### GET /v1/installations/{integrationConfigurationId}/resources Source: https://openapi.vercel.sh/ Get all resources for a given installation ID. ```markdown ### Parameters - **integrationConfigurationId** (string, path, required) ### Responses #### 200 - response - **resources** (array (object)) (required) Array items: - **partnerId** (string) (required): The ID provided by the partner for the given resource - **internalId** (string) (required): The ID assigned by Vercel for the given resource - **name** (string) (required): The name of the resource as it is recorded in Vercel - **status** (string (error|ready|pending|onboarding|suspended|resumed|uninstalled)): The current status of the resource ("error"|"ready"|"pending"|"onboarding"|"suspended"|"resumed"|"uninstalled") - **productId** (string) (required): The ID of the product the resource is derived from - **protocolSettings** (object): Any settings provided for the resource to support its product's protocols - **experimentation** (object) - **edgeConfigSyncingEnabled** (boolean) ("false"|"true") - **edgeConfigId** (string) - **edgeConfigTokenId** (string) - **notification** (object): The notification, if set, displayed to the user when viewing the resource in Vercel - **level** (string (error|info|warn)) (required) ("error"|"info"|"warn") - **title** (string) (required) - **message** (string) - **href** (string) - **billingPlanId** (string): The ID of the billing plan the resource is subscribed to, if applicable - **metadata** (object): The configured metadata for the resource as defined by its product's Metadata Schema #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X GET "https://api.vercel.com/v1/installations/{integrationConfigurationId}/resources" ``` ``` -------------------------------- ### GET /v1/projects/{projectIdOrName}/feature-flags/sdk-keys Source: https://openapi.vercel.sh/ Gets all SDK keys for a project. ```markdown ### Parameters - **projectIdOrName** (string, path, required): The project id or name - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Responses #### 200 - response - **data** (array (object)) (required) Array items: - **hashKey** (string) (required) - **projectId** (string) (required) - **type** (string (server|mobile|client)) (required) ("server"|"mobile"|"client") - **environment** (string) (required) - **createdBy** (string) (required) - **createdAt** (number) (required) - **updatedAt** (number) (required) - **label** (string) - **deletedAt** (number) - **partialKeyValue** (string) (required): Partially-masked representation of the SDK key value, safe to display in UIs. The value is the `vf__` prefix followed by the first 3 characters of the secret portion and a fixed 8-character `*` mask (e.g. `vf_server_abc********`). #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 402 - The account is missing a payment so payment method must be updated The account is missing a payment so payment method must be updated #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X GET "https://api.vercel.com/v1/projects/{projectIdOrName}/feature-flags/sdk-keys?teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" ``` ``` -------------------------------- ### POST /v1/installations/{integrationConfigurationId}/billing/balance Source: https://openapi.vercel.sh/ Sends the prepayment balances. The partner should do this at least once a day and ideally once per hour.
Use the `credentials.access_token` we provided in the [Upsert Installation](#upsert-installation) body to authorize this request. ```markdown ### Parameters - **integrationConfigurationId** (string, path, required) ### Request Body **Content-Type:** application/json - **timestamp** (string (date-time)) (required): Server time of your integration, used to determine the most recent data for race conditions & updates. Only the latest usage data for a given day, week, and month will be kept. - **balances** (array (object)) (required) Array items: - **resourceId** (string): Partner's resource ID, exclude if credits are tied to the installation and not an individual resource. - **credit** (string): A human-readable description of the credits the user currently has, e.g. "2,000 Tokens" - **nameLabel** (string): The name of the credits, for display purposes, e.g. "Tokens" - **currencyValueInCents** (number) (required): The dollar value of the credit balance, in USD and provided in cents, which is used to trigger automatic purchase thresholds. ### Responses #### 201 - response Empty response body #### 400 - One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X POST "https://api.vercel.com/v1/installations/{integrationConfigurationId}/billing/balance" \ -H "Content-Type: application/json" \ -d '{ "timestamp": "2023-01-01T00:00:00Z", "balances": [ { "resourceId": "string", "credit": "string", "nameLabel": "string", "currencyValueInCents": "0" } ] }' ``` ``` -------------------------------- ### GET /v1/webhooks/{id} Source: https://openapi.vercel.sh/ Get a webhook ```markdown ### Parameters - **id** (string, path, required) - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Responses #### 200 - response - **events** (array (string (budget.reached|domain.created|domain.dns.records.changed|domain.transfer-in.started|domain.transfer-in.completed|domain.transfer-in.failed|domain.certificate.add|domain.certificate.add.failed|domain.certificate.renew|domain.certificate.renew.failed|domain.certificate.deleted|domain.renewal|domain.renewal.failed|domain.auto-renew.changed|deployment.created|deployment.build-requested|deployment.cleanup|deployment.error|deployment.blocked|deployment.canceled|deployment.succeeded|deployment.ready|deployment.check-rerequested|deployment.promoted|deployment.rollback|deployment.integration.action.start|deployment.integration.action.cancel|deployment.integration.action.cleanup|deployment.checkrun.start|deployment.checkrun.cancel|edge-config.created|edge-config.deleted|edge-config.items.updated|firewall.attack|firewall.system-rule-anomaly|firewall.custom-rule-anomaly|function.archival-required|function.removal-required|alerts.triggered|integration-configuration.permission-upgraded|integration-configuration.removed|integration-configuration.scope-change-confirmed|integration-configuration.transferred|integration-resource.project-connected|integration-resource.project-disconnected|project.created|project.removed|project.renamed|project.env-variable.created|project.env-variable.updated|project.env-variable.deleted|project.domain.created|project.domain.updated|project.domain.deleted|project.domain.verified|project.domain.unverified|project.domain.moved|project.rolling-release.started|project.rolling-release.aborted|project.rolling-release.completed|project.rolling-release.approved|deployment.checks.failed|deployment.checks.succeeded|deployment-checks-completed|deployment-ready|deployment-prepared|deployment-error|deployment-check-rerequested|deployment-canceled|project-created|project-removed|domain-created|deployment|integration-configuration-permission-updated|integration-configuration-removed|integration-configuration-scope-change-confirmed|marketplace.member.changed|marketplace.invoice.created|marketplace.invoice.paid|marketplace.invoice.notpaid|marketplace.invoice.overdue|marketplace.invoice.refunded|ai-gateway.balance-depleted|ai-gateway.auto-reload.limit-reached|observability.anomaly|observability.anomaly-error|observability.usage-anomaly|observability.error-anomaly|botid.anomaly|flag.created|flag.updated|flag.deleted|flag.segment.created|flag.segment.updated|flag.segment.deleted|test-webhook|message.created|message.updated|message.deleted|thread.resolved|thread.unresolved|message.reaction-added|message.reaction-removed|message.mentioned|comment.created|comment.updated|comment.deleted|comment.resolved|comment.unresolved|comment.reaction-added|comment.reaction-removed|comment.mentioned))) (required): The webhooks events (example: "deployment.created") - **id** (string) (required): The webhook id (example: "account_hook_GflD6EYyo7F4ViYS") - **url** (string) (required): A string with the URL of the webhook (example: "https://my-webhook.com") - **ownerId** (string) (required): The unique ID of the team the webhook belongs to (example: "ZspSRT4ljIEEmMHgoDwKWDei") - **createdAt** (number) (required): A number containing the date when the webhook was created in in milliseconds (example: 1567024758130) - **updatedAt** (number) (required): A number containing the date when the webhook was updated in in milliseconds (example: 1567024758130) - **projectIds** (array (string)): The ID of the projects the webhook is associated with (example: ["prj_12HKQaOmR5t5Uy6vdcQsNIiZgHGB"]) #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. ### Example Usage ```bash curl -X GET "https://api.vercel.com/v1/webhooks/{id}?teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" ``` ``` -------------------------------- ### POST /v1/installations/{integrationConfigurationId}/billing/finalize Source: https://openapi.vercel.sh/ This endpoint allows the partner to mark an installation as finalized. This means you will not send any more invoices for the installation. Use this after a customer has requested uninstall and you have sent any remaining invoices. This will allow the uninstall process to proceed immediately after all invoices have been paid.
