---
title: "List sandboxes"
method: GET
path: "/sandboxes"
tags: ["Sandboxes"]
---

# List sandboxes

`GET /sandboxes`

Returns sandboxes owned by the caller, sorted by `created_at` descending.

## Query parameters

- `page` integer
- `limit` integer

## Response `200`

Paginated sandboxes

- PaginatedSandboxesEnvelope
  - `message` string, required
  - `data` PaginatedSandboxes, required
    - `data` Sandbox[], required
      - `id` string, required
      - `name` string, required
      - `template` string, required
      - `status` 'starting' | 'ready' | 'pausing' | 'paused' | 'resuming' | 'failed' | 'destroyed', required
      - `region` SandboxRegion, required
        - `id` string, required
        - `name` string, required
        - `country` string, required
        - `continent` string, required
        - `enabled` boolean, required — Whether the region is currently accepting new sandboxes.
        - `type` 'sandbox', required — Region kind. Sandbox endpoints only return sandbox-eligible regions.
      - `specs` SandboxSpecs, required
        - `cpu` integer — CPU shares in Nomad MHz units.
        - `memory` integer — Memory in MB.
        - `disk` integer — Ephemeral scratch disk in GB. Separate from persistent storage.
      - `team` string, nullable
      - `project_environment` string, nullable
      - `auto_destroy` boolean, required
      - `destroy_timeout` '30m' | '1h' | '3h' | '6h' | '12h' | '18h' | 'null', nullable
      - `one_shot` boolean, required
      - `block_outbound` boolean, required — Legacy mirror of egress policy. `true` when `egress.mode` is `deny_all`. Prefer reading `egress.mode` directly.
      - `egress` SandboxEgressConfig, required — Outbound network policy applied to the sandbox container.
        - `mode` 'open' | 'restricted' | 'deny_all', required — Outbound network policy for a sandbox. - `open` — full outbound internet access (default). - `deny_all` — all outbound connections blocked; inbound Brimble API calls still work. - `restricted` — default deny with an allowlist (`allow` required on update).
        - `allow` string[] — Allowlist for `restricted` mode. Each entry is an IPv4 address, CIDR range (e.g. `10.0.0.0/8`), or hostname (e.g. `api.example.com`). Required with at least one entry when updating to `restricted`; optional at create time.
      - `network_updated` boolean — Only present on `PUT /sandboxes/{id}/egress` responses. `true` when the sandbox was reattached to a different network profile as part of the update.
      - `persistent` boolean, required
      - `persistent_disk_gb` integer, nullable
      - `paused_at` string, date-time, nullable
      - `from_snapshot` string, nullable
      - `snapshot_mode` 'manual' | 'automatic'
      - `snapshot_frequency` string, nullable
      - `created_at` string, date-time, required
      - `last_activity_at` string, date-time, required
      - `expires_at` string, date-time, required
      - `destroyed_at` string, date-time, nullable
      - `destroy_reason` 'user' | 'idle_ttl' | 'max_lifetime' | 'one_shot_stopped' | 'failed' | 'paused_too_long'
    - `totalCount` integer, required
    - `currentPage` integer, required
    - `totalPages` integer, required
    - `limit` integer, required

## Other responses

- `400` — Validation error / invalid state transition

---

[API](https://skmtc.net/brimblehq/apis/brimble-sandbox-api.md) · [All operations](https://skmtc.net/brimblehq/apis/brimble-sandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/brimblehq/brimble-sandbox-api/versions/7fe2df041597/schema)