curl --request PATCH \
--url https://api.instabox.sh/v1/machines/{id}/secrets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"secrets": "all",
"envSecrets": [
"<string>"
],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
]
}
'import requests
url = "https://api.instabox.sh/v1/machines/{id}/secrets"
payload = {
"secrets": "all",
"envSecrets": ["<string>"],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
secrets: 'all',
envSecrets: ['<string>'],
directSecrets: [{secret: '<string>', env: '<string>', file: '<string>'}]
})
};
fetch('https://api.instabox.sh/v1/machines/{id}/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.instabox.sh/v1/machines/{id}/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'secrets' => 'all',
'envSecrets' => [
'<string>'
],
'directSecrets' => [
[
'secret' => '<string>',
'env' => '<string>',
'file' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.instabox.sh/v1/machines/{id}/secrets"
payload := strings.NewReader("{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.instabox.sh/v1/machines/{id}/secrets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.instabox.sh/v1/machines/{id}/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"secrets": "all",
"envSecrets": [
"<string>"
],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
],
"items": [
{
"id": "<string>",
"orgId": "<string>",
"name": "<string>",
"delivery": "proxy",
"hosts": [
"<string>"
],
"version": 2,
"size": 1,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
],
"version": 123,
"proxy": {
"state": "inactive",
"revision": 123,
"appliedRevision": 123,
"expiresAt": "2023-11-07T05:31:56Z"
},
"guest": {
"state": "inactive",
"revision": 123,
"appliedRevision": 123,
"items": [
{
"id": "<string>",
"name": "<string>",
"delivery": "proxy",
"version": 123,
"env": "<string>",
"file": "<string>"
}
],
"appliedAt": "2023-11-07T05:31:56Z",
"error": "<string>"
},
"usage": [
{
"name": "<string>",
"requests": 123,
"denied": 123,
"lastUsedAt": "2023-11-07T05:31:56Z"
}
]
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}Replace supplied Secret selections for a sandbox.
Org members with sandbox write access may select existing Secrets.
API keys require machines:write. Each supplied field replaces its
whole selection; omission keeps it unchanged. Null, unknown names,
wrong-delivery references and cross-org references reject the request.
Names resolve to stable IDs. Changes trigger background reconciliation;
a successful response does not mean every proxy or guest applied them.
No Idempotency-Key required. Env delivery always needs explicit names.
curl --request PATCH \
--url https://api.instabox.sh/v1/machines/{id}/secrets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"secrets": "all",
"envSecrets": [
"<string>"
],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
]
}
'import requests
url = "https://api.instabox.sh/v1/machines/{id}/secrets"
payload = {
"secrets": "all",
"envSecrets": ["<string>"],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
secrets: 'all',
envSecrets: ['<string>'],
directSecrets: [{secret: '<string>', env: '<string>', file: '<string>'}]
})
};
fetch('https://api.instabox.sh/v1/machines/{id}/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.instabox.sh/v1/machines/{id}/secrets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'secrets' => 'all',
'envSecrets' => [
'<string>'
],
'directSecrets' => [
[
'secret' => '<string>',
'env' => '<string>',
'file' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.instabox.sh/v1/machines/{id}/secrets"
payload := strings.NewReader("{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.instabox.sh/v1/machines/{id}/secrets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.instabox.sh/v1/machines/{id}/secrets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"secrets\": \"all\",\n \"envSecrets\": [\n \"<string>\"\n ],\n \"directSecrets\": [\n {\n \"secret\": \"<string>\",\n \"env\": \"<string>\",\n \"file\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"secrets": "all",
"envSecrets": [
"<string>"
],
"directSecrets": [
{
"secret": "<string>",
"env": "<string>",
"file": "<string>"
}
],
"items": [
{
"id": "<string>",
"orgId": "<string>",
"name": "<string>",
"delivery": "proxy",
"hosts": [
"<string>"
],
"version": 2,
"size": 1,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
],
"version": 123,
"proxy": {
"state": "inactive",
"revision": 123,
"appliedRevision": 123,
"expiresAt": "2023-11-07T05:31:56Z"
},
"guest": {
"state": "inactive",
"revision": 123,
"appliedRevision": 123,
"items": [
{
"id": "<string>",
"name": "<string>",
"delivery": "proxy",
"version": 123,
"env": "<string>",
"file": "<string>"
}
],
"appliedAt": "2023-11-07T05:31:56Z",
"error": "<string>"
},
"usage": [
{
"name": "<string>",
"requests": 123,
"denied": 123,
"lastUsedAt": "2023-11-07T05:31:56Z"
}
]
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"requestId": "<string>",
"retryable": true,
"operationId": "<string>",
"reason": "missing_key",
"hint": "<string>",
"docs": "<string>",
"docs_url": "<string>",
"requiredScopes": [
"<string>"
],
"retryAfterSeconds": 2,
"at": "2023-11-07T05:31:56Z"
}
}Authorizations
Opaque instabox access token (1 hour). Refresh with /v1/auth/refresh (refresh token valid 30 days, rotates on use).
Path Parameters
Sandbox ID (m_ + 26 lowercase base32 characters) or the sandbox's name (unique among your sandboxes; names never contain _, so the two never collide). Older servers take only the ID and answer 404 for a name.
^(m_[a-z2-7]{26}|[a-z0-9][a-z0-9-]{0,62})$Body
Proxy selection only. All includes current and future proxy Secrets in the sandbox's org. Explicit names resolve to stable IDs. An empty array selects none. Deleting and recreating a name does not restore an explicit grant. Null is rejected.
"all"Explicit env names; [] clears. Omission keeps the prior list. Null and all are rejected.
A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.
^[A-Za-z_][A-Za-z0-9_]{0,127}$Replaces the direct references in full; [] clears. Not sent together with envSecrets. Null is rejected.
64Show child attributes
Show child attributes
Response
Saved selections and their current delivery status.
Proxy selection only. All includes current and future proxy Secrets in the sandbox's org. Explicit names resolve to stable IDs. An empty array selects none. Deleting and recreating a name does not restore an explicit grant. Null is rejected.
"all"Direct references that are exactly the same-name shorthand ({secret X, env X}, no file). Renamed and file references appear only in directSecrets.
A unique environment variable name within an org. The names a sandbox's env reserves are reserved (shell variables such as PATH, HOME, BASH_ENV, ENV and IFS, session and trust-store variables, and INSTABOX_ and SSH_ prefixes). A Secret saved under a name before it was reserved is not delivered: the machine's guest status names it.
^[A-Za-z_][A-Za-z0-9_]{0,127}$Direct references (names and paths, never values), envSecrets included.
Show child attributes
Show child attributes
Effective selected Secrets, including proxy all. Metadata only.
Show child attributes
Show child attributes
Version of this sandbox's selection configuration.
Last node acknowledgement, not continuous health. Policies expire within 60 seconds unless renewed. Revocation is pending until applied or the previous lease expires. Already admitted streams may finish.
Show child attributes
Show child attributes
Managed environment and public CA installation. This does not prove existing processes reloaded values. Removing env access cannot remove values already copied into process memory, files, or snapshots.
Show child attributes
Show child attributes
Present when the server records proxied request counts: one entry per selected proxy Secret.
Show child attributes
Show child attributes
Was this page helpful?