> ## Documentation Index
> Fetch the complete documentation index at: https://paper.brimble.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a sandbox

Returns the full sandbox record, including its current network egress policy.

## Network egress (response fields)

| Field            | Type                                       | Description                                                              |
| ---------------- | ------------------------------------------ | ------------------------------------------------------------------------ |
| `egress.mode`    | `"open"` \| `"restricted"` \| `"deny_all"` | Current outbound network policy.                                         |
| `egress.allow`   | `string[]`                                 | Allowlist entries when mode is `restricted`. Omitted or empty otherwise. |
| `block_outbound` | `boolean`                                  | Legacy mirror of policy. `true` when `egress.mode` is `deny_all`.        |

Update policy at runtime with [Update sandbox egress](/api-reference/sandboxes/egress-update).


## OpenAPI

````yaml GET /sandboxes/{id}
openapi: 3.0.3
info:
  title: Brimble Sandbox API
  description: >
    REST API for managing Brimble sandboxes, ephemeral compute environments with

    optional persistent storage. Covers lifecycle (create / pause / resume /
    destroy),

    egress policy, runtime operations (exec, runCode, file upload/download),

    observability (logs, stats), and snapshots.


    ## Conventions


    - **Response envelope:** non-`204` JSON responses use `{ "message": string,
    "data"?: <payload> }`.
      The schemas below describe the **`data`** payload only.
    - **Errors:** every non-2xx response uses `{ "message": string }`. The
    message is
      user-facing.
    - **Async transitions:** pause / resume / destroy return immediately;
      the status change is visible on the next `GET` or in the dashboard.
      **Create is synchronous** — `POST /sandboxes` blocks until `status` is `ready`.
    - **IDs:** every `id` is a 24-char hex string.
  version: 1.0.0
  contact:
    name: Brimble Engineering
    url: https://brimble.io
servers:
  - url: https://sandbox.brimble.io
    description: Production
security:
  - brimbleKey: []
tags:
  - name: Sandboxes
    description: Lifecycle and metadata
  - name: Runtime
    description: Exec, code, files
  - name: Observability
    description: Logs and stats
  - name: Snapshots
    description: Manual & automatic snapshots
  - name: Volumes
    description: >-
      Persistent disks, pre-provisioned independently of sandbox lifecycle, then
      attached to a sandbox or project
paths:
  /sandboxes/{id}:
    get:
      tags:
        - Sandboxes
      summary: Get a sandbox
      operationId: getSandbox
      parameters:
        - $ref: '#/components/parameters/SandboxIdParam'
      responses:
        '200':
          description: Sandbox detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SandboxEnvelope'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    SandboxIdParam:
      in: path
      name: id
      required: true
      schema:
        type: string
        pattern: ^[a-f0-9]{24}$
      description: 24-char hex id of the sandbox.
  schemas:
    SandboxEnvelope:
      type: object
      required:
        - message
        - data
      properties:
        message:
          type: string
          example: Sandbox fetched
        data:
          $ref: '#/components/schemas/Sandbox'
    Sandbox:
      type: object
      required:
        - id
        - name
        - template
        - status
        - region
        - specs
        - auto_destroy
        - one_shot
        - block_outbound
        - egress
        - persistent
        - created_at
        - last_activity_at
        - expires_at
      properties:
        id:
          type: string
        name:
          type: string
        template:
          type: string
        status:
          $ref: '#/components/schemas/SandboxStatus'
        region:
          $ref: '#/components/schemas/SandboxRegion'
        specs:
          $ref: '#/components/schemas/SandboxSpecs'
        team:
          type: string
          nullable: true
        project_environment:
          type: string
          nullable: true
        auto_destroy:
          type: boolean
        destroy_timeout:
          type: string
          nullable: true
          enum:
            - 30m
            - 1h
            - 3h
            - 6h
            - 12h
            - 18h
            - null
        one_shot:
          type: boolean
        block_outbound:
          type: boolean
          description: >
            Legacy mirror of egress policy. `true` when `egress.mode` is
            `deny_all`.

            Prefer reading `egress.mode` directly.
        egress:
          $ref: '#/components/schemas/SandboxEgressConfig'
        network_updated:
          type: boolean
          description: >
            Only present on `PUT /sandboxes/{id}/egress` responses. `true` when
            the

            sandbox was reattached to a different network profile as part of the
            update.
        persistent:
          type: boolean
        persistent_disk_gb:
          type: integer
          nullable: true
        paused_at:
          type: string
          format: date-time
          nullable: true
        from_snapshot:
          type: string
