mounts

Mount an S3, R2 or Google Cloud Storage bucket at a path in a running sandbox.

The sandbox never holds the bucket's key: its mount client signs with a placeholder, and the egress proxy signs every request again with the key in your secret. The first mount in a sandbox installs rclone and fuse3, which takes a few seconds more. A mount lasts through a pause and a wake, and ends when the sandbox stops.

post/v1/sandboxes/{id}/mounts

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/sandboxes/{id}/mounts
  • Auth: HTTP bearer

Path parameters

idstring required

Resource identifier (UUID).

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

provider's3' | 'r2' | 'gcs' required

s3 for Amazon S3 (or any S3-compatible store with endpoint), r2 for Cloudflare R2, gcs for Google Cloud Storage through its S3-compatible XML API with HMAC keys.

bucketstring required

The bucket's name.

pathstring required

Where it appears in the sandbox, such as /data.

prefixstring

Mount only the keys under this prefix.

regionstring

The bucket's region; us-east-1 for S3 when omitted.

endpointstring

An https:// URL for any other S3-compatible store (MinIO, Backblaze B2...).

accountIdstring

For r2: your Cloudflare account id.

secretstring

The name of the secret holding ACCESS_KEY_ID:SECRET_KEY, stored with header Authorization and format "AWS4-HMAC-SHA256 {value}" for the endpoint's host. The sandbox never sees the key: the egress proxy signs each request. Omit for a public bucket.

readOnlyboolean

Mount it read-only.

Response

Success

pathstring required
providerstring
bucketstring required
prefixstring nullable
endpointstring
secretstring nullable
readOnlyboolean
mountedboolean required

Changes

No recorded changes to this operation across all 1 revision of this API.