---
title: "Create a new sandbox"
method: POST
path: "/workspaces/{workspace_domain}/sandboxes"
tags: ["Sandbox API"]
---

# Create a new sandbox

`POST /workspaces/{workspace_domain}/sandboxes`

## Path parameters

- `workspace_domain` string, required

## Query parameters

- `project_name` string, required

## Request body

- union
  - CloneSandboxRequest
    - `source_sandbox_id` string, required — The ID of the sandbox to clone
    - `name` string, required — The name of the sandbox
    - `identifier` string — A human-readable ID. Alphanumeric characters, underscores, and hyphens (hyphens cannot appear at the start or end).
  - CreateFromSnapshotRequest
    - `snapshot_id` string, required — The ID of the snapshot to create from
    - `name` string, required — The name of the sandbox
    - `identifier` string — A human-readable ID. Alphanumeric characters, underscores, and hyphens (hyphens cannot appear at the start or end).
    - `os` string — The operating system of the sandbox ["ubuntu:22.04", "ubuntu:24.04"]
    - `resources` '1x2' | '2x4' | '3x6' | '4x8' | '5x10' | '6x12' | '7x14' | '8x16' | '9x18' | '10x20' | '11x22' | '12x24' | 'CUSTOM' — The resource configuration of the sandbox (CPU x RAM)
    - `first_boot_commands` string — The commands to run during first boot of the sandbox
    - `app_dir` string — The application directory of the sandbox
    - `apps` string[] — The list of apps (run commands) for the sandbox
    - `tags` string[] — The list of tags associated with the sandbox
    - `endpoints` TunnelView[] — The tunnel endpoints of the sandbox
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `name` string, required — The name of the tunnel
      - `endpoint` string, required — The endpoint URL of the tunnel
      - `type` 'TCP' | 'TLS' | 'HTTP' | 'SSH', required — The type of the tunnel
      - `region` 'US' | 'EU' | 'AS', required — The region where the tunnel is deployed
      - `whitelist` string[] — The IP addresses or domains allowed to access the tunnel
      - `timeout` integer — The connection timeout of the tunnel in seconds
      - `http` HttpSettingsView — The HTTP-specific settings of the tunnel
        - `url` string — API endpoint to GET this object
        - `html_url` string — Web URL to view this object in Buddy.works
        - `verify_certificate` boolean — Whether to verify SSL/TLS certificates
        - `compression` boolean — Enable HTTP compression
        - `http2` boolean — Enable HTTP/2 protocol support
        - `log_requests` boolean — Log incoming HTTP requests
        - `request_headers` object — Custom HTTP headers to add to requests
        - `whitelist_user_agents` string[] — List of allowed User-Agent strings
        - `rewrite_host_header` string — Rewrite the Host header to this value
        - `response_headers` object — Custom HTTP headers to add to responses
        - `login` string — Basic authentication username
        - `password` string — Basic authentication password
        - `tls_ca` string — Custom TLS Certificate Authority
        - `circuit_breaker` integer — Circuit breaker threshold (number of failed requests)
        - `serve_path` string — Base path for serving requests
        - `auth_type` 'NONE' | 'BASIC' | 'BUDDY' — Type of authentication used
      - `tls` TlsSettingsView — The TLS/SSL encryption settings of the tunnel
        - `url` string — API endpoint to GET this object
        - `html_url` string — Web URL to view this object in Buddy.works
        - `private_key` string — Private key for TLS certificate
        - `certificate` string — TLS certificate
        - `ca_certificate` string — Certificate Authority certificate
        - `terminate_at` 'REGION' | 'AGENT' | 'TARGET' — Where to terminate TLS connection
      - `endpoint_url` string — The url of the tunnel
      - `active` boolean — Whether the tunnel is connected to the edge (tunnel is established)
      - `target_latency` integer — Latency to the target in milliseconds. When >= 0 the target is reachable
    - `variables` EnvironmentVariableView[] — The environment variables of the sandbox
      - `id` integer — The ID of the variable
      - `key` string — The name of the variable
      - `value` string — The value of the variable