Use the `credentials.access_token` we provided in the [Upsert Installation](#upsert-installation) body to authorize this request. ```markdown ### Parameters - **integrationConfigurationId** (string, path, required) ### Responses #### 204 - response Empty response body #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X POST "https://api.vercel.com/v1/installations/{integrationConfigurationId}/billing/finalize" ``` ``` -------------------------------- ### GET /v1/webhooks Source: https://openapi.vercel.sh/ Get a list of webhooks ```markdown ### Parameters - **projectId** (string, query, optional) - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Responses #### 200 - response - Array of object - **projectsMetadata** (array (object)) (required) Array items: - **id** (string) (required) - **name** (string) (required) - **framework** (string (blitzjs|nextjs|gatsby|remix|react-router|astro|hexo|eleventy|docusaurus-2|docusaurus|preact|solidstart-1|solidstart|dojo|ember|vue|scully|ionic-angular|angular|polymer|svelte|sveltekit|sveltekit-1|ionic-react|create-react-app|gridsome|umijs|sapper|saber|stencil|nuxtjs|redwoodjs|hugo|jekyll|brunch|middleman|zola|hydrogen|vite|tanstack-start|vitepress|vuepress|parcel|fastapi|flask|fasthtml|django|ash|sanity-v3|sanity|storybook|nitro|hono|express|h3|koa|nestjs|elysia|fastify|xmcp|python|ruby|rust|axum|actix-web|node|go|services|mastra|)) ("blitzjs"|"nextjs"|"gatsby"|"remix"|"react-router"|"astro"|"hexo"|"eleventy"|"docusaurus-2"|"docusaurus"|"preact"|"solidstart-1"|"solidstart"|"dojo"|"ember"|"vue"|"scully"|"ionic-angular"|"angular"|"polymer"|"svelte"|"sveltekit"|"sveltekit-1"|"ionic-react"|"create-react-app"|"gridsome"|"umijs"|"sapper"|"saber"|"stencil"|"nuxtjs"|"redwoodjs"|"hugo"|"jekyll"|"brunch"|"middleman"|"zola"|"hydrogen"|"vite"|"tanstack-start"|"vitepress"|"vuepress"|"parcel"|"fastapi"|"flask"|"fasthtml"|"django"|"ash"|"sanity-v3"|"sanity"|"storybook"|"nitro"|"hono"|"express"|"h3"|"koa"|"nestjs"|"elysia"|"fastify"|"xmcp"|"python"|"ruby"|"rust"|"axum"|"actix-web"|"node"|"go"|"services"|"mastra"|"null") - **latestDeployment** (string) - **events** (array (string (budget.reached|domain.created|domain.dns.records.changed|domain.transfer-in.started|domain.transfer-in.completed|domain.transfer-in.failed|domain.certificate.add|domain.certificate.add.failed|domain.certificate.renew|domain.certificate.renew.failed|domain.certificate.deleted|domain.renewal|domain.renewal.failed|domain.auto-renew.changed|deployment.created|deployment.build-requested|deployment.cleanup|deployment.error|deployment.blocked|deployment.canceled|deployment.succeeded|deployment.ready|deployment.check-rerequested|deployment.promoted|deployment.rollback|deployment.integration.action.start|deployment.integration.action.cancel|deployment.integration.action.cleanup|deployment.checkrun.start|deployment.checkrun.cancel|edge-config.created|edge-config.deleted|edge-config.items.updated|firewall.attack|firewall.system-rule-anomaly|firewall.custom-rule-anomaly|function.archival-required|function.removal-required|alerts.triggered|integration-configuration.permission-upgraded|integration-configuration.removed|integration-configuration.scope-change-confirmed|integration-configuration.transferred|integration-resource.project-connected|integration-resource.project-disconnected|project.created|project.removed|project.renamed|project.env-variable.created|project.env-variable.updated|project.env-variable.deleted|project.domain.created|project.domain.updated|project.domain.deleted|project.domain.verified|project.domain.unverified|project.domain.moved|project.rolling-release.started|project.rolling-release.aborted|project.rolling-release.completed|project.rolling-release.approved|deployment.checks.failed|deployment.checks.succeeded|deployment-checks-completed|deployment-ready|deployment-prepared|deployment-error|deployment-check-rerequested|deployment-canceled|project-created|project-removed|domain-created|deployment|integration-configuration-permission-updated|integration-configuration-removed|integration-configuration-scope-change-confirmed|marketplace.member.changed|marketplace.invoice.created|marketplace.invoice.paid|marketplace.invoice.notpaid|marketplace.invoice.overdue|marketplace.invoice.refunded|ai-gateway.balance-depleted|ai-gateway.auto-reload.limit-reached|observability.anomaly|observability.anomaly-error|observability.usage-anomaly|observability.error-anomaly|botid.anomaly|flag.created|flag.updated|flag.deleted|flag.segment.created|flag.segment.updated|flag.segment.deleted|test-webhook|message.created|message.updated|message.deleted|thread.resolved|thread.unresolved|message.reaction-added|message.reaction-removed|message.mentioned|comment.created|comment.updated|comment.deleted|comment.resolved|comment.unresolved|comment.reaction-added|comment.reaction-removed|comment.mentioned))) (required): The webhooks events (example: "deployment.created") - **id** (string) (required): The webhook id (example: "account_hook_GflD6EYyo7F4ViYS") - **url** (string) (required): A string with the URL of the webhook (example: "https://my-webhook.com") - **ownerId** (string) (required): The unique ID of the team the webhook belongs to (example: "ZspSRT4ljIEEmMHgoDwKWDei") - **createdAt** (number) (required): A number containing the date when the webhook was created in in milliseconds (example: 1567024758130) - **updatedAt** (number) (required): A number containing the date when the webhook was updated in in milliseconds (example: 1567024758130) - **projectIds** (array (string)): The ID of the projects the webhook is associated with (example: ["prj_12HKQaOmR5t5Uy6vdcQsNIiZgHGB"]) #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. ### Example Usage ```bash curl -X GET "https://api.vercel.com/v1/webhooks?projectId=string&teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" ``` ``` -------------------------------- ### POST /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/items Source: https://openapi.vercel.sh/ Create one or multiple experimentation items ```markdown ### Parameters - **integrationConfigurationId** (string, path, required) - **resourceId** (string, path, required) ### Request Body **Content-Type:** application/json - **items** (array (object)) (required) Array items: - **id** (string) (required) - **slug** (string) (required) - **origin** (string) (required) - **category** (string (experiment|flag)) ("experiment"|"flag") - **name** (string) - **description** (string) - **isArchived** (boolean) - **createdAt** (number) - **updatedAt** (number) ### Responses #### 204 - The items were created Empty response body #### 400 - One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X POST "https://api.vercel.com/v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/items" \ -H "Content-Type: application/json" \ -d '{ "items": [ { "id": "string", "slug": "string", "origin": "string", "category": "experiment", "name": "string", "description": "string", "isArchived": "true", "createdAt": "0", "updatedAt": "0" } ] }' ``` ``` -------------------------------- ### GET /v8/certs/{id} Source: https://openapi.vercel.sh/ Get cert by id ```markdown ### Parameters - **id** (string, path, required): The cert id - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Responses #### 200 - response - **id** (string) (required) - **createdAt** (number) (required) - **expiresAt** (number) (required) - **autoRenew** (boolean) (required) ("false"|"true") - **cns** (array (string)) (required) #### 400 - One of the provided values in the request query is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X GET "https://api.vercel.com/v8/certs/{id}?teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" ``` ``` -------------------------------- ### POST /v1/installations/{integrationConfigurationId}/billing Source: https://openapi.vercel.sh/ Sends the billing and usage data. The partner should do this at least once a day and ideally once per hour.
Use the `credentials.access_token` we provided in the [Upsert Installation](#upsert-installation) body to authorize this request. ```markdown ### Parameters - **integrationConfigurationId** (string, path, required) ### Request Body **Content-Type:** application/json - **timestamp** (string (date-time)) (required): Server time of your integration, used to determine the most recent data for race conditions & updates. Only the latest usage data for a given day, week, and month will be kept. - **eod** (string (date-time)) (required): End of Day, the UTC datetime for when the end of the billing/usage day is in UTC time. This tells us which day the usage data is for, and also allows for your "end of day" to be different from UTC 00:00:00. eod must be within the period dates, and cannot be older than 24h earlier from our server's current time. - **period** (object) (required): Period for the billing cycle. The period end date cannot be older than 24 hours earlier than our current server's time. - **start** (string (date-time)) (required) - **end** (string (date-time)) (required) - **billing** (array (object)) (required) Array items: - **billingPlanId** (string) (required): Partner's billing plan ID. - **resourceId** (string): Partner's resource ID. - **start** (string (date-time)): Start and end are only needed if different from the period's start/end. - **end** (string (date-time)): Start and end are only needed if different from the period's start/end. - **name** (string) (required): Line item name. - **details** (string): Line item details. - **price** (string) (required): Price per unit. - **quantity** (number) (required): Quantity of units. - **units** (string) (required): Units of the quantity. - **total** (string) (required): Total amount. - **usage** (array (object)) (required) Array items: - **resourceId** (string): Partner's resource ID. - **name** (string) (required): Metric name. - **type** (string (total|interval|rate)) (required): Type of the metric. - total: measured total value, such as Database size - interval: usage during the period, such as i/o or number of queries. - rate: rate of usage, such as queries per second. ("total"|"interval"|"rate") - **units** (string) (required): Metric units. Example: "GB" - **dayValue** (number) (required): Metric value for the day. Could be a final or an interim value for the day. - **periodValue** (number) (required): Metric value for the billing period. Could be a final or an interim value for the period. - **planValue** (number): The limit value of the metric for a billing period, if a limit is defined by the plan. ### Responses #### 201 - response Empty response body #### 400 - One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. One of the provided values in the request body is invalid. One of the provided values in the request query is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response ### Example Usage ```bash curl -X POST "https://api.vercel.com/v1/installations/{integrationConfigurationId}/billing" \ -H "Content-Type: application/json" \ -d '{ "timestamp": "2023-01-01T00:00:00Z", "eod": "2023-01-01T00:00:00Z", "period": { "start": "2023-01-01T00:00:00Z", "end": "2023-01-01T00:00:00Z" }, "billing": "value", "usage": [ { "resourceId": "string", "name": "string", "type": "total", "units": "string", "dayValue": "0", "periodValue": "0", "planValue": "0" } ] }' ``` ``` -------------------------------- ### GET /v1/microfrontends/groups Source: https://openapi.vercel.sh/ Get the microfrontends group IDs for a team. ```markdown ### Parameters - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Responses #### 200 - response #### 400 - response #### 401 - The request is not authorized. The request is not authorized. #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 500 - response ### Example Usage ```bash curl -X GET "https://api.vercel.com/v1/microfrontends/groups?teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" ``` ``` -------------------------------- ### POST /v1/sandboxes Source: https://openapi.vercel.sh/ Creates a new sandbox environment for executing code in an isolated virtual machine. A sandbox can be initialized from various sources including Git repositories, tarballs, or existing snapshots. Once created, you can execute commands, read/write files, and manage the sandbox lifecycle. ```markdown ### Parameters - **teamId** (string, query, optional): The Team identifier to perform the request on behalf of. (example: "team_1a2b3c4d5e6f7g8h9i0j1k2l") - **slug** (string, query, optional): The Team slug to perform the request on behalf of. (example: "my-team-url-slug") ### Request Body **Content-Type:** application/json - **resources** (object): Resources to define the VM - **vcpus** (integer): The number of virtual CPUs to allocate to the sandbox. Must be 1, or an even number. (example: 2) - **memory** (integer): The amount of memory in megabytes to allocate to the sandbox. Must equal vcpus * 2048. (example: 4096) - **runtime** (string (node22|node24|node26|python3.13)): The runtime environment for the sandbox. Determines the pre-installed language runtimes and tools available. (example: "node24") ("node22"|"node24"|"node26"|"python3.13") - **source** (object): Clone a Git repository into the sandbox. - **type** (unknown) (required): Indicates the source is a Git repository. - **url** (string (uri)) (required): The URL of the Git repository to clone. (example: "https://github.com/vercel/next.js.git") - **username** (string): Username for Git authentication. Required together with password for private repositories. - **password** (string): Password or personal access token for Git authentication. Required together with username for private repositories. - **depth** (integer): Create a shallow clone with history truncated to the specified number of commits. Useful for faster cloning of large repositories. (example: 1) - **revision** (string): The specific commit SHA, branch name, or tag to checkout after cloning. (example: "main") - **projectId** (string): The target project slug or ID in which the sandbox will be assigned to. (example: "prj_abc123") - **ports** (array (integer)): List of ports to expose from the sandbox. Each port will be accessible via a unique URL. Maximum of 15 ports can be exposed. (example: [3000,4000]) - **timeout** (integer): Maximum duration in milliseconds that the sandbox can run before being automatically stopped. (example: 300000) - **networkPolicy** (object): Network access policy for the sandbox.\n Controls which external hosts the sandbox can communicate with.