Refresh managed Secret delivery in a running sandbox.
API keys require machines:write. Takes no body or Idempotency-Key.
Installs selected env values, proxy placeholders and the public CA;
requests proxy reconciliation and returns each path’s current status.
Existing processes must reload env values themselves. A refresh cannot
erase credentials already copied by applications.
POST
/
v1
/
machines
/
{id}
/
secrets
Refresh managed Secret delivery in a running sandbox.
Sandbox ID (m_ + 26 lowercase base32 characters) or the sandbox's name (unique among your sandboxes; names never contain _, so the two never collide). Older servers take only the ID and answer 404 for a name.
Proxy selection only. All includes current and future proxy Secrets in the sandbox's org. Explicit names resolve to stable IDs. An empty array selects none. Deleting and recreating a name does not restore an explicit grant. Null is rejected.
Direct references that are exactly the same-name shorthand ({secret X, env X}, no file). Renamed and file references appear only in directSecrets.
A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.
Last node acknowledgement, not continuous health. Policies expire within 60 seconds unless renewed. Revocation is pending until applied or the previous lease expires. Already admitted streams may finish.
Managed environment and public CA installation. This does not prove existing processes reloaded values. Removing env access cannot remove values already copied into process memory, files, or snapshots.
Present when the server records proxied request counts: one entry per selected proxy Secret.
Show child attributes
Was this page helpful?
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"InstaBox","description":"A Linux machine of its own in the cloud for every agent.","colors":{"primary":"#0A0A0A","light":"#FAFAFA","dark":"#0A0A0A"},"logo":{"light":"https://instacloud.mintlify.site/docs/logo/light.svg","dark":"https://instacloud.mintlify.site/docs/logo/dark.svg","href":"https://instabox.sh"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/instacloud/instabox/favicon.svg","appearance":{"default":"dark"},"navbar":{"links":[{"href":"https://instabox.sh/pricing","label":"Pricing"},{"href":"https://instabox.sh/changelog","label":"Changelog"}],"primary":{"type":"button","label":"Dashboard","href":"https://dashboard.instabox.sh"}},"footer":{"socials":{"github":"https://github.com/InsForge"}},"icons":{"library":"lucide"},"contextual":{"options":["copy","view","chatgpt","claude","cursor","vscode","mcp"],"display":"header"},"styling":{"latex":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"instacloud","hasAudioNarration":false,"actualSubdomain":"instacloud","customDomains":["instabox.sh"],"gitSource":{"type":"github","owner":"insforge","repo":"instabox","deployBranch":"main","contentDirectory":"docs-site","isPrivate":true,"mountPath":"instabox","label":"","_id":"6aed4ce60814409ea4a899b5"},"feedback":{"thumbs":true,"contextualFeedback":{"allowEmail":false}},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"REMOVE_BRANDING":{"status":"ENABLED"},"CONTEXTUAL_FEEDBACK":{"status":"ENABLED"},"CODE_SNIPPET_FEEDBACK":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6af24f2490cec7c60d18d067","clientVersion":"0.0.4094","searchFilterCounts":[{"language":"default","tag":"API reference","count":86},{"language":"default","tag":"Documentation","count":34},{"language":"default","tag":"Machines","count":15},{"language":"default","tag":"Use cases","count":9},{"language":"default","tag":"SDK reference","count":8},{"language":"default","tag":"Lifecycle","count":8},{"language":"default","tag":"Secrets","count":7},{"language":"default","tag":"Account","count":6},{"language":"default","tag":"TypeScript","count":6},{"language":"default","tag":"Get started","count":5}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox","slug":"/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox","pageMetadata":{"title":"Refresh managed Secret delivery in a running sandbox.","description":"API keys require `machines:write`. Takes no body or Idempotency-Key.\nInstalls selected env values, proxy placeholders and the public CA;\nrequests proxy reconciliation and returns each path's current status.\nExisting processes must reload env values themselves. A refresh cannot\nerase credentials already copied by applications.\n","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/secrets","href":"/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_components.p, {\n children: [\"API keys require \", _jsx(_components.code, {\n children: \"machines:write\"\n }), \". Takes no body or Idempotency-Key.\\nInstalls selected env values, proxy placeholders and the public CA;\\nrequests proxy reconciliation and returns each path’s current status.\\nExisting processes must reload env values themselves. A refresh cannot\\nerase credentials already copied by applications.\"]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Refresh managed Secret delivery in a running sandbox.","description":"API keys require `machines:write`. Takes no body or Idempotency-Key.\nInstalls selected env values, proxy placeholders and the public CA;\nrequests proxy reconciliation and returns each path's current status.\nExisting processes must reload env values themselves. A refresh cannot\nerase credentials already copied by applications.\n","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/secrets","href":"/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"tags":["secrets"],"operationId":"pushMachineSecrets","summary":"Refresh managed Secret delivery in a running sandbox.","description":"API keys require `machines:write`. Takes no body or Idempotency-Key.\nInstalls selected env values, proxy placeholders and the public CA;\nrequests proxy reconciliation and returns each path's current status.\nExisting processes must reload env values themselves. A refresh cannot\nerase credentials already copied by applications.