# Sandbox URL: https://docs.hanzo.ai/docs/openapi/sandbox > The ONE compute primitive: a sandbox is a gVisor pod that runs somebody else's code, and every lifetime is the same object. Also for this capability: **API** · [CLI](https://docs.hanzo.ai/docs/cli/sandbox) · [MCP](https://docs.hanzo.ai/docs/mcp-tools/sandbox) · [SDKs](https://docs.hanzo.ai/docs/sdks) The ONE compute primitive: a sandbox is a gVisor pod that runs somebody else's code, and every lifetime is the same object. > [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | -------------- | -------------------------------------- | | **Base URL** | `https://api.hanzo.ai` | | **Operations** | 23 | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | ## Specification Specification pending — no HIP in [hanzoai/hips](https://github.com/hanzoai/hips) declares `capability: sandbox` yet. What this capability serves is below, from the API document; what it is — the store it owns, how it meters, what it publishes — is written as a HIP under HIP-0139. ## Four surfaces | Surface | Reaches this capability as | Coverage | | -------- | ----------------------------------------------- | -------------------------------------------------------------------------- | | **REST** | `sandbox` at its own prefix | 23 operations | | **CLI** | `hanzo sandbox …` | 21 of 23 — the CLI pins the document on its own clock | | **SDK** | `SandboxApi` in every published client | 23 methods | | **MCP** | tool `sandbox` on `https://api.hanzo.ai/v1/mcp` | 17 operations, 7 under the document's own id — ask `describe` for the rest | ## Quickstart ```bash export HANZO_API_KEY=sk-... # console.hanzo.ai → API keys ``` Then the first call — a read that needs nothing but the key. `GET /v1/sandbox`, operation `get_sandbox`: **CLI** ```bash hanzo sandbox list ``` **SDK** **.ts** ```ts import { Configuration, SandboxApi } from 'hanzoai'; const api = new SandboxApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getSandbox(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import SandboxApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = SandboxApi(client).get_sandbox() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.SandboxAPI.GetSandbox(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, sandbox_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = sandbox_api::get_sandbox(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.SandboxApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new SandboxApi(client).getSandbox(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/sandbox \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **sandbox** through the `sandbox` tool, which names its 17 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_sandboxes" } } }' ``` Answers `200` with `object` — ok. ## Endpoints | Endpoint | What it does | | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`POST /v1/sandbox/{id}/exec`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-exec) | Runs one command in a sandbox the caller holds and answers with its exit code, stdout and stderr. | | [`GET /v1/sandbox/{id}/fs`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-fs) | Read a file, or list a directory | | [`POST /v1/sandbox/{id}/fs`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-fs) | Write a file | | [`POST /v1/sandbox/{id}/pause`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-pause) | Stops the pod, keeps the row and the volume, and settles the tail: POST /v1/sandbox/:id/pause. | | [`GET /v1/sandbox/{id}/ports`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-ports) | Lists the TCP ports something listens on in a sandbox the caller holds, each with the preview host that serves it — what the sandbox's Browser can open. | | [`POST /v1/sandbox/{id}/preview`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-preview) | Opens a port of a sandbox the caller holds in a browser. | | [`POST /v1/sandbox/{id}/resume`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-resume) | Gives a parked sandbox a pod again: POST /v1/sandbox/:id/resume. | | [`POST /v1/sandbox/{id}/screen/ticket`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-screen-ticket) | Mints a short-lived grant to open the screen of a desktop sandbox. | | [`GET /v1/sandbox/{id}/screen/ws`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-screen-ws) | The screen, as a socket | | [`GET /v1/sandbox/{id}/screen`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-screen) | The screen, as a page | | [`POST /v1/sandbox/{id}/terminal/ticket`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox-by-id-terminal-ticket) | Mints a short-lived grant to open a terminal on a sandbox. | | [`GET /v1/sandbox/{id}/terminal/ws`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-terminal-ws) | The terminal, as a socket | | [`GET /v1/sandbox/{id}/terminal`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id-terminal) | The terminal, as a page | | [`GET /v1/sandbox/{id}`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox-by-id) | Returns one sandbox: its class, project, image, the runtime it was given, its status and when its lease ends. | | [`DELETE /v1/sandbox/{id}`](https://docs.hanzo.ai/docs/openapi/sandbox/delete-sandbox-by-id) | Ends a sandbox and releases the compute behind it. | | [`POST /v1/sandbox/end`](https://docs.hanzo.ai/docs/openapi/sandbox/end-sandbox) | End a sandbox and release it | | [`POST /v1/sandbox/lease`](https://docs.hanzo.ai/docs/openapi/sandbox/lease-sandbox) | Lease a sandbox — a real computer — or resume one you hold | | [`POST /v1/sandbox/read`](https://docs.hanzo.ai/docs/openapi/sandbox/read-sandbox-file) | Read a file from a sandbox you hold | | [`POST /v1/sandbox/run`](https://docs.hanzo.ai/docs/openapi/sandbox/run-in-sandbox) | Run a command in a sandbox you hold and read its output | | [`POST /v1/sandbox/stop`](https://docs.hanzo.ai/docs/openapi/sandbox/stop-run) | Stop what a sandbox is running, and keep the sandbox | | [`POST /v1/sandbox/write`](https://docs.hanzo.ai/docs/openapi/sandbox/write-sandbox-file) | Write a file into a sandbox you hold | | [`GET /v1/sandbox`](https://docs.hanzo.ai/docs/openapi/sandbox/get-sandbox) | Lists the sandboxes the caller holds, newest first. | | [`POST /v1/sandbox`](https://docs.hanzo.ai/docs/openapi/sandbox/post-sandbox) | Leases a sandbox — a real computer — for the caller's org. | --- [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)