Skip to main content
Create an agent launch

Authorizations

Authorization
string
header
required

BoxRouter API key; never an upstream provider key.

Headers

Idempotency-Key
string
required

Unique identifier for this logical launch. Reuse it with the identical body to reconcile an uncertain response.

Required string length: 1 - 128
Pattern: ^[^\u0000]+$

Body

application/json

Exactly one of a catalog agent name or an inline manifest is required.

agent
string
required
Required string length: 1 - 63
Pattern: ^[a-z][a-z0-9-]{0,62}$
privacy
object

Privacy floors for the sandbox created by this launch. Cloud carries this policy unchanged into deferred sandbox materialization.

manifest
object

A complete inline agent manifest or a source wrapper whose command can come from the referenced file.

overrides
object
additional_secret_refs
object
credential_delivery
enum<string>
default:prefer_native

Whether compatible environment fallback is allowed or protected delivery is required.

Available options:
prefer_native,
require_native
run
object

Optional client supplied batch metadata. Each launch remains independent; the server stores the values on its launch operation, labels the sandbox group and copy, and echoes this object in the successful Launch result. The server does not check group completeness.

registry_credentials
object

Request-only login for a manifest whose image is {private_oci}; required with it and refused without it. Both strings are non-empty, at most 64 KiB UTF-8 bytes together. It is passed to the provider to set up a copy of the image and is never stored, logged, traced or returned. Not accepted by unattended launch runs.

secret_values
object

Request-only secret values for names declared by the resolved manifest. Unknown names are invalid_request. The server enforces request size limits outside JSON Schema validation. Values are never stored, returned or logged.

Response

Launch operation accepted, or recovered for this idempotency key.

Durable, workspace-owned launch work. Poll while queued or running. A succeeded operation contains its final Launch in result; a failed operation contains the original structured error, with the HTTP status recorded in failure_status. Secret values are never stored or returned.

id
string
required
Minimum string length: 1
agent
string
required
Minimum string length: 1
repo
string | null
required

Canonical resolved code repository, or null when the launch has no code checkout.

Minimum string length: 1
sha
string | null
required

Immutable commit selected for the code checkout, or null when no code is requested.

Pattern: ^[0-9a-f]{40}$
status
enum<string>
required
Available options:
queued,
running,
succeeded,
failed
current_phase
enum<string> | null
required
Available options:
preparing_image,
create,
code,
setup,
files,
background,
previews,
null
phases
object[]
required
result
object | null
required

Result of one launch. id and sandbox_id are the same BoxRouter-owned sandbox ID. The stored result of a launch. A matching idempotent retry returns this result unchanged.

error
object | null
required

Structured error retained by asynchronous execution. It has no request_id when the failure occurs after the launch request has returned 202; clients can correlate the failure by the operation id instead.

failure_status
integer | null
required
Required range: 400 <= x <= 599
created_at
string<date-time>
required
updated_at
string<date-time>
required
sandbox_id
string
Minimum string length: 1