E2B
DEVELOPER · DEVELOPER
Cloud sandboxes for untrusted code, with their logs and metrics, on their own key.
Acts as the person, not as itself
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Credentials never touch the agent
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Every call on the record
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
e2b_delete_events_webhooks_by_webhookidWRITEDelete event webhook via DELETE /events/webhooks/{webhookID}. Delete a registered webhook.
e2b_delete_sandboxes_by_sandboxidWRITEKill sandbox via DELETE /sandboxes/{sandboxID}. Kill a sandbox
e2b_delete_secrets_by_secretidWRITEDelete a secret via DELETE /secrets/{secretID}. Revoke the secret and schedule its versions for cleanup.
e2b_delete_templates_by_templateidWRITEDelete template via DELETE /templates/{templateID}. Delete a template
e2b_delete_templates_tagsWRITEDelete template tags via DELETE /templates/tags. Delete multiple tags from templates
e2b_delete_volumes_by_volumeidWRITEDelete team volume via DELETE /volumes/{volumeID}. Delete a team volume
e2b_get_events_sandboxesREADTeam sandbox events via GET /events/sandboxes. Get all sandbox events for the team associated with the API key
e2b_get_events_sandboxes_by_sandboxidREADSandbox events via GET /events/sandboxes/{sandboxID}. Get sandbox events
e2b_get_events_webhooksREADList event webhooks via GET /events/webhooks. List registered webhooks.
e2b_get_events_webhooks_by_webhookidREADEvent webhook via GET /events/webhooks/{webhookID}. Get a registered webhook.
e2b_get_events_webhooks_by_webhookid_deliveriesREADWebhook delivery attempts via GET /events/webhooks/{webhookID}/deliveries. List webhook delivery attempts.
e2b_get_events_webhooks_by_webhookid_statsREADWebhook delivery stats via GET /events/webhooks/{webhookID}/stats. Get webhook delivery aggregate stats.
e2b_get_healthREADHealth check via GET /health.
e2b_get_sandboxesREADList running sandboxes via GET /sandboxes. List all running sandboxes. Use GET /v2/sandboxes instead. DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_get_sandboxes_by_sandboxidREADSandbox via GET /sandboxes/{sandboxID}. Get a sandbox by id
e2b_get_sandboxes_by_sandboxid_logsREADSandbox logs via GET /sandboxes/{sandboxID}/logs. Get sandbox logs. Use /v2/sandboxes/{sandboxID}/logs instead. DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_get_sandboxes_by_sandboxid_metricsREADSandbox metrics via GET /sandboxes/{sandboxID}/metrics. Get sandbox metrics
e2b_get_sandboxes_metricsREADList sandbox metrics via GET /sandboxes/metrics. List metrics for given sandboxes
e2b_get_secretsREADList project secrets via GET /secrets. List the project's secrets. No response carries a secret value.
e2b_get_secrets_by_secretidREADGet a secret via GET /secrets/{secretID}. Get one secret's metadata, selected by identifier or name.
e2b_get_snapshotsREADList snapshots via GET /snapshots. List all snapshots for the team
e2b_get_teams_by_teamid_metricsREADTeam metrics via GET /teams/{teamID}/metrics. Get metrics for the team
e2b_get_teams_by_teamid_metrics_maxREADMaximum team metrics via GET /teams/{teamID}/metrics/max. Get the maximum metrics for the team in the given interval
e2b_get_templatesREADList templates via GET /templates. List all templates DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_get_templates_aliases_by_aliasREADCheck template alias via GET /templates/aliases/{alias}. Check if template with given alias exists
e2b_get_templates_by_templateidREADList template builds via GET /templates/{templateID}. List all builds for a template
e2b_get_templates_by_templateid_builds_by_buildid_logsREADTemplate build logs via GET /templates/{templateID}/builds/{buildID}/logs. Get template build logs
e2b_get_templates_by_templateid_builds_by_buildid_statusREADTemplate build status via GET /templates/{templateID}/builds/{buildID}/status. Get template build info
e2b_get_templates_by_templateid_files_by_hashREADTemplate build file upload URL via GET /templates/{templateID}/files/{hash}. Get an upload link for a tar file containing build layer files
e2b_get_templates_by_templateid_tagsREADList template tags via GET /templates/{templateID}/tags. List all tags for a template
e2b_get_v2_sandboxesREADList sandboxes (v2) via GET /v2/sandboxes. List all sandboxes
e2b_get_v2_sandboxes_by_sandboxid_logsREADSandbox logs (v2) via GET /v2/sandboxes/{sandboxID}/logs. Get sandbox logs
e2b_get_v2_templatesREADList templates (v2) via GET /v2/templates. List all templates
e2b_get_volumesREADList team volumes via GET /volumes. List all team volumes
e2b_get_volumes_by_volumeidREADTeam volume via GET /volumes/{volumeID}. Get team volume info
e2b_patch_events_webhooks_by_webhookidWRITEUpdate event webhook via PATCH /events/webhooks/{webhookID}. Update a registered webhook configuration.