      - `type` 'VAR' | 'FILE' | 'SSH_KEY' | 'IOS_KEYCHAIN' | 'IOS_PROVISION_PROFILES' | 'SSH_PUBLIC_KEY' | 'GPG_KEY' — The type of the added variable
      - `encrypted` boolean — If set to `true` the variable value will be encrypted and hidden
      - `settable` boolean — If set to `true` the variable value can be set by Buddy actions
      - `run_only_settable` boolean — Available only if `type=VAR`. If set to `true` the variable value can be set by Buddy actions only for execution time
      - `init_path` string — Initial path for the variable
      - `defaults` string — Default value for the variable
      - `file_path` string — Specifies where to copy the file on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
      - `file_chmod` string — File permission set on copy to a container on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
      - `file_place` 'NONE' | 'CONTAINER' — Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`. If it's `NONE`, the variable can be used as a parameter in an action. For `CONTAINER`, the given key is additionally copied to an action container on each run
      - `binary` boolean — Whether the file is binary
      - `public_value` string — Public value for SSH key type variables
      - `key_fingerprint` string — Fingerprint of SSH key
      - `checksum` string — Checksum of the variable value
      - `password` string — Password for certificates
      - `passphrase` string — Passphrase for encrypted SSH keys
      - `key_identifier` string — Key identifier for iOS certificates, provisioning profiles, or GPG keys
      - `disabled` boolean — Set to `true` to disable the variable. Disabled variables are not injected anywhere
      - `note` string — Note for this resource
      - `agent_note` string — YAML note for AI agents operating on this resource
  - CreateNewSandboxRequest
    - `name` string, required — The name of the sandbox
    - `identifier` string — A human-readable ID. Alphanumeric characters, underscores, and hyphens (hyphens cannot appear at the start or end).
    - `os` string, required — The operating system of the sandbox ["ubuntu:22.04", "ubuntu:24.04"]
    - `resources` '1x2' | '2x4' | '3x6' | '4x8' | '5x10' | '6x12' | '7x14' | '8x16' | '9x18' | '10x20' | '11x22' | '12x24' | 'CUSTOM' — The resource configuration of the sandbox (CPU x RAM)
    - `first_boot_commands` string — The commands to run during first boot of the sandbox
    - `app_dir` string — The application directory of the sandbox
    - `apps` string[] — The list of apps (run commands) for the sandbox
    - `fetch` SandboxFetchView[] — The list of items (repositories and artifacts) to fetch into the sandbox
      - `type` 'PROJECT_REPO' | 'PUBLIC_REPO' | 'ARTIFACT' — The type of the fetch item: PROJECT_REPO, PUBLIC_REPO, or ARTIFACT
      - `repository` string — The URL of the git repository (for PUBLIC_REPO type)
      - `ref` string — The branch, tag, or commit to checkout. Defaults to the default branch
      - `path` string — The target path where the item will be cloned/downloaded. Defaults to the app directory
      - `build_command` string — The command to run after fetching
      - `artifact` string — The artifact identifier in format pkg:version (for ARTIFACT type)
    - `tags` string[] — The list of tags associated with the sandbox
    - `endpoints` TunnelView[] — The tunnel endpoints of the sandbox
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `name` string, required — The name of the tunnel
      - `endpoint` string, required — The endpoint URL of the tunnel
      - `type` 'TCP' | 'TLS' | 'HTTP' | 'SSH', required — The type of the tunnel
      - `region` 'US' | 'EU' | 'AS', required — The region where the tunnel is deployed
      - `whitelist` string[] — The IP addresses or domains allowed to access the tunnel
      - `timeout` integer — The connection timeout of the tunnel in seconds
      - `http` HttpSettingsView — The HTTP-specific settings of the tunnel
        - `url` string — API endpoint to GET this object
        - `html_url` string — Web URL to view this object in Buddy.works
        - `verify_certificate` boolean — Whether to verify SSL/TLS certificates
        - `compression` boolean — Enable HTTP compression
        - `http2` boolean — Enable HTTP/2 protocol support
