Error

A valid request URL is required to generate request examples

{
  "download_url": "<string>",
  "token": "<string>",
  "expires_at": "<string>"
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

Generate a sandbox file download link

Generate a tokenized link that downloads a single file from a sandbox with no further authentication. This mints a token rather than creating an addressable resource, so it returns 200 with no Location header. The token pins the sandbox, the file path, the response content type and disposition, and the sandbox flags, so a link cannot be repointed at another file or served under a weaker policy. The file is always served with a Content-Security-Policy: a sandbox directive, plus a default-src holding every fetch to the sandbox’s own download host and a set of pre-approved third-party origins. csp_sandbox_flags may loosen the sandbox with allow-downloads, allow-forms, allow-modals, allow-orientation-lock, allow-pointer-lock, allow-popups, allow-presentation, allow-scripts, or allow-top-navigation-by-user-activation. allow-same-origin is not accepted, so a served file never shares an origin with anything. csp_source_bundles selects the third-party origins: cdnjs, google-fonts, jsdelivr, and unpkg are all allowed when the field is omitted, and ‘none’ holds the file to the sandbox alone. Because every file of one sandbox is served from the same host, a page can load sibling files it has links for, but only by their own link URLs. Links never expire unless expires_in_seconds is set. The link is served from the sandbox service domain, not the API host.

POST

/

api

/

v2

/

sandboxes

/

boxes

/

{name}

/

download-url

Error

A valid request URL is required to generate request examples

{
  "download_url": "<string>",
  "token": "<string>",
  "expires_at": "<string>"
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

Authorizations

X-API-Key

string

header

required

Path Parameters

name

string

required

Sandbox ID or name

Body

application/json

path

string

required

content_disposition

string

content_type

string

csp_sandbox_flags

enum<string>[]

CSPSandboxFlags loosen the CSP sandbox the file is served under; omit for the most restrictive policy.

Available options:

allow-downloads,

allow-forms,

allow-modals,

allow-orientation-lock,

allow-pointer-lock,

allow-popups,

allow-presentation,

allow-scripts,

allow-top-navigation-by-user-activation

csp_source_bundles

enum<string>[]

CSPSourceBundles allow the served file to fetch from named third-party origins; omit to send no fetch directive.

Available options:

cdnjs,

google-fonts,

jsdelivr,

unpkg,

none

expires_in_seconds

integer

ExpiresInSeconds is optional; a link with no expiry never expires.

Response

OK

download_url

string

required

token

string

required

expires_at

string | null

ExpiresAt is null for a link that never expires.