\n Use \"allow-all\" mode to allow all traffic, \"deny-all\" to block all traffic or \"custom\" to provide specific rules. - **mode** (string (allow-all|deny-all|custom|default-allow|default-deny)) (required): The network access policy mode. Use \"allow-all\" to permit all outbound traffic. Use \"deny-all\" to block all outbound traffic. Use \"custom\" to specify explicit allow/deny rules. (example: "custom") ("allow-all"|"deny-all"|"custom"|"default-allow"|"default-deny") - **allowedDomains** (array (string)): List of domain names the sandbox is allowed to connect to. Only applies when mode is \"custom\". Supports wildcard patterns (e.g., \"*.example.com\" matches all subdomains). (example: ["api.github.com","*.npmjs.org"]) - **allowedCIDRs** (array (string)): List of IP address ranges (in CIDR notation) the sandbox is allowed to connect to. Traffic to these addresses bypasses domain-based restrictions. (example: ["35.192.0.0/12","104.16.0.0/12"]) - **deniedCIDRs** (array (string)): List of IP address ranges (in CIDR notation) the sandbox is blocked from connecting to. These rules take precedence over all allowed rules. (example: ["35.192.0.0/12"]) - **injectionRules** (array (object)): HTTP header injection rules for outgoing requests matching specific domains. Traffic to matching domains will be intercepted instead of proxied through encrypted connections. Array items: - **domain** (string) (required): The domain (or pattern) of requests to add headers for. Supports wildcards like *.example.com. - **headers** (object) (required): HTTP headers to inject into requests for this domain. Existing headers with the same name will be overridden. - **match** (object): Optional L7 match. When provided, the injection rule only applies to requests that satisfy every specified dimension. When multiple injection rules target the same domain they are evaluated in order and the first match wins; a rule without `match` matches any request and shadows later rules for the same domain. - **path** (object): Match on the request path. Comparison is case-sensitive. - **exact** (string): Match the value exactly. Case-sensitive for paths, header values, and methods; case-insensitive for domains and header keys. - **startsWith** (string): Match values that start with the given prefix. - **method** (array (string)): HTTP methods to match. Any single match succeeds (OR semantics). - **queryString** (array (object)): Query-string entry matchers. Multiple entries are ANDed. Query parameter names and values are both compared case-sensitively (RFC 3986). When a request has multiple values for the same key, any matching value satisfies the matcher. Array items: - **key** (object): Matcher for the entry key (header name or query key). - **value** (object): Matcher for the entry value. - **headers** (array (object)): Header matchers. Multiple entries are ANDed. Header names are compared case-insensitively (RFC 9110); header values are compared case-sensitively. When a request has multiple values for the same header, any matching value satisfies the matcher. Array items: - **env** (object): Default environment variables for the sandbox. These are inherited by all commands unless overridden. (example: {"NODE_ENV":"production","HELLO":"world"}) ### Responses #### 200 - response - **sandbox** (object) (required): This object contains information related to a Vercel Sandbox. - **id** (string) (required): The unique identifier of the sandbox. (example: "sbx_123a6c5209bc3778245d011443644c8d27dc2c50") - **memory** (number) (required): Memory allocated to this sandbox in MB. (example: 2048) - **vcpus** (number) (required): Number of vCPUs allocated to this sandbox. (example: 2) - **region** (string) (required): The region where the sandbox is hosted. (example: "iad1") - **runtime** (string) (required): The runtime of the sandbox. (example: "node22") - **timeout** (number) (required): The maximum amount of time the sandbox will run for in milliseconds. (example: 3600000) - **status** (string (failed|aborted|pending|stopping|snapshotting|running|stopped)) (required): The status of the sandbox. (example: "running") ("failed"|"aborted"|"pending"|"stopping"|"snapshotting"|"running"|"stopped") - **requestedAt** (number) (required): The time when the sandbox was requested, in milliseconds since the epoch. (example: 1750344501629) - **startedAt** (number): The time when the sandbox was started, in milliseconds since the epoch. (example: 1750344501629) - **cwd** (string) (required): The working directory of the sandbox. (example: "/vercel/sandbox") - **requestedStopAt** (number): The time when the sandbox was requested to stop, in milliseconds since the epoch. (example: 1750344501629) - **stoppedAt** (number): The time when the sandbox was stopped, in milliseconds since the epoch. (example: 