\n","security":["de7ba4fc-95b0-4a52-8fee-c56e1cfa587a","c0d0df8c-7ad4-4e29-a37d-fc0c92833ad7","eb19137b-a081-4bbd-98f4-35213fe85183"],"responses":{"200":"a4d153bf-5763-40ea-b53c-4da4dad79dd4","401":"6cc34e6c-9f77-436a-8d24-357bd20ad0b3","403":"f763d5bb-53cf-437f-b5ea-3bfbb0ff2a91","404":"ebfb1198-0e3c-43e0-ba46-9c2a6b676463","409":"815346bd-a859-49fc-8c97-3f910f7f6d34","429":"5d271fc1-8cd5-4ad2-89bc-ba4d41553847","503":"c12f8fa3-512f-4aee-b93a-b65077f304c7"},"method":"post","type":"path","servers":["e2c665bb-4b53-46fa-8dd3-3dba6e3ac4a8"],"path":"/v1/machines/{id}/secrets","baseUrlOptions":["https://api.instabox.sh"],"title":"Refresh managed Secret delivery in a running sandbox.","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"66928f7b-8013-4357-813b-9252e7848f92":{"name":"id","in":"path","required":true,"description":"Sandbox ID (`m_` + 26 lowercase base32 characters) or the sandbox's name (unique among your sandboxes; names never contain `_`, so the two never collide). Older servers take only the ID and answer `404` for a name.","schema":{"type":"string","pattern":"^(m_[a-z2-7]{26}|[a-z0-9][a-z0-9-]{0,62})$","isRequired":true,"description":"Sandbox ID (`m_` + 26 lowercase base32 characters) or the sandbox's name (unique among your sandboxes; names never contain `_`, so the two never collide). Older servers take only the ID and answer `404` for a name.","uniqueKey":"","typeLabel":"string"}}},"responses":{"a4d153bf-5763-40ea-b53c-4da4dad79dd4":{"description":"Current delivery status. Check proxy and guest independently.","content":{"application/json":{"schema":{"type":"object","required":["secrets","envSecrets","directSecrets","items","version"],"properties":{"secrets":{"oneOf":[{"type":"string","description":"Proxy selection only. All includes current and future proxy Secrets in the sandbox's org. Explicit names resolve to stable IDs. An empty array selects none. Deleting and recreating a name does not restore an explicit grant. Null is rejected.","const":"all","isRequired":true,"uniqueKey":"secrets.oneOf.0","typeLabel":"string"},{"type":"array","items":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","uniqueKey":"secrets.oneOf.1.items.[INDEX]","typeLabel":"string"},"description":"Proxy selection only. All includes current and future proxy Secrets in the sandbox's org. Explicit names resolve to stable IDs. An empty array selects none. Deleting and recreating a name does not restore an explicit grant. Null is rejected.","isRequired":true,"uniqueKey":"secrets.oneOf.1","typeLabel":"string[]"}],"isRequired":true,"uniqueKey":"secrets","typeLabel":"string | string[]"},"envSecrets":{"type":"array","items":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","uniqueKey":"envSecrets.items.[INDEX]","typeLabel":"string"},"description":"Direct references that are exactly the same-name shorthand ({secret X, env X}, no file). Renamed and file references appear only in directSecrets.","isRequired":true,"uniqueKey":"envSecrets","typeLabel":"string[]"},"directSecrets":{"type":"array","items":{"type":"object","required":["secret"],"description":"A reference to a direct (delivery env) Secret: its real value as the variable `env` (exported by login shells), as a file at `file` (home-relative; the value stays on tmpfs at /run/instabox/secrets/files and the home path is a symlink to it), or both. Names and paths only; values are never returned.","properties":{"secret":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","isRequired":true,"uniqueKey":"directSecrets.items.[INDEX].secret","typeLabel":"string"},"env":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"Not reserved (PATH, HOME, BASH_ENV, IFS, CA variables, ...) and no INSTABOX_ or SSH_ prefix.","uniqueKey":"directSecrets.items.[INDEX].env","typeLabel":"string"},"file":{"type":"string","maxLength":255,"description":"Clean path relative to the home directory, without .. components.","uniqueKey":"directSecrets.items.[INDEX].file","typeLabel":"string"}},"uniqueKey":"directSecrets.items.[INDEX]","typeLabel":"object"},"description":"Direct references (names and paths, never values), envSecrets included.","isRequired":true,"uniqueKey":"directSecrets","typeLabel":"object[]"},"items":{"type":"array","items":{"type":"object","required":["id","orgId","name","delivery","hosts","version","size","createdAt","updatedAt"],"description":"Org Secret metadata. Values, ciphertext and placeholders are never returned.","properties":{"id":{"type":"string","description":"Stable identity retained by replacements; deletion and recreation makes a new ID.","isRequired":true,"uniqueKey":"\\items.items.[INDEX].id","typeLabel":"string"},"orgId":{"type":"string","isRequired":true,"uniqueKey":"\\items.items.[INDEX].orgId","typeLabel":"string"},"name":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","isRequired":true,"uniqueKey":"\\items.items.[INDEX].name","typeLabel":"string"},"delivery":{"type":"string","enum":["proxy","env"],"description":"Proxy supplies an opaque sandbox-specific placeholder for substitution in ordinary HTTPS headers on allowed hosts (port 443). Env supplies the real value, including credentials needed by native database clients. Unsupported traffic never falls back from proxy to env.","isRequired":true,"uniqueKey":"\\items.items.[INDEX].delivery","typeLabel":"enum\u003cstring>"},"hosts":{"type":"array","maxItems":32,"items":{"type":"string","maxLength":253,"uniqueKey":"\\items.items.[INDEX].hosts.items.[INDEX]","typeLabel":"string"},"description":"Exact ASCII DNS hostnames, normalized to lowercase without a trailing dot, or a standalone `*` for every public HTTPS destination. Omitted or empty for proxy delivery means `[\"*\"]`. No scheme, port, path, partial wildcard, IP literal, or local hostname. Destination checks also reject private and restricted resolved addresses. This scopes credential use, not all sandbox network access.","isRequired":true,"uniqueKey":"\\items.items.[INDEX].hosts","typeLabel":"string[]"},"version":{"type":"integer","minimum":1,"isRequired":true,"uniqueKey":"\\items.items.