Skip to main content
GET
The signed-in user and the sandbox size they get.

Authorizations

Authorization
string
header
required

Opaque instabox access token (1 hour). Refresh with /v1/auth/refresh (refresh token valid 30 days, rotates on use).

Response

The user.

userId
integer<int64>
required

Instabox user ID.

login
string
required

GitHub login at last sign-in (display only).

name
string
email
string

The account's email, which an org invite must be sent to for it to join.

avatarUrl
string<uri>
admin
boolean

The user is an admin and may use the admin-only endpoints (/v1/admin).

machineMetrics
boolean

Clients show this account per-sandbox metrics (the dashboard's Metrics tab, instabox metrics): admins always, every account once the server sets machineMetricsForAll. Absent: hidden. GET /v1/machines/{id}/metrics answers either way.

orgId
string

Set for a workspace API key: its workspace. The user is then the workspace's owner, whom the key acts as.

adminUrl
string<uri>

Admins only: the origin of the admin console when it has its own (the server's adminUrl). Absent, the console is /admin/ on the dashboard's origin.

billingEnabled
boolean

Paid plans can be subscribed: the server has Stripe configured. False: the dashboard offers no plan actions and the billing routes answer 503.

webhooksEnabled
boolean

This server offers org webhooks (docs/webhooks.md). False: the dashboard hides them, the CLI says they are off and the webhook routes answer 404.

emailInvites
boolean

This server emails workspace invites (server.json email). Absent: creating or resending an invite answers 503.

paidActivation
boolean

An account the invite gate holds back may buy a workspace (POST /v1/orgs) instead, and is activated once its plan takes effect (docs/invites.md). Absent: only an invite code lets it in.

plans
object[]

The paid plans an org can go on (Pro, Builder, Team) as this server sells them, for plan pickers.

csrfToken
string

Browser sessions only. Send it as X-Instabox-CSRF on every request that is not GET or HEAD.

allowedSpecs
object[]

The sizes your new sandboxes may have in your personal org (no rootDiskGiB: the template's). The first is the server's limits.machineSpec (4 vCPUs and 8 GiB memory by default), what a create naming no size gets; the others are your plan's (Pro: 2/4, 4/8, 8/16; Builder: 2/4 up to 16/32; Team and Enterprise: 2/4 up to 32/64) and sizes an admin granted you, picked by naming their vcpus and memMiB on create. Any other size is refused with spec_not_allowed, admins included.

org
object

The org allowedSpecs, idleChoicesSeconds and alwaysOnAllowed describe: your personal org, or a workspace key's workspace. Absent from older servers.

workspaces
object[]

Your other orgs, each with its own plan and limits (GET /v1/usage?org=ID, GET /v1/orgs/{id}). Omitted when there are none, and for a workspace API key, which reaches only its own org.

inviteRequired
boolean

This server gates new accounts behind an invite code (docs/invites.md).

activated
boolean

This account passed the invite gate (admins always have). When inviteRequired and not activated, every route but this one, POST /v1/invites/redeem and POST /v1/auth/logout answers 403 invite_required.

manualLifecycle
boolean

An admin let this account manage its sandboxes' lifecycle (docs/idle-suspend.md): the autoSuspendAfterSeconds it sends applies (0: off). Otherwise every sandbox pauses after fixedAutoSuspendSeconds idle, whatever a request says.

fixedAutoSuspendSeconds
integer

The idle auto-suspend every sandbox of this account gets on a server that offers no choice; absent when the account chooses (manualLifecycle, or idleChoicesSeconds).

idleChoicesSeconds
integer[]

The idle times offered (300 to 1800, 5 to 30 minutes; docs/pricing.md): a request may send any whole minute from the first to the last. 0 (off) is never listed: alwaysOnAllowed says whether it is a choice too. Absent with manualLifecycle.

alwaysOnAllowed
boolean

Whether 0 (off) is a choice too, on org's plan (the personal org's for a sign-in session). A sandbox in another org follows that org's plan: see its workspaces entry's alwaysOnAllowed.

diskResize
enum<string>

An admin's override of disk growth (PATCH /v1/machines/{id} persistentDiskGiB, rootDiskGiB): allow grows free sandboxes' disks too, deny none. Absent: paid sandboxes grow, free ones are fixed.

Available options:
allow,
deny
resizeRestart
boolean

This server takes PATCH /v1/machines/{id} apply: "restart" (one stop, resize, start operation). Absent: it answers 400 resize_restart_off; resize with your own stop, PATCH, start.

directSecretRefs
boolean

This site takes direct Secret file references and renamed variables (directSecrets) and exec secretEnvs. Absent: they are refused with 400 (same-name references work); clients should not send them, since a control host from before them would ignore or misread them.

termsVersion
string

The version of the rules of the road (the Terms of Service's acceptable use) this account last agreed to (PUT /v1/me/terms). Absent: none.

waitlist
object

The account's place in the line invite codes go out from and its referral link (docs/invites.md, "Referrals"). Absent: not in line (activated, the gate off, or a live code claimed for its email).