These Terms of Service (the "Terms") govern your access to and use of SandboxAPI (the "Service"), a code-execution API operated by SandboxAPI ("we", "us", or "our"). By accessing or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.
1. Description of the Service
SandboxAPI provides an HTTP API that executes user-supplied source code in isolated, ephemeral sandbox environments. The Service runs code on infrastructure operated by us and returns the resulting output. The Service is intended for legitimate software development, testing, education, and AI-agent use cases.
2. Account and access
Access to the Service is provided through the RapidAPI marketplace at rapidapi.com/sandboxapidev/api/sandboxapi. You are responsible for maintaining the confidentiality of your RapidAPI credentials and for all activity that occurs under your account. You must be at least 16 years old (or the age of digital consent in your jurisdiction) to use the Service.
3. Acceptable use
You may use the Service to execute code that you own, have a license to use, or are otherwise authorized to run. You agree not to use the Service to:
- Attack, scan, probe, or otherwise harm any system, network, or service, including ours;
- Attempt to escape, break out of, or circumvent the sandbox isolation, including by exploiting kernel, container, or hypervisor vulnerabilities;
- Mine cryptocurrency or perform other workloads whose primary purpose is to consume compute resources for monetary gain;
- Send unsolicited communications (email, SMS, etc.) or generate traffic intended to harass, defraud, or deceive;
- Host or proxy traffic for third parties, run open relays, or use the Service as a general-purpose internet egress point;
- Process or transmit content that is illegal in your jurisdiction or ours, including child sexual abuse material, content that infringes intellectual property rights, or content that violates export-control or sanctions laws;
- Attempt to access, modify, or interfere with other users' executions, sessions, or data;
- Reverse-engineer the Service, except to the extent permitted by applicable law that cannot be contractually waived;
- Use the Service to train, build, or operate a competing code-execution API.
One-strike enforcement. We may suspend or terminate access without notice for any conduct we reasonably believe violates this section, especially abuse that endangers other users or our infrastructure.
4. Quotas, rate limits, and fair use
Each pricing tier includes a request allowance owned and reset by RapidAPI on its marketplace subscription period, plus documented request-rate, timeout, and accepted-batch-item limits. SandboxAPI enforces only the per-minute burst rate and has no duplicate calendar-month allowance counter. One call to any endpoint counts as one RapidAPI request. A batch call counts as one request regardless of its item count, while each session endpoint call counts separately. Batch counts are request-size limits, not parallelism guarantees: items run through bounded workers and the entire batch request has a 150-second wall-clock budget. RapidAPI's gateway maximum is 180 seconds, so response-held work stops at 150 seconds to preserve 30 seconds for delivery and cleanup. Ultra 300-second and Mega 600-second jobs are async-only; explicit async returns 503 if its queue is unavailable and never falls back to sync. Limits are listed at sandboxapi.dev/pricing and on the RapidAPI listing. Exceeding documented limits may result in throttling (HTTP 429) or, for repeated violations, suspension. We reserve the right to apply additional fair-use limits to protect the Service from abuse.
5. Billing and refunds
All billing is handled by RapidAPI under RapidAPI's terms. RapidAPI measures bandwidth in 1 MB units, with 10,240 MB/month currently included on every plan, then charges $0.001 per MB above that allowance, separately from each plan's subscription-period request allowance. We do not charge you directly. Cancellations, refunds, plan changes, invoices, and current marketplace billing settings are managed through your RapidAPI account. Free-tier usage is provided as-is and may be modified or discontinued.
6. Your content
You retain all rights to the source code, inputs, and outputs you submit to the Service ("Your Content"). You grant us a limited, worldwide, non-exclusive license to receive, process, transiently store, and return Your Content solely to operate the Service. We do not claim ownership of Your Content and we do not use Your Content to train machine-learning models.
You are solely responsible for ensuring you have the necessary rights to submit Your Content and that doing so does not violate any applicable law or third-party right.