[INDEX].version","typeLabel":"integer"},"size":{"type":"integer","minimum":0,"description":"Raw value size in bytes.","isRequired":true,"uniqueKey":"\\items.items.[INDEX].size","typeLabel":"integer"},"createdAt":{"type":"string","format":"date-time","isRequired":true,"uniqueKey":"\\items.items.[INDEX].createdAt","typeLabel":"string\u003cdate-time>"},"updatedAt":{"type":"string","format":"date-time","isRequired":true,"uniqueKey":"\\items.items.[INDEX].updatedAt","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"\\items.items.[INDEX]","typeLabel":"object"},"description":"Effective selected Secrets, including proxy all. Metadata only.","isRequired":true,"uniqueKey":"\\items","typeLabel":"object[]"},"version":{"type":"integer","description":"Version of this sandbox's selection configuration.","isRequired":true,"uniqueKey":"version","typeLabel":"integer"},"proxy":{"type":"object","required":["state","revision","appliedRevision"],"description":"Last node acknowledgement, not continuous health. Policies expire within 60 seconds unless renewed. Revocation is pending until applied or the previous lease expires. Already admitted streams may finish.","properties":{"state":{"type":"string","enum":["inactive","pending","applied","expired"],"isRequired":true,"uniqueKey":"proxy.state","typeLabel":"enum\u003cstring>"},"revision":{"type":"integer","description":"Desired org policy revision.","isRequired":true,"uniqueKey":"proxy.revision","typeLabel":"integer"},"appliedRevision":{"type":"integer","description":"Last revision acknowledged by the node.","isRequired":true,"uniqueKey":"proxy.appliedRevision","typeLabel":"integer"},"expiresAt":{"type":"string","format":"date-time","uniqueKey":"proxy.expiresAt","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"proxy","typeLabel":"object"},"guest":{"type":"object","required":["state","revision","appliedRevision","items"],"description":"Managed environment and public CA installation. This does not prove existing processes reloaded values. Removing env access cannot remove values already copied into process memory, files, or snapshots.","properties":{"state":{"type":"string","enum":["inactive","pending","applied","error"],"isRequired":true,"uniqueKey":"guest.state","typeLabel":"enum\u003cstring>"},"revision":{"type":"integer","description":"Desired policy revision.","isRequired":true,"uniqueKey":"guest.revision","typeLabel":"integer"},"appliedRevision":{"type":"integer","description":"Revision of the last installation attempt; check state for success.","isRequired":true,"uniqueKey":"guest.appliedRevision","typeLabel":"integer"},"items":{"type":"array","items":{"type":"object","required":["id","name","delivery","version"],"properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"guest.\\items.items.[INDEX].id","typeLabel":"string"},"name":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","isRequired":true,"uniqueKey":"guest.\\items.items.[INDEX].name","typeLabel":"string"},"delivery":{"type":"string","enum":["proxy","env"],"description":"Proxy supplies an opaque sandbox-specific placeholder for substitution in ordinary HTTPS headers on allowed hosts (port 443). Env supplies the real value, including credentials needed by native database clients. Unsupported traffic never falls back from proxy to env.","isRequired":true,"uniqueKey":"guest.\\items.items.[INDEX].delivery","typeLabel":"enum\u003cstring>"},"version":{"type":"integer","isRequired":true,"uniqueKey":"guest.\\items.items.[INDEX].version","typeLabel":"integer"},"env":{"type":"string","description":"A direct Secret's variable name.","uniqueKey":"guest.\\items.items.[INDEX].env","typeLabel":"string"},"file":{"type":"string","description":"A direct Secret's home-relative file path.","uniqueKey":"guest.\\items.items.[INDEX].file","typeLabel":"string"}},"uniqueKey":"guest.\\items.items.[INDEX]","typeLabel":"object"},"description":"Metadata from the last successful installation.","isRequired":true,"uniqueKey":"guest.\\items","typeLabel":"object[]"},"appliedAt":{"type":"string","format":"date-time","uniqueKey":"guest.appliedAt","typeLabel":"string\u003cdate-time>"},"error":{"type":"string","description":"Fixed delivery error, never arbitrary guest output or credential values.","uniqueKey":"guest.error","typeLabel":"string"}},"uniqueKey":"guest","typeLabel":"object"},"usage":{"type":"array","items":{"type":"object","required":["name","requests","denied"],"description":"This sandbox's HTTPS requests carrying the Secret's placeholder. requests had the real value injected; denied went to a host outside the Secret's hosts and were refused. Lags by up to a policy renewal and covers only hosts the proxy intercepts.","properties":{"name":{"type":"string","pattern":"^[A-Za-z_][A-Za-z0-9_]{0,127}$","description":"A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.","isRequired":true,"uniqueKey":"usage.items.[INDEX].name","typeLabel":"string"},"requests":{"type":"integer","isRequired":true,"uniqueKey":"usage.items.[INDEX].requests","typeLabel":"integer"},"denied":{"type":"integer","isRequired":true,"uniqueKey":"usage.items.[INDEX].denied","typeLabel":"integer"},"lastUsedAt":{"type":"string","format":"date-time","description":"Last request with the value injected; denied requests do not move it.","uniqueKey":"usage.items.[INDEX].lastUsedAt","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"usage.items.