Skip to main content
GET
Get a sandbox preview

Authorizations

Authorization
string
header
required

Send Authorization: Bearer <api_key>. The legacy Authorization: Api-Key <api_key> scheme is also accepted.

Headers

X-Team-Id
string

Optional team ID. Must match the team_id query parameter when both are supplied. If neither selector is supplied, defaults to the caller's only accessible team. Callers with multiple accessible teams must select a team. Requests without access to any team are forbidden.

Minimum string length: 1

Path Parameters

sandbox_name
string
required

Immutable sandbox name returned by creation.

Minimum string length: 1
Example:

"baseten-api-review-0916"

preview_name
string
required

Preview name returned by creation.

Minimum string length: 1
Example:

"web"

Query Parameters

team_id
string

Optional team ID. Must match X-Team-Id when both are supplied. If neither selector is supplied, defaults to the caller's only accessible team. Callers with multiple accessible teams must select a team. Requests without access to any team are forbidden.

Minimum string length: 1
show_secrets
boolean
default:false

Reveal request header values for workspace administrators, for example to change one header and send the full set back in a PATCH. Defaults to false. Callers without the admin role receive masked values even when true.

Response

Successful operation.

Sandbox preview with configuration and server-managed fields at the root.

public
boolean
default:false
required

Whether the URL is reachable without a preview token. Defaults to false.

Example:

true

name
string
required
read-only

Preview name, used in preview_name path parameters.

Example:

"web"

port
integer
required
read-only

Exposed sandbox port.

Example:

3000

url
string<uri>
required
read-only

HTTPS URL serving the port, including the region label. Use this exact URL. Requests to a private preview need a token.

Example:

"https://a1b2c3d4e5f6g7h8.us-pdx-1.preview.b10.co"

status
enum<string>
required
read-only

Preview status, always uppercase.

Available options:
DEPLOYING,
DEPLOYED,
FAILED,
DELETING,
TERMINATED
Example:

"DEPLOYED"

response_headers
object

Headers added to every response served by the preview, for example CORS headers.

Example:
request_headers
object

Headers added to every request forwarded to the sandbox, for example an Authorization header expected by the application. Responses return each name with the value "", except a GET with show_secrets=true by a workspace administrator. Sending "" back as a value returns 400. A PATCH replaces the whole set.

Example:
ttl
string

Lifetime counted from the request, using seconds, minutes, hours or composite durations such as 1h30m. Whole days are also supported, for example 7d; days cannot be combined with other units. The preview is deleted when it elapses.

Pattern: ^([0-9]+d|(([0-9]+(\.[0-9]*)?|\.[0-9]+)(ns|us|µs|μs|ms|s|m|h))+)$
Example:

"24h"

expires_at
string<date-time>

Time at which the preview is deleted. Must be in the future.

Example:

"2026-10-19T12:00:00Z"

region
string
read-only

Region serving the preview, the sandbox's region.

Example:

"us-pdx-1"

created_at
string<date-time>
read-only
Example:

"2026-10-12T12:00:00Z"

updated_at
string<date-time>
read-only
Example:

"2026-10-12T12:00:00Z"

created_by
string
read-only
Example:

"sandbox-automation"

updated_by
string
read-only
Example:

"sandbox-automation"