---
title: "Update sandbox config"
method: PUT
path: "/sandbox-configs/{id}"
tags: ["SandboxConfig"]
---

# Update sandbox config

`PUT /sandbox-configs/{id}`

Update a sandbox backend config. Identity-field changes are refused while the config owns live or paused sandboxes.

## Path parameters

- `id` string, required

## Request body

- InternalHandlerSandboxConfigRequest
  - `config` GithubComTencentWeKnoraInternalTypesTenantSandboxConfig
    - `allow_private_endpoints` boolean — AllowPrivateEndpoints permits this workspace config to reach RFC1918 or loopback cluster endpoints. Link-local/cloud-metadata addresses remain blocked. It is explicit in the UI instead of hidden in process env.
    - `cube` GithubComTencentWeKnoraInternalTypesCubeSandboxConfig
      - `api_key` string — 加密
      - `api_url` string
      - `cube_sandbox_ttl_seconds` integer
      - `http_timeout_sec` integer — HTTPTimeoutSec bounds each HTTP call to the sandbox control plane. 0 means use the built-in default (30s), never the deployment's value.
      - `proxy_url` string
      - `sandbox_domain` string
      - `template_id` string
    - `default_timeout_sec` integer — DefaultTimeoutSec is the per-execution timeout in seconds. 0 uses the program's built-in default.
    - `docker` GithubComTencentWeKnoraInternalTypesDockerSandboxConfig
      - `image` string
    - `e2b` GithubComTencentWeKnoraInternalTypesE2BSandboxConfig
      - `api_key` string — 加密
      - `api_url` string
      - `e2b_sandbox_ttl_seconds` integer
      - `http_timeout_sec` integer — HTTPTimeoutSec bounds each HTTP call to the sandbox control plane. 0 means use the built-in default (30s), never the deployment's value.
      - `proxy_url` string — ProxyURL is the data-plane gateway that fronts envd. E2B Cloud resolves "<port>-<sandboxID>.<sandbox_domain>" through public DNS and TLS, so it needs no value here. Self-hosted E2B-compatible control planes usually serve every sandbox from one gateway address and expect the sandbox authority in the Host header; setting this makes WeKnora dial the gateway directly instead of requiring wildcard DNS and a certificate for the sandbox domain. An "http://" gateway also downgrades the data-plane scheme, which the E2B SDK otherwise pins to https.
      - `sandbox_domain` string
      - `template_id` string
    - `env_vars` object — EnvVars are additional environment variables injected into every sandbox created for this tenant. 🔒 Values are encrypted at rest. These become visible to all scripts running in the tenant's sandboxes — do not place secrets here that scripts must not access.
    - `sandbox_type` string — SandboxType selects the sandbox backend. Named configs may use "cube", "e2b", "docker", or "local". "disabled" is reserved for the hidden workspace policy row.
    - `volume_mount` GithubComTencentWeKnoraInternalTypesVolumeMountConfig
      - `enabled` boolean — Enabled toggles the volume mount for this tenant.
      - `mount_path` string — MountPath is the sandbox-internal path where the volume is mounted. Default: /weknora/tenant/skills (customizable per use case).
      - `provider` string — Provider identifies the volume backend. Currently "e2b" or "cube".
      - `volume_id` string — VolumeID is the provider-specific volume identifier, populated after EnsureVolume / CreateVolume succeeds.
      - `volume_name` string — VolumeName is the human-readable volume name, e.g. "weknora-tenant-<id>-skills".
      - `volume_owner_fingerprint` string — VolumeOwnerFingerprint = sha256(provider + APIKey + APIURL). Used to detect when the tenant switched to a different backend or API key, at which point the volume is no longer reachable and must be recreated.
  - `description` string
  - `name` string, required

## Response `200`

Updated sandbox config

- object

## Other responses

- `400` — Invalid request or validation failure
- `401` — Unauthorized
- `404` — Sandbox config not found
- `409` — Live sandboxes or unverifiable inventory
- `423` — Sandbox config is being modified by another request

---

[API](https://skmtc.net/tencentblueking/apis/weknora-api.md) · [All operations](https://skmtc.net/tencentblueking/apis/weknora-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tencentblueking/weknora-api/revisions/6e297e21afca/schema)