[INDEX]","typeLabel":"object"},"description":"Present when the server records proxied request counts: one entry per selected proxy Secret.","uniqueKey":"usage","typeLabel":"object[]"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"secrets":"all","envSecrets":["\u003cstring>"],"directSecrets":[{"secret":"\u003cstring>","env":"\u003cstring>","file":"\u003cstring>"}],"items":[{"id":"\u003cstring>","orgId":"\u003cstring>","name":"\u003cstring>","delivery":"proxy","hosts":["\u003cstring>"],"version":2,"size":1,"createdAt":"2023-11-07T05:31:56Z","updatedAt":"2023-11-07T05:31:56Z"}],"version":123,"proxy":{"state":"inactive","revision":123,"appliedRevision":123,"expiresAt":"2023-11-07T05:31:56Z"},"guest":{"state":"inactive","revision":123,"appliedRevision":123,"items":[{"id":"\u003cstring>","name":"\u003cstring>","delivery":"proxy","version":123,"env":"\u003cstring>","file":"\u003cstring>"}],"appliedAt":"2023-11-07T05:31:56Z","error":"\u003cstring>"},"usage":[{"name":"\u003cstring>","requests":123,"denied":123,"lastUsedAt":"2023-11-07T05:31:56Z"}]}}},"exampleType":"generated"}},"exampleType":"generated"},"6cc34e6c-9f77-436a-8d24-357bd20ad0b3":{"description":"A credential 401 has its own code: `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key` or `session_expired`, with `hint` and `docs` (older servers sent `unauthenticated`, `api_key_expired` or `api_key_revoked`). Other 401s (refresh tokens, tickets) are `unauthenticated`. For a missing or bad API key or access token the message ends with how to get a key (session and refresh-token 401s say to sign in again instead), e.g. `create an API key at https://dashboard.instabox.sh/dashboard/api-keys and send it as \"Authorization: Bearer \u003ckey>\" or \"X-API-Key: \u003ckey>\"`.","content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"},"f763d5bb-53cf-437f-b5ea-3bfbb0ff2a91":{"description":"`permission_denied`: the user is not allowed (not on the allowlist, or not the owner), or an API key was used where only a sign-in session is; `missing_scope`: the API key lacks the route's scope (`requiredScopes` names it; older servers sent `insufficient_scope`).","content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"},"ebfb1198-0e3c-43e0-ba46-9c2a6b676463":{"description":"`not_found`: no such resource (also for deleted sandboxes).","content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"},"815346bd-a859-49fc-8c97-3f910f7f6d34":{"description":"`operation_conflict` (another operation is active; `operationId` names it,\nor the transition is not allowed), `idempotency_conflict` (key reused for\na different request), `delete_confirmation_required` (a delete's\n`X-Confirm-Delete` header is not the sandbox's or snapshot's ID or name,\nor a key that must send it left it out),\n`machine_not_running` (the sandbox is not running), `desktop_not_running` (the\nVNC endpoint before the desktop started), or for Orca connections\n`orca_unsupported` and `runtime_not_ready` (retryable).\n","content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"},"5d271fc1-8cd5-4ad2-89bc-ba4d41553847":{"description":"`quota_exceeded`: one of your limits was reached: the number of sandboxes (on the free plan 1, in any state, stopped and paused included; Pro 500; Builder 1000), stored data (on the free plan 200 GiB), snapshots (on the free plan 5), API keys, execs or terminals. The message says which, e.g. \"sandbox limit reached (1 of 1) in org alice (free plan): delete a sandbox first\". Delete a sandbox or snapshot, upgrade the plan, or ask an admin to raise your limit.","content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"},"c12f8fa3-512f-4aee-b93a-b65077f304c7":{"description":"`no_capacity` (there is no room for the sandbox right now; the message says what could not run and when to retry) or `host_unavailable` (the sandbox cannot be reached right now). Usually `retryable`; try again shortly. `no_capacity` is `retryable`: retry with exponential backoff (for example after 15 s, 30 s, 60 s, then every few minutes), or try another size or template. A create whose operation failed with it replays that failed operation for the same `Idempotency-Key`, so retry it with a new key. With `--fail-fast` the CLI's `create` and `run` exit 75 on it (otherwise 1). A retryable `no_capacity` has `retryAfterSeconds` and the same `Retry-After` header: wait at least that long before the first retry.","headers":{"Retry-After":{"description":"Seconds to wait before retrying; the body's `retryAfterSeconds`.","schema":{"type":"integer","minimum":1,"examples":[60]}}},"content":{"application/json":{"schema":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","requestId","retryable","operationId"],"properties":{"code":{"type":"string","description":"Machine-readable code. HTTP status per code is fixed.","enum":["unauthenticated","missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","permission_denied","not_found","bad_request","feature_disabled","unknown_field","operation_conflict","idempotency_conflict","machine_not_running","restore_unavailable","delete_confirmation_required","fork_unavailable","machine_cooldown","max_run_disabled","desktop_not_running","disk_too_small","grow_needs_stop","resize_restart_off","private_ports_unavailable","quota_exceeded","no_capacity","host_unavailable","metrics_unavailable","restore_failed","internal","authorization_pending","slow_down","expired_token","access_denied","invalid_grant","invite_required","invite_invalid","invite_email_mismatch","api_key_expired","api_key_revoked","insufficient_scope","orca_unsupported","runtime_not_ready","spec_not_allowed","template_not_allowed","template_limit","kernel_unavailable","template_unavailable","invalid_guest_user","vault_unavailable","vault_retired","credit_exhausted","spend_limit_reached","subscription_required","payment_method_required","early_allowance_ended","rate_limited","concurrency_limit","payment_failed","missing_parent","not_a_file","no_space","too_large","data_disk_not_browsable","support_unavailable","host_oom","vmm_crashed","guest_reboot_loop"],"isRequired":true,"uniqueKey":"error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","isRequired":true,"uniqueKey":"error.message","typeLabel":"string"},"requestId":{"type":"string","isRequired":true,"uniqueKey":"error.requestId","typeLabel":"string"},"retryable":{"type":"boolean","description":"True if the same request may succeed later.","isRequired":true,"uniqueKey":"error.retryable","typeLabel":"boolean"},"operationId":{"oneOf":[{"type":"string","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.0","typeLabel":"string"},{"type":"null","description":"For `operation_conflict`, the active operation.","isRequired":true,"uniqueKey":"error.operationId.