request could not be understood by the server.
- `401`: Authorization information is missing or invalid.
- `403`: You do not have permissions for the requested resource. If a scoped API token does not satisfy the endpoint's minimum scope requirements, the response has code insufficient_token_scope and its message lists all minimum required scopes. Broader scopes that include their permissions also satisfy the requirements. Passing this check does not guarantee access to the requested resource or to conditional operations.
- `404`: Unable to find the requested resource.
- `429`: Rate limit has been surpassed. Rate-limited endpoints also return `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` on successful responses so clients can track their remaining quota.
- `500`: An unexpected server error has occurred.
- `503`: Server currently unavailable.

## Changes

- **2026-11-03** `6ac5d3d47362`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/render/apis/render-public-api/changes/sandboxes/:sandboxId/files/:operation/token/post.md)

---

[API](https://skmtc.dev/render/apis/render-public-api.md) - [All operations](https://skmtc.dev/render/apis/render-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/render/apis/render-public-api/revisions/6ac5d3d47362?raw)