---
title: "Create session"
method: POST
path: "/v1/agents/sessions"
tags: ["Sessions"]
---

# Create session

`POST /v1/agents/sessions`

## Request

- Base URL: `https://api.sandbase.ai`
- URL: `https://api.sandbase.ai/v1/agents/sessions`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Create a Session for a saved Agent, or for an inline Agent defined in the request. The Agent configuration, Skills, and MCP connections are frozen for the lifetime of the Session. With stream=true and an initial input, the 201 response is a Server-Sent Events stream of the first turn instead of a JSON Session. Execution admission (balance and organization status) is checked here.

## Headers

- `Idempotency-Key` string
- `OpenAI-Beta` 'agents=v1'

## Request body

- union: Send agent_id, agent, or both.
  - object
    - `agent_id` string, required: Saved Agent ID (`agt_` prefix).
    - `version` integer: Agent version. Defaults to the current version. Not allowed with an inline Agent.
    - `title` string
    - `agent` object: Agent configuration, validated as in Create Agent. Without agent_id it defines an inline Agent and model is required; inline Agents carry no Skills or MCP connections. With agent_id, each field sent replaces that field of the saved version for this Session only.
      - `model` string
      - `instructions` string, nullable
      - `runtime_profile` 'codex' | 'claude' | 'mcode': Defaults to codex for an inline Agent.
      - `service_tier` string, nullable
      - `tools` object[]
      - `text` object
      - `reasoning` object
      - `multi_agent` object
    - `model` string: Model override for this Session. Must equal agent.model when both are sent.
    - `environment` object: OpenAI SDK compatibility only. Sessions always run in the SandBase hosted cloud, so omit this field in direct HTTP calls. The OpenAI SDK requires it; {"type":"openai_hosted"} is accepted and any other value returns 400.
      - `type` 'openai_hosted'
    - `input` union: Optional first input: a string, or an array with exactly one message, e.g. [{"role":"user","content":[{"type":"input_text","text":"..."}]}]. A bare object returns 400.
      - string
      - object[]
        - `role` 'user', required
        - `content` object[], required
          - `type` 'input_text', required
          - `text` string, required
    - `metadata` object
    - `stream` boolean: true requires a non-empty input and returns a 201 text/event-stream of the first turn.
    - `model_provider` ModelProvider: Write-only model credential. Omit it to run with the calling SandBase API key. Never returned.
      - `type` 'sandbase' | 'custom'
      - `base_url` string, uri: Required for custom. HTTPS only, without credentials, query, or fragment. Not allowed for sandbase.
      - `api_key` string: Required for custom. Optional for sandbase, where it defaults to the calling key.
  - object
    - `agent_id` string: Saved Agent ID (`agt_` prefix).
    - `version` integer: Agent version. Defaults to the current version. Not allowed with an inline Agent.
    - `title` string
    - `agent` object, required: Agent configuration, validated as in Create Agent. Without agent_id it defines an inline Agent and model is required; inline Agents carry no Skills or MCP connections. With agent_id, each field sent replaces that field of the saved version for this Session only.
      - `model` string
      - `instructions` string, nullable
      - `runtime_profile` 'codex' | 'claude' | 'mcode': Defaults to codex for an inline Agent.
      - `service_tier` string, nullable
      - `tools` object[]
      - `text` object
      - `reasoning` object
      - `multi_agent` object
    - `model` string: Model override for this Session. Must equal agent.model when both are sent.
    - `environment` object: OpenAI SDK compatibility only. Sessions always run in the SandBase hosted cloud, so omit this field in direct HTTP calls. The OpenAI SDK requires it; {"type":"openai_hosted"} is accepted and any other value returns 400.
      - `type` 'openai_hosted'
    - `input` union: Optional first input: a string, or an array with exactly one message, e.g. [{"role":"user","content":[{"type":"input_text","text":"..."}]}]. A bare object returns 400.
      - string
      - object[]
        - `role` 'user', required
        - `content` object[], required
          - `type` 'input_text', required
          - `text` string, required
    - `metadata` object
    - `stream` boolean: true requires a non-empty input and returns a 201 text/event-stream of the first turn.
    - `model_provider` ModelProvider: Write-only model credential. Omit it to run with the calling SandBase API key. Never returned.
      - `type` 'sandbase' | 'custom'
      - `base_url` string, uri: Required for custom. HTTPS only, without credentials, query, or fragment. Not allowed for sandbase.
      - `api_key` string: Required for custom. Optional for sandbase, where it defaults to the calling key.

## Response `201`

Session created. With stream=true, a text/event-stream of the first turn whose first event, agent.session.created, carries the Session.

- Session
  - `id` string, required: Session ID (`ses_` prefix).
  - `object` 'agent.session', required
  - `agent` object, required: OpenAI-shaped snapshot of the effective Agent configuration (id, name, model, instructions, multi_agent, reasoning, service_tier, text, tools).
  - `agent_id` string, required
  - `agent_version` integer, required
  - `title` string, required
  - `model` string, required
  - `environment` object, required: Echo of the hosted execution context, kept for OpenAI SDK compatibility. It is not a Sandbox instance and needs no action from clients.
    - `id` string
    - `type` 'openai_hosted'
    - `skills` object[]
  - `metadata` object, required
  - `status` 'idle' | 'in_progress' | 'requires_action' | 'failed', required: Execution status. requires_action is not supported yet and surfaces as a 502 executor_contract_error.
  - `lifecycle_status` 'active' | 'archived', required
  - `sync_status` string, required
  - `execution_status` string, required
  - `failure` SessionFailure, required
    - `code` 'session_creation_rejected' | 'execution_failed' | 'model_authentication_failed' | 'model_rate_limited' | 'model_quota_exceeded' | 'context_limit_exceeded' | 'environment_connection_timeout' | 'runtime_unavailable' | 'model_request_failed' | 'model_configuration_rejected' | 'session_not_ready' | 'session_execution_unavailable' | 'session_configuration_unavailable' | 'session_snapshot_unavailable', required
    - `message` string, required
    - `action` string, required: Suggested next step, such as retry_later, inspect_history, create_new_session, check_model_account, or create_session_with_updated_model_provider.
    - `retryable` boolean
  - `row_version` integer, required
  - `required_actions` unknown[], required
    - unknown
  - `vault_ids` string[], required
  - `usage` object, nullable: Token usage; null until a turn reports usage.
  - `created_at` integer, required
  - `last_active_at` integer, required
  - `updated_at` integer, required
  - `archived_at` integer, nullable, required
  - `source` 'direct' | 'service' | 'schedule' | 'null', nullable
  - `source_id` string, nullable: Service or Schedule ID when source is service or schedule.
  - `source_failure_code` string

## Other responses

- `400`: invalid_request (malformed JSON, unknown fields, failed validation, an unsupported option, or stream=true without input)
- `401`: unauthorized: missing, malformed, or conflicting API key headers
- `402`: spending_limit_exceeded: API key spending limit or organization balance exhausted
- `403`: insufficient_scope (scoped key) or org_disabled
- `404`: not_found: the resource does not exist in this organization
- `409`: conflict: the Agent is archived or not ready, an MCP connection or Secret is not active, or Idempotency-Key reused with a different body
- `502`: executor_rejected or executor_contract_error from the execution layer
- `503`: authorization_unavailable, admission_unavailable, executor_unavailable, storage_unavailable, or internal_error

---

[API](https://skmtc.dev/sandbase/apis/sandbase-api.md) · [All operations](https://skmtc.dev/sandbase/apis/sandbase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sandbase/apis/sandbase-api/revisions/d40df2467ba2?raw)