        - `log_requests` boolean — Log incoming HTTP requests
        - `request_headers` object — Custom HTTP headers to add to requests
        - `whitelist_user_agents` string[] — List of allowed User-Agent strings
        - `rewrite_host_header` string — Rewrite the Host header to this value
        - `response_headers` object — Custom HTTP headers to add to responses
        - `login` string — Basic authentication username
        - `password` string — Basic authentication password
        - `tls_ca` string — Custom TLS Certificate Authority
        - `circuit_breaker` integer — Circuit breaker threshold (number of failed requests)
        - `serve_path` string — Base path for serving requests
        - `auth_type` 'NONE' | 'BASIC' | 'BUDDY' — Type of authentication used
      - `tls` TlsSettingsView — The TLS/SSL encryption settings of the tunnel
        - `url` string — API endpoint to GET this object
        - `html_url` string — Web URL to view this object in Buddy.works
        - `private_key` string — Private key for TLS certificate
        - `certificate` string — TLS certificate
        - `ca_certificate` string — Certificate Authority certificate
        - `terminate_at` 'REGION' | 'AGENT' | 'TARGET' — Where to terminate TLS connection
      - `endpoint_url` string — The url of the tunnel
      - `active` boolean — Whether the tunnel is connected to the edge (tunnel is established)
      - `target_latency` integer — Latency to the target in milliseconds. When >= 0 the target is reachable
    - `variables` AddVariableInObjectRequest[] — The environment variables of the sandbox
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `key` string, required — The name of the variable
      - `value` string — The value of the variable
      - `settable` boolean — If set to `true` the variable value can be set by Buddy actions
      - `run_only_settable` boolean — Available only if `type=VAR`. If set to `true` the variable value can be set by Buddy actions only for execution time
      - `encrypted` boolean — If set to `true` the variable value will be encrypted and hidden
      - `init_path` string — Initial path for the variable
      - `defaults` string — Default value for the variable
      - `file_path` string — Specifies where to copy the file on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
      - `file_chmod` string — File permission set on copy to a container on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
      - `file_place` 'NONE' | 'CONTAINER' — Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`. If it's `NONE`, the variable can be used as a parameter in an action. For `CONTAINER`, the given key is additionally copied to an action container on each run
      - `password` string — Password for certificates
      - `passphrase` string — Passphrase for encrypted SSH keys
      - `key_identifier` string — Key identifier for iOS certificates, provisioning profiles, or GPG keys
      - `disabled` boolean — Set to `true` to disable the variable. Disabled variables are not injected anywhere
      - `note` string — Note for this resource
      - `agent_note` string — YAML note for AI agents operating on this resource
      - `type` 'VAR' | 'FILE' | 'SSH_KEY' | 'IOS_KEYCHAIN' | 'IOS_PROVISION_PROFILES' | 'SSH_PUBLIC_KEY' | 'GPG_KEY', required — The type of the added variable
    - `timeout` integer — The timeout in seconds after which the sandbox will be automatically stopped
    - `permissions` PermissionsView — Access permissions configuration
      - `others` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — Access level for other workspace members
      - `users` UserPermissionView[] — List of specific users with their access levels
        - `id` integer — The ID of the user
        - `access_level` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — The access level for the user
      - `groups` GroupPermissionView[] — List of user groups with their access levels
        - `id` integer — The ID of the group
        - `access_level` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — The access level for the group
    - `note` string — Note for this resource
    - `agent_note` string — YAML note for AI agents operating on this resource

