SandboxAPI — Code Execution API for AI Agents

8 languages. gVisor isolation. Stateful sessions with file and package persistence. Opt-in managed public HTTPS for paid API plans. Streaming, async polling, and MCP-native tools.

Current API version: 4.0.0 · Base URL via RapidAPI: https://sandboxapi.p.rapidapi.com

Quick Start #

Direct API access

When direct accounts are enabled, sign in and create an API key in your dashboard. Save it as SANDBOXAPI_KEY in your server environment and call:

curl --fail-with-body https://api.sandboxapi.dev/v1/execute \
  -H "Authorization: Bearer $SANDBOXAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{"language":"python3","code":"print(2 + 2)"}'

Keep the key in your server or secret manager. Never embed it in browser code. Direct keys and RapidAPI keys are separate credentials with separate subscriptions and allowances. Direct workspace usage includes authenticated playground runs. Basic resets at the start of each UTC month; paid direct allowances reset on the verified billing period. One accepted request costs one unit, including a batch; code failures count, confirmed infrastructure failures do not. Direct access stops at the allowance without automatic overage billing.

The examples and marketplace pricing below use the RapidAPI distribution channel. Direct clients use the same execution endpoints with the direct origin and Bearer header above. Hosted MCP currently uses RapidAPI credentials.

Synchronous execution #

curl -X POST https://sandboxapi.p.rapidapi.com/v1/execute \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -H "X-RapidAPI-Host: sandboxapi.p.rapidapi.com" \
  -d '{"language":"python3","code":"print(\"Hello, World!\")"}'

Response:

{
  "id": "exec_abc123",
  "status": "completed",
  "language": "python3",
  "stdout": "Hello, World!\n",
  "stderr": "",
  "exit_code": 0,
  "execution_time_ms": 42,
  "memory_used_kb": 8192,
  "timeout": 10,
  "created_at": "2026-06-25T10:00:00Z"
}

Stateful session 3.2.0 #

Sessions hold a sandbox open between calls. Files and installed packages persist for the session's idle TTL (max 30 minutes). Each call still runs in a fresh interpreter, so keep durable state on disk.

# 1. Create a session
curl -X POST https://sandboxapi.p.rapidapi.com/v1/sessions \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"language":"python3","idle_ttl":300}'
# → {"id":"sess_abc","language":"python3","expires_at":"..."}

# 2. Execute — writes durable state to the session filesystem
curl -X POST https://sandboxapi.p.rapidapi.com/v1/sessions/sess_abc/execute \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"code":"from pathlib import Path\nPath(\"state.txt\").write_text(\"42\")"}'

# 3. Execute again — the file is still there
curl -X POST https://sandboxapi.p.rapidapi.com/v1/sessions/sess_abc/execute \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"code":"from pathlib import Path\nprint(int(Path(\"state.txt\").read_text()) * 2)"}'
# → stdout: "84\n"

Package installation in a session 3.3.0 #

curl -X POST https://sandboxapi.p.rapidapi.com/v1/sessions/sess_abc/install \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"manager":"pip","packages":["pandas","numpy"]}'

Supported stable managers for current public runtimes are pip for Python and npm for JavaScript/TypeScript. They install only the artifacts explicitly listed in packages from a curated cache behind the managed install proxy. pip accepts cached wheels only with --only-binary=:all: --no-deps --no-build-isolation; source distributions are rejected. npm uses npm pack --ignore-scripts, validates and extracts the direct tarball, and removes dependency and lifecycle-script metadata. Transitive dependencies are not resolved yet, so list every required package explicitly. The deprecated options.no_deps field is forced true; setting it to false does not enable dependencies.

Streaming output 3.1.0 #

curl -N -X POST https://sandboxapi.p.rapidapi.com/v1/execute/stream \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"language":"python3","code":"for i in range(5):\n  print(i); import time; time.sleep(1)"}'
# → SSE events: stdout, stdout, ..., result

Events use the standard SSE format. The terminal event has event: result with a JSON payload that includes exit_code, execution_time_ms, and memory_used_kb.

Async polling 3.1.0 #

curl -X POST "https://sandboxapi.p.rapidapi.com/v1/execute?async=true" \
  -H "X-RapidAPI-Key: YOUR_API_KEY" \
  -d '{"language":"python3","code":"..."}'
# → {"job_id":"job_xyz","status":"queued","poll_url":"/v1/executions/job_xyz"}

curl https://sandboxapi.p.rapidapi.com/v1/executions/job_xyz \
  -H "X-RapidAPI-Key: YOUR_API_KEY"
# Terminal responses include either result or error fields.

Production async is enabled. Ultra may request up to 300 seconds and Mega up to 600 seconds. If the queue is temporarily unavailable, an explicit async request returns HTTP 503 and never falls back to sync.

