---
title: "Share a port of a sandbox at a public HTTPS address."
method: POST
path: "/v1/sandboxes/{id}/previews"
tags: ["previews"]
---

# Share a port of a sandbox at a public HTTPS address.

`POST /v1/sandboxes/{id}/previews`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/sandboxes/{id}/previews`
- Auth: HTTP bearer

Creates the preview for this port, or changes its visibility and embedOrigins if it exists (so a retry is harmless). Returns the URL and, for a private preview, a signed token. WebSockets are supported. The server must listen on 0.0.0.0 or localhost inside the sandbox. embedOrigins limits which sites may show it in an iframe.

## Path parameters

- `id` string, required: Resource identifier (UUID).

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `port` integer, required: The port inside the sandbox.
  - `visibility` 'private' | 'public': private (default): a token is needed. public: anyone with the address; only for an account with a kept top-up.
  - `ttlSeconds` integer: The token's lifetime in seconds.
  - `expiresAt` string, date-time: An absolute private-token deadline, at least a minute and at most a week ahead. The token never outlives it.
  - `embedOrigins` string[], nullable: The sites that may show this preview in an iframe, as origins: https://app.example.com, https://*.example.com for its subdomains, or http://localhost:3000. Up to 16. Any other site's iframe is refused, and a private link's token works in an iframe only on these. Omitted on a preview that exists: kept as it is. [] or null: any site (the default).

## Response `200`

Success

- object
  - `id` string
  - `sandboxId` string
  - `port` integer
  - `visibility` string
  - `url` string: The address. A private preview also needs the token.
  - `token` string, nullable: Private previews: a token signed for this answer. Every create and read signs its own, each with its own tokenExpiresAt (a day unless ttlSeconds or expiresAt asks otherwise); tokens signed before keep working until their own expiry or a rotate. Null for a key that cannot run commands in the sandbox, such as a read-only key.
  - `tokenExpiresAt` string, date-time, nullable: When this answer's token stops working. It is not stored on the preview: another read signs another token with its own expiry, and does not shorten or extend this one.
  - `urlWithToken` string, nullable: Private previews: a link that carries the token once, for a browser.
  - `disabled` boolean: Turned off by Runtime after a report. Contact support.
  - `embedOrigins` string[], nullable: The sites that may show it in an iframe; null for any site.
  - `createdAt` string, date-time
  - `hint` string: How to share it, in one line.

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)