## Response `201`

- SandboxResponse
  - `url` string — API endpoint to GET this object
  - `html_url` string — Web URL to view this object in Buddy.works
  - `id` string — The ID of the sandbox
  - `identifier` string — A human-readable ID. Alphanumeric characters, underscores, and hyphens (hyphens cannot appear at the start or end).
  - `name` string — The name of the sandbox
  - `status` 'STARTING' | 'STOPPING' | 'FAILED' | 'RUNNING' | 'STOPPED' | 'RESTORING' — The current status of the sandbox
  - `setup_status` 'INPROGRESS' | 'SUCCESS' | 'FAILED' | 'STALE' — The current setup status of the sandbox
  - `os` string — The operating system of the sandbox ["ubuntu:22.04", "ubuntu:24.04"]
  - `resources` '1x2' | '2x4' | '3x6' | '4x8' | '5x10' | '6x12' | '7x14' | '8x16' | '9x18' | '10x20' | '11x22' | '12x24' | 'CUSTOM' — The resource configuration of the sandbox (CPU x RAM)
  - `first_boot_commands` string — The commands to run during first boot of the sandbox
  - `app_dir` string — The application directory of the sandbox
  - `apps` SandboxAppView[] — The list of apps (run commands) for the sandbox
    - `id` string — The auto-generated ID of the app
    - `command` string — The run command of the app
    - `app_status` 'NONE' | 'RUNNING' | 'ENDED' | 'FAILED' — The current status of the app
  - `fetch` SandboxFetchView[] — The list of items (repositories and artifacts) to fetch into the sandbox
    - `type` 'PROJECT_REPO' | 'PUBLIC_REPO' | 'ARTIFACT' — The type of the fetch item: PROJECT_REPO, PUBLIC_REPO, or ARTIFACT
    - `repository` string — The URL of the git repository (for PUBLIC_REPO type)
    - `ref` string — The branch, tag, or commit to checkout. Defaults to the default branch
    - `path` string — The target path where the item will be cloned/downloaded. Defaults to the app directory
    - `build_command` string — The command to run after fetching
    - `artifact` string — The artifact identifier in format pkg:version (for ARTIFACT type)
  - `timeout` integer — The timeout in seconds after which the sandbox will be automatically stopped
  - `tags` string[] — The list of tags associated with the sandbox
  - `boot_logs` string[] — The boot logs of the sandbox
  - `endpoints` TunnelView[] — The tunnel endpoints of the sandbox
    - `url` string — API endpoint to GET this object
    - `html_url` string — Web URL to view this object in Buddy.works
    - `name` string, required — The name of the tunnel
    - `endpoint` string, required — The endpoint URL of the tunnel
    - `type` 'TCP' | 'TLS' | 'HTTP' | 'SSH', required — The type of the tunnel
    - `region` 'US' | 'EU' | 'AS', required — The region where the tunnel is deployed
    - `whitelist` string[] — The IP addresses or domains allowed to access the tunnel
    - `timeout` integer — The connection timeout of the tunnel in seconds
    - `http` HttpSettingsView — The HTTP-specific settings of the tunnel
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `verify_certificate` boolean — Whether to verify SSL/TLS certificates
      - `compression` boolean — Enable HTTP compression
      - `http2` boolean — Enable HTTP/2 protocol support
      - `log_requests` boolean — Log incoming HTTP requests
      - `request_headers` object — Custom HTTP headers to add to requests
      - `whitelist_user_agents` string[] — List of allowed User-Agent strings
      - `rewrite_host_header` string — Rewrite the Host header to this value
      - `response_headers` object — Custom HTTP headers to add to responses
      - `login` string — Basic authentication username
      - `password` string — Basic authentication password
      - `tls_ca` string — Custom TLS Certificate Authority
      - `circuit_breaker` integer — Circuit breaker threshold (number of failed requests)
      - `serve_path` string — Base path for serving requests
      - `auth_type` 'NONE' | 'BASIC' | 'BUDDY' — Type of authentication used
    - `tls` TlsSettingsView — The TLS/SSL encryption settings of the tunnel
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `private_key` string — Private key for TLS certificate