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"error.operationId","typeLabel":"string | null"},"reason":{"type":"string","description":"The same as `code` for credential errors (401 `missing_key`, `malformed_key`, `invalid_key`, `expired_key`, `revoked_key`, `session_expired`; 403 `missing_scope`). For 409 `machine_cooldown`, the automatic abuse check whose pause locks the sandbox: `abuse_egress_blocklist` (it tried to connect to a blocked destination on the egress blocklist, not a DNS lookup), `abuse_network_flows` (scanning or attack traffic), `abuse_cpu` (mining); absent for a max-run cooldown. For a retryable 409 `fork_unavailable`, why the source's host cannot take the fork: `source_host_unavailable` (it takes no new sandboxes) or `source_host_full` (no room now). Absent on other errors and from older servers.","enum":["missing_key","malformed_key","invalid_key","expired_key","revoked_key","session_expired","missing_scope","abuse_egress_blocklist","abuse_network_flows","abuse_cpu","source_host_unavailable","source_host_full"],"uniqueKey":"error.reason","typeLabel":"enum\u003cstring>"},"hint":{"type":"string","description":"The next step that fixes the error (credential errors). Absent otherwise.","uniqueKey":"error.hint","typeLabel":"string"},"docs":{"type":"string","format":"uri","description":"A URL documenting the error (credential errors). Absent otherwise.","uniqueKey":"error.docs","typeLabel":"string\u003curi>"},"docs_url":{"type":"string","format":"uri","description":"The code's entry on the errors page, on every error response: https://instabox.sh/docs/errors#\u003ccode> with underscores as dashes (e.g. #credit-exhausted): its HTTP status, whether to retry and what to do. Snake case, unlike the other fields. Absent from a failed operation's `error` and from older servers.","uniqueKey":"error.docs_url","typeLabel":"string\u003curi>"},"requiredScopes":{"type":"array","items":{"type":"string","uniqueKey":"error.requiredScopes.items.[INDEX]","typeLabel":"string"},"description":"For `missing_scope`, the scopes the route accepts; the key needs one of them.","uniqueKey":"error.requiredScopes","typeLabel":"string[]"},"retryAfterSeconds":{"type":"integer","minimum":1,"description":"Seconds to wait before trying again: a retryable `no_capacity` (60, as a 503 or on a failed operation's `error`), `rate_limited`, `machine_cooldown` and agent sign-up `quota_exceeded`. An error response also sends it as the `Retry-After` header; a failed operation's `error` has only this field. Absent otherwise and from older servers.","uniqueKey":"error.retryAfterSeconds","typeLabel":"integer"},"at":{"type":"string","format":"date-time","description":"When it happened, for a stop the platform found (a sandbox's `lastError` with code `host_oom`, `vmm_crashed` or `guest_reboot_loop`; `hint` says what to do). The next successful start clears the error. Absent otherwise and from older servers.","uniqueKey":"error.at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"error","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":{"code":"unauthenticated","message":"\u003cstring>","requestId":"\u003cstring>","retryable":true,"operationId":"\u003cstring>","reason":"missing_key","hint":"\u003cstring>","docs":"\u003cstring>","docs_url":"\u003cstring>","requiredScopes":["\u003cstring>"],"retryAfterSeconds":2,"at":"2023-11-07T05:31:56Z"}}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{"de7ba4fc-95b0-4a52-8fee-c56e1cfa587a":{"bearerAuth":{"type":"http","scheme":"bearer","description":"Opaque instabox access token (1 hour). Refresh with `/v1/auth/refresh` (refresh token valid 30 days, rotates on use).","scopes":[],"schemeName":"bearerAuth"}},"c0d0df8c-7ad4-4e29-a37d-fc0c92833ad7":{"apiKey":{"type":"apiKey","in":"header","name":"X-API-Key","description":"API key (`ibk_...`) with scopes; also accepted as `Authorization: Bearer ibk_...`.\nAccepted on sandbox, snapshot, operation, template and usage routes per scope\n(see API keys), never on key management, sessions, logout or admin routes.\n","scopes":[],"schemeName":"apiKey"}},"eb19137b-a081-4bbd-98f4-35213fe85183":{"sessionCookie":{"type":"apiKey","in":"cookie","name":"instabox_session","description":"Dashboard browser session from `/auth/github/login` (7 days idle, 30 days at\nmost). Used only when no Authorization header is sent. Requests other than\nGET and HEAD must send `X-Instabox-CSRF` (from `GET /v1/me`) and an `Origin`\nequal to the server's `publicUrl`; otherwise `403 permission_denied`.\n","scopes":[],"schemeName":"sessionCookie"}}},"servers":{"e2c665bb-4b53-46fa-8dd3-3dba6e3ac4a8":{"url":"https://api.instabox.sh"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","description":"Opaque instabox access token (1 hour). Refresh with `/v1/auth/refresh` (refresh token valid 30 days, rotates on use).","scopes":[],"schemeName":"bearerAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"Opaque instabox access token (1 hour). Refresh with `/v1/auth/refresh` (refresh token valid 30 days, rotates on use).","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"bearerAuth","name":"Authorization"}],"title":"bearerAuth"},{"schemes":[{"scheme":{"type":"apiKey","in":"header","name":"X-API-Key","description":"API key (`ibk_...`) with scopes; also accepted as `Authorization: Bearer ibk_...`.\nAccepted on sandbox, snapshot, operation, template and usage routes per scope\n(see API keys), never on key management, sessions, logout or admin routes.\n","scopes":[],"schemeName":"apiKey"},"schema":{"title":"X-API-Key","type":"string","description":"API key (`ibk_...`) with scopes; also accepted as `Authorization: Bearer ibk_...`.\nAccepted on sandbox, snapshot, operation, template and usage routes per scope\n(see API keys), never on key management, sessions, logout or admin routes.