Sandbox API

Admin

Credential plane administration

Credential plane administration

Every request needs a credential — see Authentication.

MethodPathSummary
GET/sandbox/v1/admin/credential-plane/keysAdmin: list provider key ids (no key material)
POST/sandbox/v1/admin/credential-plane/keysAdmin: append LLM provider key (credential plane multi-key pool)
DELETE/sandbox/v1/admin/credential-plane/keys/{key_id}Admin: deactivate a provider key in the pool
POST/sandbox/v1/admin/credential-plane/keys/{key_id}/rotateAdmin: rotate a specific provider key in the pool
POST/sandbox/v1/admin/credential-plane/teamsAdmin: create team (credential plane)
POST/sandbox/v1/admin/keyhive/keysAdmin: add LLM provider key (legacy path; proxies credential plane)
POST/sandbox/v1/admin/keyhive/teamsAdmin: create team (legacy path; proxies credential plane)
DELETE/sandbox/v1/admin/quotas/{tenant}/{project}Admin: delete a tenant/project concurrency quota
GET/sandbox/v1/admin/quotas/{tenant}/{project}Admin: inspect a tenant/project concurrency quota
PUT/sandbox/v1/admin/quotas/{tenant}/{project}Admin: create or replace a tenant/project concurrency quota

Common headers

Accepted on every endpoint on this page.

NameInTypeRequiredDescription
x-correlation-idheaderstringnoEnd-to-end correlation id for this eval run. When set, the gateway and downstream services honor it verbatim in logs, Cloud Trace span attributes, async job payloads, and Langfuse trace.id. When omitted, the gateway generates a ULID and echoes it on the response.

Endpoints

Admin: list provider key ids (no key material)

GET /sandbox/v1/admin/credential-plane/keys

Parameters

NameInTypeRequiredDescription
namespacequerystringyes

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: append LLM provider key (credential plane multi-key pool)

POST /sandbox/v1/admin/credential-plane/keys

Request body

application/json, required

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: deactivate a provider key in the pool

DELETE /sandbox/v1/admin/credential-plane/keys/{key_id}

Parameters

NameInTypeRequiredDescription
key_idpathstringyes

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: rotate a specific provider key in the pool

POST /sandbox/v1/admin/credential-plane/keys/{key_id}/rotate

Parameters

NameInTypeRequiredDescription
key_idpathstringyes

Request body

application/json, required

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: create team (credential plane)

POST /sandbox/v1/admin/credential-plane/teams

Request body

application/json, required

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: add LLM provider key (legacy path; proxies credential plane)

POST /sandbox/v1/admin/keyhive/keys

Request body

application/json, required

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: create team (legacy path; proxies credential plane)

POST /sandbox/v1/admin/keyhive/teams

Request body

application/json, required

Responses

StatusDescriptionBody
200Successful Responseobject
422Validation ErrorHTTPValidationError

Admin: delete a tenant/project concurrency quota

DELETE /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

NameInTypeRequiredDescription
tenantpathstringyes
projectpathstringyes

Responses

StatusDescriptionBody
200Successful Responseany
422Validation ErrorHTTPValidationError

Admin: inspect a tenant/project concurrency quota

GET /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

NameInTypeRequiredDescription
tenantpathstringyes
projectpathstringyes

Responses

StatusDescriptionBody
200Successful Responseany
422Validation ErrorHTTPValidationError

Admin: create or replace a tenant/project concurrency quota

PUT /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

NameInTypeRequiredDescription
tenantpathstringyes
projectpathstringyes

Request body

application/json, required — QuotaPolicyRequest

FieldTypeRequiredDescription
max_concurrentintegeryes

Responses

StatusDescriptionBody
200Successful Responseany
422Validation ErrorHTTPValidationError

Schemas

The object shapes referenced above.

HTTPValidationError

FieldTypeRequiredDescription
detailValidationError[]no

QuotaPolicyRequest

Admin request to set one project or tenant-default concurrency limit.

FieldTypeRequiredDescription
max_concurrentintegeryes

ValidationError

FieldTypeRequiredDescription
locstring | integer[]yes
msgstringyes
typestringyes
inputanyno
ctxobjectno

Machine-readable spec: OpenAPI YAML.

Sandboxes

Sandboxes API endpoints

Harbor (compatibility)

Older Harbor paths, still supported for existing callers. `/v1` returns TerminalBench-shaped fields, and paths without a version resolve to `/v1`. Same operations as Harbor otherwise — prefer `/v2` when you can choose.

On this page

Common headersEndpointsAdmin: list provider key ids (no key material)ParametersResponsesAdmin: append LLM provider key (credential plane multi-key pool)Request bodyResponsesAdmin: deactivate a provider key in the poolParametersResponsesAdmin: rotate a specific provider key in the poolParametersRequest bodyResponsesAdmin: create team (credential plane)Request bodyResponsesAdmin: add LLM provider key (legacy path; proxies credential plane)Request bodyResponsesAdmin: create team (legacy path; proxies credential plane)Request bodyResponsesAdmin: delete a tenant/project concurrency quotaParametersResponsesAdmin: inspect a tenant/project concurrency quotaParametersResponsesAdmin: create or replace a tenant/project concurrency quotaParametersRequest bodyResponsesSchemasHTTPValidationErrorQuotaPolicyRequestValidationError