Update a sandbox preview
Updates a preview’s access, headers, or expiration.
Authorizations
Send Authorization: Bearer <api_key>. The legacy Authorization: Api-Key <api_key> scheme is also accepted.
Headers
Optional team ID. Must match the team_id query parameter when both are supplied. If neither selector is supplied, defaults to the caller's only accessible team. Callers with multiple accessible teams must select a team. Requests without access to any team are forbidden.
1Path Parameters
Immutable sandbox name returned by creation.
1"baseten-api-review-0916"
Preview name returned by creation.
1"web"
Query Parameters
Optional team ID. Must match X-Team-Id when both are supplied. If neither selector is supplied, defaults to the caller's only accessible team. Callers with multiple accessible teams must select a team. Requests without access to any team are forbidden.
1Body
Preview fields to change. name and port cannot be changed.
Whether the URL is reachable without a preview token. Defaults to false.
true
Headers added to every response served by the preview, for example CORS headers.
Headers added to every request forwarded to the sandbox, for example an Authorization header expected by the application. Responses return each name with the value "", except a GET with show_secrets=true by a workspace administrator. Sending "" back as a value returns 400. A PATCH replaces the whole set.
Lifetime counted from the request, using seconds, minutes, hours or composite durations such as 1h30m. Whole days are also supported, for example 7d; days cannot be combined with other units. The preview is deleted when it elapses.
^([0-9]+d|(([0-9]+(\.[0-9]*)?|\.[0-9]+)(ns|us|µs|μs|ms|s|m|h))+)$"24h"
Time at which the preview is deleted. Must be in the future.
"2026-10-19T12:00:00Z"
Response
Successful operation.
Sandbox preview with configuration and server-managed fields at the root.
Whether the URL is reachable without a preview token. Defaults to false.
true
Preview name, used in preview_name path parameters.
"web"
Exposed sandbox port.
3000
HTTPS URL serving the port, including the region label. Use this exact URL. Requests to a private preview need a token.
"https://a1b2c3d4e5f6g7h8.us-pdx-1.preview.b10.co"
Preview status, always uppercase.
DEPLOYING, DEPLOYED, FAILED, DELETING, TERMINATED "DEPLOYED"
Headers added to every response served by the preview, for example CORS headers.
Headers added to every request forwarded to the sandbox, for example an Authorization header expected by the application. Responses return each name with the value "", except a GET with show_secrets=true by a workspace administrator. Sending "" back as a value returns 400. A PATCH replaces the whole set.
Lifetime counted from the request, using seconds, minutes, hours or composite durations such as 1h30m. Whole days are also supported, for example 7d; days cannot be combined with other units. The preview is deleted when it elapses.
^([0-9]+d|(([0-9]+(\.[0-9]*)?|\.[0-9]+)(ns|us|µs|μs|ms|s|m|h))+)$"24h"
Time at which the preview is deleted. Must be in the future.
"2026-10-19T12:00:00Z"
Region serving the preview, the sandbox's region.
"us-pdx-1"
"2026-10-12T12:00:00Z"
"2026-10-12T12:00:00Z"
"sandbox-automation"
"sandbox-automation"