\n","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"apiKey","name":"X-API-Key"}],"title":"apiKey"},{"schemes":[{"scheme":{"type":"apiKey","in":"cookie","name":"instabox_session","description":"Dashboard browser session from `/auth/github/login` (7 days idle, 30 days at\nmost). Used only when no Authorization header is sent. Requests other than\nGET and HEAD must send `X-Instabox-CSRF` (from `GET /v1/me`) and an `Origin`\nequal to the server's `publicUrl`; otherwise `403 permission_denied`.\n","scopes":[],"schemeName":"sessionCookie"},"schema":{"title":"instabox_session","type":"string","description":"Dashboard browser session from `/auth/github/login` (7 days idle, 30 days at\nmost). Used only when no Authorization header is sent. Requests other than\nGET and HEAD must send `X-Instabox-CSRF` (from `GET /v1/me`) and an `Origin`\nequal to the server's `publicUrl`; otherwise `403 permission_denied`.\n","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"sessionCookie","name":"instabox_session"}],"title":"sessionCookie"}]},"originalFileLocation":"api-reference/openapi.yaml"},"subdomain":"instacloud","siteName":"InstaBox","title":"Refresh managed Secret delivery in a running sandbox. - InstaBox","relatedPagesConfig":{"enabled":false,"limit":5,"mode":"automatic"},"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-09T06:53:04.035Z","originalFileLocation":"api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"dark\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"API keys require machines:write. Takes no body or Idempotency-Key. Installs selected env values, proxy placeholders and the public CA; requests proxy reconciliation and returns each path\u0026#x27;s current status. Existing processes must reload env values themselves. A refresh cannot erase credentials already copied by applications.\">\u003cmeta data-mint-head name=\"application-name\" content=\"InstaBox\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Refresh managed Secret delivery in a running sandbox. - InstaBox\">\u003cmeta data-mint-head property=\"og:description\" content=\"API keys require machines:write. Takes no body or Idempotency-Key. Installs selected env values, proxy placeholders and the public CA; requests proxy reconciliation and returns each path\u0026#x27;s current status. Existing processes must reload env values themselves. A refresh cannot erase credentials already copied by applications.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"InstaBox\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://instacloud.mintlify.site/docs/_mintlify/api/og/v2?division=Secrets\u0026amp;title=Refresh+managed+Secret+delivery+in+a+running+sandbox.\u0026amp;description=API+keys+require+%60machines%3Awrite%60.+Takes+no+body+or+Idempotency-Key.%0AInstalls+selected+env+values%2C+proxy+placeholders+and+the+public+CA%3B%0Arequests+proxy+reconcil\u0026amp;theme=4d60089f83d6d00671834b24\u0026amp;signature=617404f987b27e43a6bad1e1166a3b6dadad732b17024a2eec7f861dbcbe7cca\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Refresh managed Secret delivery in a running sandbox. - InstaBox\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"API keys require machines:write. Takes no body or Idempotency-Key. Installs selected env values, proxy placeholders and the public CA; requests proxy reconciliation and returns each path\u0026#x27;s current status. Existing processes must reload env values themselves. A refresh cannot erase credentials already copied by applications.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://instacloud.mintlify.site/docs/_mintlify/api/og/v2?division=Secrets\u0026amp;title=Refresh+managed+Secret+delivery+in+a+running+sandbox.\u0026amp;description=API+keys+require+%60machines%3Awrite%60.+Takes+no+body+or+Idempotency-Key.%0AInstalls+selected+env+values%2C+proxy+placeholders+and+the+public+CA%3B%0Arequests+proxy+reconcil\u0026amp;theme=4d60089f83d6d00671834b24\u0026amp;signature=617404f987b27e43a6bad1e1166a3b6dadad732b17024a2eec7f861dbcbe7cca\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/docs/mintlify-assets/_mintlify/favicons/instacloud/B4TOiHlk6CDYfBRt/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"InstaBox\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0A0A0A\">\u003clink data-mint-head rel=\"canonical\" href=\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/docs/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://instabox.sh/#organization\",\"name\":\"InstaBox\",\"url\":\"https://instabox.sh\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://instacloud.mintlify.site/docs/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://instabox.sh/docs#website\",\"name\":\"InstaBox\",\"url\":\"https://instabox.sh/docs\",\"publisher\":{\"@id\":\"https://instabox.sh/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox#webpage\",\"url\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox\",\"name\":\"Refresh managed Secret delivery in a running sandbox.\",\"description\":\"API keys require machines:write. Takes no body or Idempotency-Key. Installs selected env values, proxy placeholders and the public CA; requests proxy reconciliation and returns each path's current status. Existing processes must reload env values themselves. A refresh cannot erase credentials already copied by applications.\",\"dateModified\":\"2026-11-09T06:53:04.035Z\",\"isPartOf\":{\"@id\":\"https://instabox.sh/docs#website\"},\"breadcrumb\":{\"@id\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"API reference\",\"item\":\"https://instabox.sh/docs/api-reference/introduction\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secrets\",\"item\":\"https://instabox.sh/docs/api-reference/secrets/list-an-orgs-secret-metadata-never-values\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Refresh managed Secret delivery in a running sandbox.\",\"item\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox#apireference\",\"headline\":\"Refresh managed Secret delivery in a running sandbox.