      - `certificate` string — TLS certificate
      - `ca_certificate` string — Certificate Authority certificate
      - `terminate_at` 'REGION' | 'AGENT' | 'TARGET' — Where to terminate TLS connection
    - `endpoint_url` string — The url of the tunnel
    - `active` boolean — Whether the tunnel is connected to the edge (tunnel is established)
    - `target_latency` integer — Latency to the target in milliseconds. When >= 0 the target is reachable
  - `ssh_host` string — The SSH hostname
  - `ssh_port` integer — The SSH port
  - `project` ProjectView
    - `url` string — API endpoint to GET this object
    - `html_url` string — Web URL to view this object in Buddy.works
    - `name` string — The human-readable ID of the project
    - `display_name` string, required — The Name of the project
    - `status` string — The status of the project
    - `access` 'PRIVATE' | 'PUBLIC' — Indicates if this is a public project
    - `create_date` string, date-time — The creation date of the project
    - `external_project_id` string — Repo slug of the Bitbucket, GitHub or GitLab project. Required when adding the integrated project
    - `git_lab_project_id` integer — ID of the project in GitLab
    - `custom_repo_url` string — SSH or HTTPS url of the git repository. Required when adding the project integrated with custom git repository
    - `custom_repo_user` string — Username used to authorize access to the git repository. Required when adding the project integrated with custom git repository
    - `custom_repo_pass` string — Password used to authorize access to the git repository. Required when adding the project integrated with custom git repository and the provided `custom_repo_url` is the HTTPS url
    - `custom_repo_ssh_key_id` integer — The ID of the private SSH key used to authorize access to the git repository. Required when adding the project integrated with private git server by SSH url
    - `created_by` MemberView — User/member reference
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `id` integer — The ID of the user
      - `name` string — The name of the user
      - `avatar_url` string — The avatar URL of the user
      - `email` string — The email address of the user
      - `admin` boolean — Whether the user has admin privileges
      - `workspace_owner` boolean — Whether the user is workspace owner
    - `http_repository` string — The HTTP repository URL
    - `ssh_repository` string — The SSH repository URL
    - `default_branch` string — The default branch name
    - `integration` IntegrationIdView — Integration reference
      - `url` string — API endpoint to GET this object
      - `html_url` string — Web URL to view this object in Buddy.works
      - `identifier` string — A human-readable ID of the integration
      - `hash_id` string — The unique hash ID of the integration
      - `name` string — The name of the integration
      - `type` 'GIT_HUB' | 'BITBUCKET' | 'GOOGLE' | 'DIGITAL_OCEAN' | 'SLACK' | 'MODULUS' | 'HEROKU' | 'AMAZON' | 'GIT_LAB' | 'SHOPIFY' | 'GIT_HUB_ENTERPRISE' | 'GIT_LAB_ENTERPRISE' | 'PUSHOVER' | 'PUSHBULLET' | 'RACKSPACE' | 'CUSTOM' | 'CLOUDFLARE' | 'NEW_RELIC' | 'SENTRY' | 'ROLLBAR' | 'DATADOG' | 'DO_SPACES' | 'HONEYBADGER' | 'VULTR' | 'SENTRY_ENTERPRISE' | 'LOGGLY' | 'HIP_CHAT' | 'FIREBASE' | 'TELEGRAM' | 'AZURE' | 'UPCLOUD' | 'GHOST_INSPECTOR' | 'NETLIFY' | 'AZURE_CLOUD' | 'MICROSOFT_TEAMS' | 'GOOGLE_SERVICE_ACCOUNT' | 'GOOGLE_PLAY_STORE' | 'DOCKER_HUB' | 'APP_STORE' | 'GIT_HUB_APP' | 'GIT_HUB_APP_ENTERPRISE' | 'GIT_HUB_API' | 'ATOP' | 'SNYK' | 'STACK_HAWK' | 'BLACKFIRE' | 'BACKBLAZE' | 'ONE_LOGIN' | 'OKTA' | 'CONTENTFUL' | 'JIRA' | 'NPM_REGISTRY' | 'ANTHROPIC' | 'GOOGLE_GEMINI' — The type of integration
      - `auth_type` 'OAUTH' | 'TOKEN' | 'API_KEY' | 'APP' | 'APP_SPRYKER' | 'TOKEN_APP_EXTENSION' | 'DEFAULT' | 'OIDC' | 'TRUSTED' | 'APP_RW' — The authentication method used by the integration
      - `host_url` string — The host URL for custom integrations
      - `webhook_address` string — The webhook URL for receiving notifications
