---
title: "Mount an S3, R2 or Google Cloud Storage bucket at a path in a running sandbox."
method: POST
path: "/v1/sandboxes/{id}/mounts"
tags: ["mounts"]
---

# Mount an S3, R2 or Google Cloud Storage bucket at a path in a running sandbox.

`POST /v1/sandboxes/{id}/mounts`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/sandboxes/{id}/mounts`
- Auth: HTTP bearer

The sandbox never holds the bucket's key: its mount client signs with a placeholder, and the egress proxy signs every request again with the key in your secret. The first mount in a sandbox installs rclone and fuse3, which takes a few seconds more. A mount lasts through a pause and a wake, and ends when the sandbox stops.

## Path parameters

- `id` string, required: Resource identifier (UUID).

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `provider` 's3' | 'r2' | 'gcs', required: s3 for Amazon S3 (or any S3-compatible store with endpoint), r2 for Cloudflare R2, gcs for Google Cloud Storage through its S3-compatible XML API with HMAC keys.
  - `bucket` string, required: The bucket's name.
  - `path` string, required: Where it appears in the sandbox, such as /data.
  - `prefix` string: Mount only the keys under this prefix.
  - `region` string: The bucket's region; us-east-1 for S3 when omitted.
  - `endpoint` string: An https:// URL for any other S3-compatible store (MinIO, Backblaze B2...).
  - `accountId` string: For r2: your Cloudflare account id.
  - `secret` string: The name of the secret holding ACCESS_KEY_ID:SECRET_KEY, stored with header Authorization and format "AWS4-HMAC-SHA256 {value}" for the endpoint's host. The sandbox never sees the key: the egress proxy signs each request. Omit for a public bucket.
  - `readOnly` boolean: Mount it read-only.

## Response `200`

Success

- object
  - `path` string, required
  - `provider` string
  - `bucket` string, required
  - `prefix` string, nullable
  - `endpoint` string
  - `secret` string, nullable
  - `readOnly` boolean
  - `mounted` boolean, required

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)