\",\"name\":\"Refresh managed Secret delivery in a running sandbox.\",\"description\":\"API keys require machines:write. Takes no body or Idempotency-Key. Installs selected env values, proxy placeholders and the public CA; requests proxy reconciliation and returns each path's current status. Existing processes must reload env values themselves. A refresh cannot erase credentials already copied by applications.\",\"url\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox\",\"mainEntityOfPage\":{\"@id\":\"https://instabox.sh/docs/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox#webpage\"},\"dateModified\":\"2026-11-09T06:53:04.035Z\",\"publisher\":{\"@id\":\"https://instabox.sh/#organization\"},\"isPartOf\":{\"@id\":\"https://instabox.sh/docs#website\"}}]}\u003c/script>","siteName":"InstaBox","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":""}]},{"tab":"API reference","groups":[{"group":"API reference","pages":[{"title":"API overview","icon":"braces","href":"/api-reference/introduction"},{"group":"Machines","pages":[{"title":"Create a sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines","href":"/api-reference/machines/create-a-sandbox"},{"title":"List the sandboxes of your orgs.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines","href":"/api-reference/machines/list-the-sandboxes-of-your-orgs"},{"title":"Get a sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}","href":"/api-reference/machines/get-a-sandbox"},{"title":"Rename, resize (vCPUs, memory, disk) a stopped sandbox, or set its idle pause and metadata.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml patch /v1/machines/{id}","href":"/api-reference/machines/rename-resize-vcpus-memory-disk-a-stopped-sandbox-or-set-its-idle-pause-and-metadata"},{"title":"Delete a sandbox, its system files and its storage.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/machines/{id}","href":"/api-reference/machines/delete-a-sandbox-its-system-files-and-its-storage"}]},{"group":"Lifecycle","pages":[{"title":"Start a stopped or paused sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/start","href":"/api-reference/machines/start-a-stopped-or-paused-sandbox"},{"title":"Stop a running sandbox (shuts it down; running programs end, files are kept).","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/stop","href":"/api-reference/machines/stop-a-running-sandbox-shuts-it-down;-running-programs-end-files-are-kept"},{"title":"Pause a running sandbox, keeping its running programs.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/suspend","href":"/api-reference/machines/pause-a-running-sandbox-keeping-its-running-programs"},{"title":"Resume a paused sandbox where it left off.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/resume","href":"/api-reference/machines/resume-a-paused-sandbox-where-it-left-off"},{"title":"Resume an idle-suspended machine before using it.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/wake","href":"/api-reference/machines/resume-an-idle-suspended-machine-before-using-it"},{"title":"Put a sandbox's disks back to a snapshot's, in place.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/restore","href":"/api-reference/machines/put-a-sandboxs-disks-back-to-a-snapshots-in-place"},{"title":"Create a copy of a sandbox on its host, without a snapshot.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/fork","href":"/api-reference/machines/create-a-copy-of-a-sandbox-on-its-host-without-a-snapshot"},{"title":"Get an operation (the progress of a sandbox change).","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/operations/{id}","href":"/api-reference/operations/get-an-operation-the-progress-of-a-sandbox-change"}]},{"group":"Commands and files","pages":[{"title":"Run a command in the sandbox and return its output.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/exec","href":"/api-reference/connections/run-a-command-in-the-sandbox-and-return-its-output"},{"title":"Read a file or directory of a running sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}/files","href":"/api-reference/machines/read-a-file-or-directory-of-a-running-sandbox"},{"title":"Write (upload) a file to a running sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml put /v1/machines/{id}/files","href":"/api-reference/machines/write-upload-a-file-to-a-running-sandbox"},{"title":"Download a file's raw bytes from a running sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}/files/content","href":"/api-reference/machines/download-a-files-raw-bytes-from-a-running-sandbox"},{"title":"Get a short-lived signed URL that uploads one file.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/files/upload-url","href":"/api-reference/machines/get-a-short-lived-signed-url-that-uploads-one-file"}]},{"group":"Snapshots","pages":[{"title":"Save a sandbox's system files and storage as a snapshot.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/snapshots","href":"/api-reference/snapshots/save-a-sandboxs-system-files-and-storage-as-a-snapshot"},{"title":"List the snapshots of your orgs.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/snapshots","href":"/api-reference/snapshots/list-the-snapshots-of-your-orgs"},{"title":"Get a snapshot of one of your orgs.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/snapshots/{id}","href":"/api-reference/snapshots/get-a-snapshot-of-one-of-your-orgs"},{"title":"Read a file or directory of a snapshot's system files.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/snapshots/{id}/files","href":"/api-reference/snapshots/read-a-file-or-directory-of-a-snapshots-system-files"},{"title":"Delete a snapshot.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/snapshots/{id}","href":"/api-reference/snapshots/delete-a-snapshot"}]},{"group":"Ports","pages":[{"title":"Give one HTTP port of a sandbox an HTTPS URL, public or private.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/ports","href":"/api-reference/give-one-http-port-of-a-sandbox-an-https-url-public-or-private"},{"title":"List a sandbox's public ports.