---
title: "Create a sandbox image"
method: POST
path: "/projects/{projectId}/images"
tags: ["Sandbox images"]
---

# Create a sandbox image

`POST /projects/{projectId}/images`

Create a personal-draft sandbox image from a blueprint and respond `201` with its detail. Build it (`POST .../build`) before a computer can boot from it. Guest callers are denied (a write).

## Path parameters

- `projectId` string, required

## Request body

- SandboxImageCreateRequest — Create a sandbox image from a blueprint YAML document: an allowlisted, `@sha256`-digest-pinned `base` image plus `initialize` steps baked into the image, and optional `maintenance`/`knowledge` delivered to the agent at runtime.
  - `name` string, required — Display name for the new sandbox image; must be non-empty after trimming.
  - `blueprint` string, required — Blueprint YAML defining the image. Validated server-side; use the validate endpoint for fast feedback.

## Response `201`

The sandbox image was created.

- SandboxImage — A project's custom Computer image: a digest-pinned blueprint plus its latest build.
  - `id` string, required
  - `projectId` string, required
  - `name` string, required
  - `contentHash` string, required
  - `sharing` 'user' | 'project', required — `user` = a personal draft; `project` = shared with the whole project.
  - `isOwner` boolean, required
  - `currentBuild` SandboxImageBuild, required — One build of a sandbox image's image.
    - `id` string, required
    - `status` 'queued' | 'building' | 'ready' | 'failed', required
    - `provider` 'e2b' | 'stub', required
    - `e2bBuildId` string
    - `baseImageDigests` string[], required — Resolved sha256 digest of every FROM base (the reproducibility pin).
    - `logPreview` string — Capped, ANSI-stripped tail of the build log.
    - `error` string
    - `createdAt` number, required
    - `startedAt` number
    - `finishedAt` number
  - `createdAt` number, required
  - `updatedAt` number, required
  - `blueprint` string, required — The image's blueprint YAML (base / initialize / maintenance / knowledge). `base` must be an allowlisted official image pinned by sha256 digest.

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.
- `502` — Could not connect to the target MCP server.

---

[API](https://skmtc.net/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.net/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/versions/75f218486b1d/schema)