Supported Languages #

Language	Version	ID
Python	3.12	python3
JavaScript	Node 22	javascript
TypeScript	5.6.3 (esbuild + Node 22)	typescript
Go	1.22	go
Java	21	java
C++	GCC 12 / C++17	cpp
C	GCC 12 / GNU C17	c
Bash	5.2	bash

TypeScript source is transpiled and bundled by esbuild 0.24 before Node 22 executes it. The API does not run a separate full tsc type-checking pass. C++ compiles with -std=c++17; C compiles with -std=gnu17.

Request Parameters #

The complete HTTP request body is capped at 2 MiB, including JSON encoding overhead. The 1 MiB limits for code and stdin are field limits inside that shared envelope. For batch requests, every item must fit in the same 2 MiB body. Each batch result caps stdout at 16 KiB and stderr at 16 KiB and sets truncated: true when either stream exceeds its cap; single and session execution keep their 1 MiB-per-stream output caps.

Controlled public HTTPS egress #

Outbound network is off by default. Basic requests and the browser playground are denied network access. Pro, Ultra, and Mega API clients can opt in to managed public HTTPS on single, streaming, or async execution, or when creating a session. Batch execution stays networkless: a batch containing network.enabled=true is rejected with BATCH_NETWORK_UNSUPPORTED, so each outbound budget maps to one RapidAPI request.

This is explicit proxy-based egress, not transparent internet access. Your HTTP client or library must honor the injected HTTPS_PROXY environment variable or be explicitly configured to use it. Clients that bypass proxy settings—including some Node built-in fetch and Java configurations—do not automatically work. Raw public sockets and direct public routes are unavailable.

{
  "language": "python3",
  "code": "from urllib.request import urlopen; print(urlopen('https://api.github.com/rate_limit').status)",
  "network": {
    "enabled": true
  }
}

Pro may enable managed public HTTPS but cannot submit allowed_domains. Ultra and Mega may optionally provide up to 32 exact hostnames or explicit leading-wildcard rules such as *.example.com. On Ultra or Mega, an omitted or empty allowed_domains list means all public HTTPS destinations remain eligible; the proxy safety rules still apply.

"network": {
  "enabled": true,
  "allowed_domains": ["api.github.com", "*.githubusercontent.com"]
}

For an Ultra or Mega session with fixed domain controls, put the same object on POST /v1/sessions:

Network-enabled session calls run in short-lived gVisor workers sharing the session's files. The persistent container stays networkless. Files persist between calls, but leftover child processes from a network-enabled call are stopped before its response; background services and process memory do not persist.

{
  "language": "python3",
  "idle_ttl": 300,
  "network": {
    "enabled": true,
    "allowed_domains": ["api.example.com"]
  }
}

The session policy is fixed at creation; it cannot be broadened by a later execute request. Current plan eligibility is rechecked on each call, so a downgrade requires a new session. Signed proxy credentials are refreshed for each session execute.

• The managed proxy accepts HTTPS CONNECT only on port 443. Raw-IP targets and private, internal, or special-purpose IP ranges are blocked.
• DNS is resolved and pinned to the approved public address, and TLS SNI must match the requested hostname.
• Each run receives signed, short-lived per-execution tokens. Production defaults allow 8 concurrent tunnels and 25 MiB aggregate transfer per execution.
• Tunnel duration is capped by the execution timeout. Structured operator egress logs record connection outcomes and metering data.
• Package installation uses a separate managed install-proxy path only after firewall/topology and mirror/OSV readiness checks pass; enabling network does not change package-source policy.

The proxy validates the CONNECT hostname, pinned public DNS answer, and outer TLS ClientHello SNI, then relays opaque TLS. It does not inspect encrypted HTTP hosts, paths, or payloads. Use domain rules as outbound routing controls, not as a content-level data-loss-prevention boundary.

Response Fields #

Error Handling #

SandboxAPI distinguishes between API errors (HTTP 4xx/5xx) and execution errors (HTTP 200 with a status field). Treat any HTTP 200 response as a successful API call — the status tells you whether the user's code ran cleanly.

Pricing & Rate Limits #

All plans include gVisor isolation, 8 languages, stdin, batch execution, streaming output, production async polling, and the playground. Sessions and stable direct-artifact pip/npm installation from the curated popular-package cache are available on paid plans. Pro allows 2 concurrent sessions per RapidAPI account, Ultra allows 5, and Mega allows 8. Response-held sync/stream and sessions cap at 60s on Pro and 150s on Ultra/Mega; only production async exposes Ultra 300s and Mega 600s. Mega also includes 200,000 requests per RapidAPI subscription period, up to 200 accepted items per batch, a 30-minute idle maximum, and 300 installs per subscriber identity/hour. See pricing for the full comparison.