7. Data and logs
We log operational metadata about each request — including timestamps, language, status code, execution duration, IP address, and the originating RapidAPI account — for the purpose of operating, securing, and billing the Service. Standard application logs exclude source code, stdin, stdout, and stderr. Synchronous request bodies and results are handled inline. Production async execution stores submitted code, stdin, job metadata, and the eventual result in Redis so polling and crash recovery work; those job records expire after the configured job TTL, which is 24 hours by default. Any separately enabled execution audit log is an opt-in operational control with its own retention and access policy.
When controlled HTTPS egress is enabled, structured operator egress logs also record tunnel metadata such as the execution identifier, requested hostname, selected public IP, outcome, duration, and transfer counts. Customer-facing access to those audit records is planned and is not part of the current self-serve plans.
We may retain bounded operational error metadata temporarily for debugging when an execution fails internally; standard logs still exclude source code, stdin, stdout, and stderr. We do not sell user data.
8. Service availability
We work hard to keep the Service available, but we provide it on a best-effort basis. There is no guaranteed uptime or service level (SLA) for any tier unless explicitly stated in a separately signed agreement. The Service may be unavailable due to maintenance, upstream failures, or events outside our reasonable control.
9. Security and responsible disclosure
We operate the sandbox under defense-in-depth (Docker, gVisor user-space kernel, network off by default, and resource limits). Basic and playground workloads cannot enable outbound access. Paid API requests may opt in to managed public HTTPS using network.enabled; Pro cannot submit custom domain rules, while Ultra and Mega may optionally provide exact or explicit *.example.com rules in allowed_domains, up to 32 entries. The proxy accepts HTTPS CONNECT only on port 443, rejects raw-IP and private, internal, or special-purpose destinations, pins DNS, requires matching TLS SNI, and uses signed short-lived per-execution tokens. Production defaults cap each execution at 8 concurrent tunnels and 25 MiB aggregate transfer, with tunnel duration capped by the execution timeout. Session policy is fixed at creation and credentials are refreshed for each execute. Stable pip/npm installation uses a separate managed install-proxy path only after firewall/topology and mirror/OSV readiness checks pass; otherwise installs are disabled. Installs publish only explicitly requested artifacts: pip accepts cached wheels only with --only-binary=:all: --no-deps --no-build-isolation and rejects source distributions, while npm uses validated npm pack --ignore-scripts extraction with dependency and lifecycle-script metadata removed. Transitive dependency resolution is planned. A static egress IP is planned and deployment-dependent. No system is perfectly secure. If you believe you have found a security vulnerability, please email security@sandboxapi.dev with details and a reproduction. Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.
10. Disclaimer of warranties
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE. YOU USE THE SERVICE AT YOUR OWN RISK.
11. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL WE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE. OUR TOTAL AGGREGATE LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATED TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US (THROUGH RAPIDAPI) FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM OR (B) USD 50.
12. Indemnification
You agree to indemnify and hold harmless SandboxAPI and its operators against any claim, damage, or expense (including reasonable legal fees) arising from (a) Your Content, (b) your use of the Service in violation of these Terms, or (c) your violation of any law or third-party right.
13. Termination
You may stop using the Service at any time by cancelling your RapidAPI subscription. We may suspend or terminate your access to the Service at any time, with or without notice, if we reasonably believe you have violated these Terms or pose a risk to the Service or other users. On termination, sections that by their nature should survive (including Sections 6, 7, 10, 11, 12, and 16) will survive.
14. Changes to the Service and these Terms
We may modify the Service — including adding, removing, or changing features, language versions, or pricing tiers — at any time. We may update these Terms by posting an updated version at this URL. Material changes will be indicated by updating the "Last updated" date at the top. Your continued use of the Service after a change constitutes acceptance of the updated Terms.
15. Third-party services
The Service depends on third-party providers, including RapidAPI (billing and authentication), Cloudflare (edge and DNS), and our infrastructure host. Your use of those services is subject to their own terms. We are not responsible for the acts or omissions of third parties.
16. Governing law and disputes
These Terms are governed by the laws of the Netherlands, without regard to conflict-of-laws principles. Any dispute arising out of or related to these Terms or the Service will be submitted to the exclusive jurisdiction of the competent courts of Amsterdam, the Netherlands, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property.
17. Contact
Questions about these Terms? Email hello@sandboxapi.dev.