Skip to main content
Get a URL for a sandbox port

Authorizations

Authorization
string
header
required

BoxRouter API key; never an upstream provider key.

Headers

Idempotency-Key
string

Optional for this operation. Preserve the same stable identifier when retrying an uncertain response; never reuse it for new work. If omitted where allowed, Cloud generates a request-scoped key that cannot reconcile a later retry. Do not include credentials or payloads. Stable identifier for one logical mutation.

Required string length: 1 - 128

Path Parameters

sandbox_id
string
required

Workspace-owned BoxRouter sandbox ID, not an upstream ID.

Minimum string length: 1
Pattern: ^[^\u0000]*$

Body

application/json

A preview request for one port declared by the sandbox's previews requirement.

port
integer
required

Must be one of the gate's ports, else not_named.

Required range: 1 <= x <= 65535
access
enum<string>

Which kind of link to open. Required only when granted.access holds both values, and not allowed when the request named "any": then the result says which it is.

Available options:
public,
private
credential
enum<string>

Where a private preview carries its credential, and only with access private. Left out, the adapter picks and the result says which.

Available options:
link,
header

Response

This port already had a preview with this access, so it is returned unchanged.

One open preview, as BoxRouter recorded it. A resume forgets a sandbox's previews, because no adapter can re-read one: open again rather than caching a URL.

id
string
required

BoxRouter's own ID, prefixed pv_, which a revoke names.

port
integer
required
Required range: 1 <= x <= 65535
url
string<uri>
required
access
enum<string>
required
Available options:
public,
private
credential
enum<string> | null
required

Where a private preview's credential is: link, in the url, which a person can click; header, in headers, to send with every request. Null for a public one.

Available options:
link,
header,
null
headers
object
required

Credential headers to send with every request; empty unless credential is header.

expires_at
string<date-time> | null
required

Set only where the provider enforces an expiry, and never sooner than a granted link_lifetime_seconds after created_at. There is no way to shorten a link (D30).

created_at
string<date-time>
required