---
title: "Upsert CLI connection"
method: POST
path: "/sandbox-clis/config"
tags: ["Sandbox CLIs"]
---

# Upsert CLI connection

`POST /sandbox-clis/config`

## Request

- Base URL: `https://api.sazabi.com/v1`
- URL: `https://api.sazabi.com/v1/sandbox-clis/config`
- Auth: none declared

Set or replace a project's CLI connection credentials (e.g. the kubectl CLI's KUBECONFIG_CONTENTS). The credentials are tested in a read-only ephemeral sandbox first unless `skipTest` is set: a failed test saves nothing and is refused with `reason: connection_test_failed`, and a passed test records the connection as verified in the same step. Values are encrypted server-side and never returned. Requires write access to the target project.

## Request body

- object
  - `projectId` string, uuid: Project to configure. Required for organization-scoped keys; auto-filled from a project-scoped key when omitted.
  - `cliType` string, required: CLI type identifier (e.g. kubectl, aws, github).
  - `environmentVariables` object[], required: Full set of env vars for this sandbox CLI. Replaces any previously stored values for the CLI.
    - `key` string, required: Environment variable name (e.g. KUBECONFIG_CONTENTS).
    - `value` string, required: Secret value. Encrypted at rest; never returned by any API response.
  - `skipTest` boolean: Save without running the connection test first. Nothing is confirmed, so the connection is not marked verified and an existing needs-attention status is kept.

## Response `200`

OK

- object
  - `projectId` string, uuid, required: Project the CLI connection was written to.
  - `id` string, uuid, required: Connection ID of the stored connection row.
  - `cliType` string, required: CLI type that was upserted.
  - `envVarKeys` string[], required: Env var key names now stored for this sandbox CLI. Values are never returned.
  - `connectionTest` 'passed' | 'skipped' | 'inconclusive', required: What the save learned about the stored credentials: `passed` (the connection test passed; the connection is verified when the CLI supports saved-credential checks), `skipped` (saved with `skipTest`), or `inconclusive` (the test sandbox could not run, so the credentials were saved untested).

## Changes

- **2026-10-11** `5f4a1feb193a`: 1 info
  - added the required property `id` to the response with the `200` status
- **2026-09-29** `752040c39373`: 2 info
  - added the new optional request property `skipTest`
  - added the required property `connectionTest` to the response with the `200` status

[Operation history](https://skmtc.dev/sazabi/apis/sazabi-public-api/changes/sandbox-clis/config/post.md)

---

[API](https://skmtc.dev/sazabi/apis/sazabi-public-api.md) - [All operations](https://skmtc.dev/sazabi/apis/sazabi-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sazabi/apis/sazabi-public-api/revisions/965b6230cf45?raw)