e2b_patch_templates_by_templateidWRITEUpdate template via PATCH /templates/{templateID}. DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_patch_v2_templates_by_templateidWRITEUpdate template (v2) via PATCH /v2/templates/{templateID}. Update template
e2b_post_events_webhooksWRITERegister event webhook via POST /events/webhooks. Register events webhook.
e2b_post_sandboxesWRITECreate sandbox via POST /sandboxes. Create a sandbox from the template. Use POST /v2/sandboxes instead. DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_post_sandboxes_by_sandboxid_connectWRITEConnect sandbox via POST /sandboxes/{sandboxID}/connect. Returns sandbox details. If the sandbox is paused, it will be resumed. TTL is only extended. Use POST /v2/sandboxes/{sandboxID}/connect instead. DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_post_sandboxes_by_sandboxid_forkWRITEFork sandbox via POST /sandboxes/{sandboxID}/fork. Fork the sandbox: checkpoint the running sandbox in place (it is briefly paused, snapshotted with its full memory state, and resumed on its node, keeping its ID and expiration untouched) and create count new sandboxes from that snapshot. Returns one result per requested fork, each carrying either the created sandbox or the error that prevented it from starting. A non-201 status means the request failed before any fork was attempted.
e2b_post_sandboxes_by_sandboxid_pauseWRITEPause sandbox via POST /sandboxes/{sandboxID}/pause. Pause the sandbox DESTRUCTIVE TO A RUNNING WORKLOAD: this suspends a live sandbox and every process inside it stops. It is reversible with Resume sandbox, but do not call it speculatively against a sandbox someone is using.
e2b_post_sandboxes_by_sandboxid_refreshesWRITERefresh sandbox via POST /sandboxes/{sandboxID}/refreshes. Refresh the sandbox extending its time to live
e2b_post_sandboxes_by_sandboxid_resumeWRITEResume sandbox via POST /sandboxes/{sandboxID}/resume. Resume the sandbox DEPRECATED by E2B in its own API specification -- it still answers today, but prefer the replacement named above where one is given.
e2b_post_sandboxes_by_sandboxid_snapshotsWRITECreate snapshot via POST /sandboxes/{sandboxID}/snapshots. Create a persistent snapshot from the sandbox's current state. Snapshots can be used to create new sandboxes and persist beyond the original sandbox's lifetime.
e2b_post_sandboxes_by_sandboxid_timeoutWRITESet sandbox timeout via POST /sandboxes/{sandboxID}/timeout. Set the timeout for the sandbox. The sandbox will expire x seconds from the time of the request. Calling this method multiple times overwrites the TTL, each time using the current timestamp as the starting point to measure the timeout duration. DESTRUCTIVE TO A RUNNING WORKLOAD: this OVERWRITES the sandbox's time to live, measured from the moment of the request, so a small value kills a running sandbox and the previous expiry cannot be recovered. E2B exposes no DELETE verb for this effect, which is why it is marked destructive.
e2b_post_secretsWRITECreate a secret via POST /secrets. Create a secret by storing a runtime marker as its first version. The response carries metadata only.
e2b_post_secrets_by_secretidWRITEUpdate a secret via POST /secrets/{secretID}. Replace the secret's stored marker by appending a new version. The response carries metadata only.
e2b_post_templates_tagsWRITEAssign template tags via POST /templates/tags. Assign tag(s) to a template build
e2b_post_v2_sandboxesWRITECreate sandbox (v2) via POST /v2/sandboxes. Create a sandbox from the template. All system communication with the sandbox is secured.
e2b_post_v2_sandboxes_by_sandboxid_connectWRITEConnect sandbox (v2) via POST /v2/sandboxes/{sandboxID}/connect. Returns sandbox details. If the sandbox is paused, it will be resumed. TTL is only extended. The request body is optional; an omitted timeout defaults to 300 seconds.
e2b_post_v2_templates_by_templateid_builds_by_buildidWRITEStart template build (v2) via POST /v2/templates/{templateID}/builds/{buildID}. Start the build
e2b_post_v3_templatesWRITECreate template (v3) via POST /v3/templates. Create a new template
e2b_post_volumesWRITECreate team volume via POST /volumes. Create a new team volume
e2b_put_sandboxes_by_sandboxid_networkWRITEUpdate sandbox network via PUT /sandboxes/{sandboxID}/network. Update the network configuration for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting field clears it. DESTRUCTIVE TO A RUNNING WORKLOAD: this REPLACES a running sandbox's egress rules wholesale and, in E2B's own words, 'omitting field clears it' -- so a partial body silently removes network configuration that cannot be read back from the API to restore.
Often connected alongside
Put E2B behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.