1750344501629) - **abortedAt** (number): The time when the sandbox was aborted, in milliseconds since the epoch. (example: 1750344501629) - **duration** (number): The duration of the sandbox in milliseconds. (example: 3600000) - **sourceSnapshotId** (string): The unique identifier of the snapshot associated with this sandbox, if any. (example: "snap_123a6c5209bc3778245d011443644c8d27dc2c50") - **snapshottedAt** (number): The time when a snapshot was requested, in milliseconds since the epoch. (example: 1750344501629) - **createdAt** (number) (required): The time when the sandbox was created, in milliseconds since the epoch. (example: 1750344501629) - **updatedAt** (number) (required): The last time the sandbox was updated, in milliseconds since the epoch. (example: 1750344501629) - **networkPolicy** (object): The network policy applied to this sandbox, if any. - **mode** (string (allow-all|deny-all|custom)) (required): The network policy mode. - 'allow-all': All traffic is allowed. - 'deny-all': All traffic is blocked. - 'custom': Traffic is controlled by explicit allow/deny rules. (example: "custom") ("allow-all"|"deny-all"|"custom") - **allowedDomains** (array (string)): List of domain names the sandbox is allowed to connect to. Supports wildcard patterns (e.g., "*.vercel.com" matches all subdomains). (example: ["api.vercel.com","*.example.com"]) - **allowedCIDRs** (array (string)): List of IP address ranges (in CIDR notation) the sandbox is allowed to connect to. (example: ["10.0.0.0/8"]) - **deniedCIDRs** (array (string)): List of IP address ranges (in CIDR notation) the sandbox is blocked from connecting to. These rules take precedence over all allowed rules. (example: ["10.0.0.0/8"]) - **injectionRules** (array (SandboxInjectionRule)): HTTP header injection rules for outgoing requests matching specific domains. Array items: - **domain** (string) (required): The domain (or pattern) that this injection rule applies to. Supports wildcards like *.vercel.com. (example: "api.vercel.com") - **headerNames** (array (string)): The names of HTTP headers that have value that will be injected for requests to this domain. (example: ["Authorization","X-API-Key"]) - **activeCpuDurationMs** (number): The amount of CPU time the sandbox consumed, if available, in milliseconds. This value is only available once the sandbox is stopped, and only if it stopped successfully. (example: 42) - **networkTransfer** (object): The quantity of data transfered to and from the sandbox, in bytes. This value is only available once the sandbox is stopped, and only if it stopped successfully. (example: {"in":12543852,"out":15368}) - **ingress** (number) (required) - **egress** (number) (required) - **routes** (array (SandboxPublicRoute)) (required) Array items: - **url** (string) (required): A public URL to access the corresponding port in the Sandbox. - **port** (number) (required): The user port number that the route is mapped to. - **subdomain** (string) (required): The subdomain assigned to this route. - **system** (boolean): Whether the route is reserved by the system (e.g. for internal use). ("true") #### 400 - One of the provided values in the request body is invalid. One of the provided values in the request body is invalid. #### 401 - The request is not authorized. The request is not authorized. #### 402 - The account is missing a payment so payment method must be updated The account is missing a payment so payment method must be updated #### 403 - You do not have permission to access this resource. You do not have permission to access this resource. #### 404 - response #### 409 - response #### 410 - response #### 422 - response #### 429 - The concurrency limit has been exceeded. The concurrency limit has been exceeded. #### 500 - response ### Example Usage ```bash curl -X POST "https://api.vercel.com/v1/sandboxes?teamId=team_1a2b3c4d5e6f7g8h9i0j1k2l&slug=my-team-url-slug" \ -H "Content-Type: application/json" \ -d '{ "resources": { "vcpus": 2, "memory": 4096 }, "runtime": "node24", "source": "value", "projectId": "prj_abc123", "ports": [ 3000, 4000 ], "timeout": 300000, "networkPolicy": { "mode": "custom", "allowedDomains": [ "api.github.com", "*.npmjs.org" ], "allowedCIDRs": [ "35.192.0.0/12", "104.16.0.0/12" ], "deniedCIDRs": [ "35.192.0.0/12" ], "injectionRules": [ { "domain": "string", "headers": "value", "match": { "path": { "exact": "string", "startsWith": "string" }, "method": [ "string" ], "queryString": [ { "key": { "exact": "string", "startsWith": "string" }, "value": { "exact": "string", "startsWith": "string" } } ], "headers": [ { "key": { "exact": "string", "startsWith": "string" }, "value": { "exact": "string", "startsWith": "string" } } ] } } ] }, "env": { "NODE_ENV": "production", "HELLO": "world" } }' ``` ```