Start safely on Basic, move to recommended Pro for production workflows and opt-in public HTTPS, choose Ultra for serious session usage and domain controls, or use Mega's 200,000-request RapidAPI subscription-period allowance for scale.
Managed public HTTPS is shipped for paid, opt-in API requests. Customer-facing audit access and a static egress IP remain planned or deployment-dependent. RapidAPI owns the subscription-period allowances; SandboxAPI applies the listed per-minute burst limits without a duplicate calendar-month counter.
| Feature | Basic | Pro | Ultra | Mega |
|---|---|---|---|---|
| Monthly price | $0 | $19 | $49 | $149 |
| RapidAPI plan requests / subscription period | 500 | 10,000 | 50,000 | 200,000 |
| Sync / stream timeout | 30s | 60s | 150s | 150s |
| Production async timeout | 30s | 60s | 300s | 600s |
| Max accepted items / batch | 10 | 50 | 100 | 200 |
| Service rate limit (req/min) | 15 | 30 | 60 | 60 |
| 8 languages | ✓ | ✓ | ✓ | ✓ |
| gVisor isolation | ✓ | ✓ | ✓ | ✓ |
| Stdin support | ✓ | ✓ | ✓ | ✓ |
| Batch execution | ✓ | ✓ | ✓ | ✓ |
| Streaming output | ✓ | ✓ | ✓ | ✓ |
| Async polling | Enabled in production · explicit async returns 503 if temporarily unavailable | |||
| Stateful sessions | — | 2 concurrent | 5 concurrent | 8 concurrent |
| Session idle maximum | — | 15 min | 30 min | 30 min |
| Session execute timeout | — | 60s | 150s | 150s |
| Package install | — | direct-artifact wheels/npm · curated | direct-artifact wheels/npm · curated | direct-artifact wheels/npm · curated |
| Installs / RapidAPI account / hour | — | 60 | 300 | 300 |
| Default network state | Off | Off | Off | Off |
| Opt-in managed public HTTPS | — | ✓ | ✓ | ✓ |
allowed_domains controls | — | — | Up to 32 | Up to 32 |
| Production egress defaults | — | 8 concurrent tunnels · 25 MiB aggregate per execution | ||
| Structured operator egress logs | — | ✓ | ✓ | ✓ |
| Customer audit logs | — | — | — | Planned |
| Static egress IP | — | — | — | Planned · deployment-dependent |
| Hosted MCP — 4 stateless tools | ✓ | ✓ | ✓ | ✓ |
| RapidAPI bandwidth | 10,240 MB/month currently included · 1 MB per unit · then $0.001 per MB | |||
RapidAPI's gateway maximum is 180 seconds. SandboxAPI caps response-held sync, stream, session, hosted MCP, and batch work at 150 seconds, retaining 30 seconds for response delivery and cleanup. Ultra's 300s and Mega's 600s limits are production-async only; an explicit async request returns HTTP 503 if that service is temporarily unavailable and never falls back to sync.
Session caps are per-RapidAPI-account ceilings. Shared service capacity is not reserved; during saturation, session creation may return HTTP 503 with Retry-After.
The listed service rate limits are SandboxAPI's per-subscriber burst limits. RapidAPI's separate marketplace rate settings may differ; both layers apply.
--only-binary=:all: --no-deps --no-build-isolation; source distributions are rejected. npm downloads with npm pack --ignore-scripts, validates and extracts the direct package, and strips dependency and lifecycle-script metadata. List every required package explicitly; transitive dependency resolution is planned. The deprecated options.no_deps field is forced true, so setting it to false does not enable dependencies.*.example.com rules; an empty list means all public HTTPS. Batch execution stays networkless and rejects network.enabled=true so one outbound budget maps to one RapidAPI request. Customer-facing audit logs and a static egress IP remain planned or deployment-dependent.HTTPS_PROXY or be configured for it. Some Node built-in fetch and Java configurations do not do that automatically, and raw public sockets are unavailable. Production defaults cap each execution at 8 concurrent tunnels and 25 MiB aggregate transfer, with duration capped by the execution timeout. It relays opaque TLS rather than inspecting HTTP content, so domain rules are routing controls—not content-level DLP. Connection outcomes are recorded in structured operator egress logs. A session's destination policy is fixed at creation, current plan eligibility is rechecked, and credentials refresh on every execute. Stable pip/npm installs use a separate managed install-proxy path only after firewall/topology and mirror/OSV readiness checks pass; otherwise installs are disabled.Use Basic to validate your integration. Recommended Pro adds the runtime headroom, sessions, package workflows, and opt-in managed public HTTPS most production apps need.