---
title: "Get a sandbox"
method: GET
path: "/sandboxes/{id}"
tags: ["Sandboxes"]
---

# Get a sandbox

`GET /sandboxes/{id}`

## Path parameters

- `id` string, required

## Response `200`

Sandbox detail

- SandboxEnvelope
  - `message` string, required
  - `data` Sandbox, required
    - `id` string, required
    - `name` string, required
    - `template` string, required
    - `status` 'starting' | 'ready' | 'pausing' | 'paused' | 'resuming' | 'failed' | 'destroyed', required
    - `region` SandboxRegion, required
      - `id` string, required
      - `name` string, required
      - `country` string, required
      - `continent` string, required
      - `enabled` boolean, required — Whether the region is currently accepting new sandboxes.
      - `type` 'sandbox', required — Region kind. Sandbox endpoints only return sandbox-eligible regions.
    - `specs` SandboxSpecs, required
      - `cpu` integer — CPU shares in Nomad MHz units.
      - `memory` integer — Memory in MB.
      - `disk` integer — Ephemeral scratch disk in GB. Separate from persistent storage.
    - `team` string, nullable
    - `project_environment` string, nullable
    - `auto_destroy` boolean, required
    - `destroy_timeout` '30m' | '1h' | '3h' | '6h' | '12h' | '18h' | 'null', nullable
    - `one_shot` boolean, required
    - `block_outbound` boolean, required — Legacy mirror of egress policy. `true` when `egress.mode` is `deny_all`. Prefer reading `egress.mode` directly.
    - `egress` SandboxEgressConfig, required — Outbound network policy applied to the sandbox container.
      - `mode` 'open' | 'restricted' | 'deny_all', required — Outbound network policy for a sandbox. - `open` — full outbound internet access (default). - `deny_all` — all outbound connections blocked; inbound Brimble API calls still work. - `restricted` — default deny with an allowlist (`allow` required on update).
      - `allow` string[] — Allowlist for `restricted` mode. Each entry is an IPv4 address, CIDR range (e.g. `10.0.0.0/8`), or hostname (e.g. `api.example.com`). Required with at least one entry when updating to `restricted`; optional at create time.
    - `network_updated` boolean — Only present on `PUT /sandboxes/{id}/egress` responses. `true` when the sandbox was reattached to a different network profile as part of the update.
    - `persistent` boolean, required
    - `persistent_disk_gb` integer, nullable
    - `paused_at` string, date-time, nullable
    - `from_snapshot` string, nullable
    - `snapshot_mode` 'manual' | 'automatic'
    - `snapshot_frequency` string, nullable
    - `created_at` string, date-time, required
    - `last_activity_at` string, date-time, required
    - `expires_at` string, date-time, required
    - `destroyed_at` string, date-time, nullable
    - `destroy_reason` 'user' | 'idle_ttl' | 'max_lifetime' | 'one_shot_stopped' | 'failed' | 'paused_too_long'

## Other responses

- `400` — Validation error / invalid state transition
- `404` — Sandbox or related resource not found (also returned when owned by another user)

---

[API](https://skmtc.net/brimblehq/apis/brimble-sandbox-api.md) · [All operations](https://skmtc.net/brimblehq/apis/brimble-sandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/brimblehq/brimble-sandbox-api/versions/7fe2df041597/schema)