      - `atop_url` string — The ATOP service URL
      - `app_id` string — The application ID for Azure Cloud integrations
      - `google_project` string — The Google Cloud project ID
      - `audience` string — The JWT audience for token validation
    - `fetch_submodules` boolean — Defines whether the submodules are fetched during the runs in this project
    - `fetch_submodules_env_key` string — Name of the key that will be used to authorize while fetching the submodules. Required when `fetch_submodules` is set to `true`
    - `allow_pull_requests` boolean — Enables/disables pull requests in the project. Available only for projects synchronized with GitHub or GitHub Enterprise repository
    - `update_default_branch_from_external` boolean — If set to true, the default branch will be updated from GitHub/GitLab/Bitbucket.
    - `without_repository` boolean — If set to true, the project is created without any repository attached.
  - `permissions` PermissionsView — Access permissions configuration
    - `others` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — Access level for other workspace members
    - `users` UserPermissionView[] — List of specific users with their access levels
      - `id` integer — The ID of the user
      - `access_level` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — The access level for the user
    - `groups` GroupPermissionView[] — List of user groups with their access levels
      - `id` integer — The ID of the group
      - `access_level` 'DENIED' | 'READ_ONLY' | 'USE_ONLY' | 'BLIND' | 'RUN_ONLY' | 'READ_WRITE' | 'MANAGE' | 'DEFAULT' | 'ALLOWED' | 'STAGE' | 'COMMIT' — The access level for the group
  - `note` string — Note for this resource
  - `agent_note` string — YAML note for AI agents operating on this resource
  - `variables` EnvironmentVariableView[] — The environment variables of the sandbox
    - `id` integer — The ID of the variable
    - `key` string — The name of the variable
    - `value` string — The value of the variable
    - `type` 'VAR' | 'FILE' | 'SSH_KEY' | 'IOS_KEYCHAIN' | 'IOS_PROVISION_PROFILES' | 'SSH_PUBLIC_KEY' | 'GPG_KEY' — The type of the added variable
    - `encrypted` boolean — If set to `true` the variable value will be encrypted and hidden
    - `settable` boolean — If set to `true` the variable value can be set by Buddy actions
    - `run_only_settable` boolean — Available only if `type=VAR`. If set to `true` the variable value can be set by Buddy actions only for execution time
    - `init_path` string — Initial path for the variable
    - `defaults` string — Default value for the variable
    - `file_path` string — Specifies where to copy the file on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
    - `file_chmod` string — File permission set on copy to a container on each run. Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`
    - `file_place` 'NONE' | 'CONTAINER' — Set if `type` is `FILE`, `SSH_KEY`, `SSH_PUBLIC_KEY`, `IOS_KEYCHAIN`, or `IOS_PROVISION_PROFILES`. If it's `NONE`, the variable can be used as a parameter in an action. For `CONTAINER`, the given key is additionally copied to an action container on each run
    - `binary` boolean — Whether the file is binary
    - `public_value` string — Public value for SSH key type variables
    - `key_fingerprint` string — Fingerprint of SSH key
    - `checksum` string — Checksum of the variable value
    - `password` string — Password for certificates
    - `passphrase` string — Passphrase for encrypted SSH keys
    - `key_identifier` string — Key identifier for iOS certificates, provisioning profiles, or GPG keys
    - `disabled` boolean — Set to `true` to disable the variable. Disabled variables are not injected anywhere
    - `note` string — Note for this resource
    - `agent_note` string — YAML note for AI agents operating on this resource

---

[API](https://skmtc.net/buddy/apis/buddy-api.md) · [All operations](https://skmtc.net/buddy/apis/buddy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/buddy/buddy-api/revisions/2426d67c249a/schema)