Gateway and batch capacity: RapidAPI holds a request for at most 180 seconds. SandboxAPI stops response-held work at 150 seconds, preserving 30 seconds for delivery and cleanup. Plan batch values are maximum accepted item counts, not parallelism guarantees; items run through bounded workers within that 150-second request wall-clock budget.

Session capacity: Session caps are per-RapidAPI-account ceilings. Shared service capacity is not reserved; during saturation, session creation may return HTTP 503 with Retry-After.

Request billing: One call to any endpoint counts as one RapidAPI request. A batch call is one request regardless of the number of items; each session endpoint call is a separate request. Starting an async job is one request, and every later polling call is another request.

Allowance ownership: RapidAPI owns and resets included requests on the marketplace subscription period. SandboxAPI separately enforces only the listed per-minute burst limit; it has no duplicate calendar-month counter.

Bandwidth billing: RapidAPI measures bandwidth in 1 MB units, with 10,240 MB/month currently included on every plan, then charges $0.001 per MB above that allowance. This platform fee is separate from the subscription-period request allowance and the proxy's per-execution transfer safety cap.

Security #

Every execution runs inside an OCI container backed by gVisor. The production configuration requires runsc, which mediates application syscalls through a user-space kernel and adds an isolation boundary beyond the container runtime. This is combined with strict resource limits, network off by default, no persistent storage for synchronous execution, and per-request cleanup.

• gVisor (runsc) wraps every container; user-space syscall filter blocks risky calls before the host kernel sees them.
• CPU, memory (swap disabled), PID count, and tmpfs size are enforced as container limits under gVisor.
• Network egress remains disabled unless a paid request is explicitly authorized for the managed HTTPS proxy. Basic and playground workloads stay network-disabled.
• Stable pip/npm installs run through a separate short-lived installer and managed install proxy after fail-closed topology/readiness checks; managed egress does not bypass that path.
• Synchronous executions retain no data. Async results live for 24h. Session state expires at the idle TTL (max 30 min).

Opted-in paid workloads use managed public HTTPS only: destination validation, DNS pinning, SNI enforcement, signed short-lived credentials, connection and transfer ceilings, structured operator logging, and public-address-only routing.

MCP Server #

The hosted Streamable HTTP adapter at https://mcp.sandboxapi.dev/mcp exposes four stateless tools: execute_code, execute_batch, list_languages, and get_capabilities. Each invocation is forwarded through RapidAPI using the caller's subscription key. Sessions, package install, managed HTTPS, streaming, and async are REST-only.

Claude Code, Codex, Cursor, VS Code, and Antigravity support remote MCP with Bearer authentication. Use the client setup guide for each client's configuration format. For VS Code, add this to .vscode/mcp.json to use a prompted secret:

{
  "inputs": [{
    "type": "promptString",
    "id": "sandboxapi-key",
    "description": "SandboxAPI RapidAPI key",
    "password": true
  }],
  "servers": {
    "sandboxapi": {
      "type": "http",
      "url": "https://mcp.sandboxapi.dev/mcp",
      "headers": { "Authorization": "Bearer ${input:sandboxapi-key}" }
    }
  }
}

Claude Desktop's remote connector UI also supports request headers for organizations with access to Anthropic's limited beta. SandboxAPI OAuth onboarding is planned. Keep keys in environment variables, secret stores, or personal configuration; never place a RapidAPI key in the endpoint URL.

Full integration guide on the MCP page.

Code Examples #

Python (requests)

import requests

resp = requests.post(
    "https://sandboxapi.p.rapidapi.com/v1/execute",
    headers={
        "X-RapidAPI-Key": "YOUR_API_KEY",
        "X-RapidAPI-Host": "sandboxapi.p.rapidapi.com",
    },
    json={"language": "python3", "code": "print(2 + 2)"},
)
data = resp.json()
print(data["stdout"])  # → "4\n"

JavaScript (fetch)

const resp = await fetch("https://sandboxapi.p.rapidapi.com/v1/execute", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_API_KEY",
    "X-RapidAPI-Host": "sandboxapi.p.rapidapi.com",
  },
  body: JSON.stringify({ language: "javascript", code: "console.log(2 + 2)" }),
});
const data = await resp.json();
console.log(data.stdout); // → "4\n"

Go

req, _ := http.NewRequest("POST", "https://sandboxapi.p.rapidapi.com/v1/execute",
  strings.NewReader(`{"language":"go","code":"package main\nimport \"fmt\"\nfunc main(){fmt.Println(2+2)}"}`))
req.Header.Set("X-RapidAPI-Key", "YOUR_API_KEY")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()

Changelog #

Read the full release-by-release changelog →