          nullable: true
        snapshot_mode:
          type: string
          enum:
            - manual
            - automatic
        snapshot_frequency:
          type: string
          nullable: true
        created_at:
          type: string
          format: date-time
        last_activity_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
        destroyed_at:
          type: string
          format: date-time
          nullable: true
        destroy_reason:
          allOf:
            - $ref: '#/components/schemas/DestroyReason'
          nullable: true
    ErrorResponse:
      type: object
      required:
        - message
      properties:
        message:
          type: string
          description: Human-readable, user-facing error reason.
    SandboxStatus:
      type: string
      enum:
        - starting
        - ready
        - pausing
        - paused
        - resuming
        - failed
        - destroyed
    SandboxRegion:
      type: object
      required:
        - id
        - name
        - country
        - continent
        - enabled
        - type
      properties:
        id:
          type: string
          example: 6a06df21cc6bef51342e199e
        name:
          type: string
          example: eu-west
        country:
          type: string
          example: France
        continent:
          type: string
          example: Europe
        enabled:
          type: boolean
          description: Whether the region is currently accepting new sandboxes.
        type:
          type: string
          enum:
            - sandbox
          description: Region kind. Sandbox endpoints only return sandbox-eligible regions.
    SandboxSpecs:
      type: object
      properties:
        cpu:
          type: integer
          minimum: 1
          maximum: 2000
          description: CPU shares in Nomad MHz units.
        memory:
          type: integer
          minimum: 1
          maximum: 2048
          description: Memory in MB.
        disk:
          type: integer
          minimum: 1
          maximum: 5
          description: Ephemeral scratch disk in GB. Separate from persistent storage.
    SandboxEgressConfig:
      type: object
      required:
        - mode
      description: Outbound network policy applied to the sandbox container.
      properties:
        mode:
          $ref: '#/components/schemas/SandboxEgressMode'
        allow:
          type: array
          maxItems: 50
          items:
            type: string
            minLength: 1
            maxLength: 253
          description: >
            Allowlist for `restricted` mode. Each entry is an IPv4 address, CIDR
            range

            (e.g. `10.0.0.0/8`), or hostname (e.g. `api.example.com`). Required
            with at

            least one entry when updating to `restricted`; optional at create
            time.
          example:
            - 1.1.1.1
            - api.example.com
      example:
        mode: restricted
        allow:
          - 1.1.1.1
          - api.example.com
    DestroyReason:
      type: string
      enum:
        - user
        - idle_ttl
        - max_lifetime
        - one_shot_stopped
        - failed
        - paused_too_long
    SandboxEgressMode:
      type: string
      enum:
        - open
        - restricted
        - deny_all
      description: >
        Outbound network policy for a sandbox.


        - `open` — full outbound internet access (default).

        - `deny_all` — all outbound connections blocked; inbound Brimble API
        calls still work.

        - `restricted` — default deny with an allowlist (`allow` required on
        update).
  responses:
    BadRequest:
      description: Validation error / invalid state transition
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            invalidId:
              summary: Invalid sandbox id
              value:
                message: Invalid sandbox id
            statusTransition:
              summary: Wrong status
              value:
                message: Sandbox is paused; only ready sandboxes can be paused
            fileNotDir:
              summary: Parent dir missing on upload
              value:
                message: 'Destination directory does not exist: /work'
            duplicateVolumeName:
              summary: Duplicate volume name
              value:
                message: A volume named "node-cache" already exists
            volumeAttached:
              summary: Delete attempted on attached volume
              value:
                message: Volume is attached; detach it before deleting
    NotFound:
      description: >-
        Sandbox or related resource not found (also returned when owned by
        another user)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            sandboxNotFound:
              value:
                message: Sandbox not found
            snapshotNotFound:
              value:
                message: Snapshot not found
            volumeNotFound:
              value:
                message: Volume not found
  securitySchemes:
    brimbleKey:
      type: apiKey
      in: header
      name: x-brimble-key
      description: |
        Your account-level Brimble API key. Find it in the dashboard under
        your profile drawer → **API key** (click the avatar in the sidebar).
        Available on paid plans only.

````