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}/ports","href":"/api-reference/list-a-sandboxs-public-ports"},{"title":"List the public ports of all your sandboxes.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/ports","href":"/api-reference/list-the-public-ports-of-all-your-sandboxes"},{"title":"Remove a port's public URL and close its active connections.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/machines/{id}/ports/{port}","href":"/api-reference/remove-a-ports-public-url-and-close-its-active-connections"}]},{"group":"SSH","pages":[{"title":"Issue an SSH token, for a plain `ssh` command without a key.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/ssh-tokens","href":"/api-reference/connections/issue-an-ssh-token-for-a-plain-`ssh`-command-without-a-key"},{"title":"List SSH token metadata, including revoked and recently expired tokens.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}/ssh-tokens","href":"/api-reference/connections/list-ssh-token-metadata-including-revoked-and-recently-expired-tokens"},{"title":"Revoke one SSH token and close its SSH and mosh connections.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/machines/{id}/ssh-tokens/{tokenID}","href":"/api-reference/connections/revoke-one-ssh-token-and-close-its-ssh-and-mosh-connections"},{"title":"Revoke every SSH token of the sandbox and close their connections.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/machines/{id}/ssh-tokens","href":"/api-reference/connections/revoke-every-ssh-token-of-the-sandbox-and-close-their-connections"},{"title":"Issue a short-lived SSH user certificate for the sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/connections","href":"/api-reference/connections/issue-a-short-lived-ssh-user-certificate-for-the-sandbox"}]},{"group":"Secrets","pages":[{"title":"List an org's Secret metadata, never values.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/orgs/{id}/secrets","href":"/api-reference/secrets/list-an-orgs-secret-metadata-never-values"},{"title":"Create or replace an org Secret.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml put /v1/orgs/{id}/secrets/{name}","href":"/api-reference/secrets/create-or-replace-an-org-secret"},{"title":"Atomically create or replace a batch of org Secrets.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/orgs/{id}/secrets/import","href":"/api-reference/secrets/atomically-create-or-replace-a-batch-of-org-secrets"},{"title":"Delete an org Secret and its explicit sandbox grants.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml delete /v1/orgs/{id}/secrets/{name}","href":"/api-reference/secrets/delete-an-org-secret-and-its-explicit-sandbox-grants"},{"title":"Read a sandbox's Secret selections and delivery status.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/machines/{id}/secrets","href":"/api-reference/secrets/read-a-sandboxs-secret-selections-and-delivery-status"},{"title":"Replace supplied Secret selections for a sandbox.","description":"Org members with sandbox write access may select existing Secrets.\nAPI keys require `machines:write`. Each supplied field replaces its\nwhole selection; omission keeps it unchanged. Null, unknown names,\nwrong-delivery references and cross-org references reject the request.\nNames resolve to stable IDs. Changes trigger background reconciliation;\na successful response does not mean every proxy or guest applied them.\nNo Idempotency-Key required. Env delivery always needs explicit names.\n","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml patch /v1/machines/{id}/secrets","href":"/api-reference/secrets/replace-supplied-secret-selections-for-a-sandbox"},{"title":"Refresh managed Secret delivery in a running sandbox.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml post /v1/machines/{id}/secrets","href":"/api-reference/secrets/refresh-managed-secret-delivery-in-a-running-sandbox"}]},{"group":"Account","pages":[{"title":"The signed-in user and the sandbox size they get.","description":"\"API keys: any key.\" Not behind the invite gate: `inviteRequired` and `activated` tell a client whether the account must redeem an invite code (`POST /v1/invites/redeem`) before the other routes answer.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/me","href":"/api-reference/auth/the-signed-in-user-and-the-sandbox-size-they-get"},{"title":"List the templates a sandbox can start from.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/templates","href":"/api-reference/machines/list-the-templates-a-sandbox-can-start-from"},{"title":"Your storage use, limits, this month's cost and credit balance.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.yaml get /v1/usage","href":"/api-reference/usage/your-storage-use-limits-this-months-cost-and-credit-balance"}]}]}]},{"tab":"SDK reference","pages":[{"title":"SDK reference","href":"/integrations/sdk-quickstart"}]}]},"basePath":"","title":"Refresh managed Secret delivery in a running sandbox. - InstaBox","buildId":"dpl_3pZeXn3XukjzFRgAX73A7GNDfRJ1","deploymentId":"dpl_3pZeXn3XukjzFRgAX73A7GNDfRJ1","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CW3yP2DK.js","utils-BN0nty2W.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-C8_MydSG.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-Bsl5xDMQ.js","snippetPresets-DYv9OBej.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","conditional-requirements-CFM0id0Q.js","ApiExamples-9OnYPrVf.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-xr67xWGO.js","shallow-DO1aDdBF.js","getApiPlaygroundDisplay-o7cLzFL-.js","CodeSnippet-CGr2yOA8.js","CodeSnippets-CzBbqPNh.js","Page-CBlOSKZG.js","getPastedJson-dpi9sn5Y.js","icon-aIWHt8Pn.js","MethodPill-Bv2zLsGY.js","DuplicateIcon-DxFSz0J6.js","createIcon-uDNv6jwj.js","DynamicMarkdown-C91yhnNP.js","SectionHeading-DG_xjOLR.js","axios-vUo_bRtp.js","Markdown-B4M_Eo1P.js","clsx-DShopWo_.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BX6wab7q.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-48h67xm_.js"]}