Concepts

Orgs and workspaces

An org (org_…) is the tenant. It owns money and trust: the wallet, the ledger, the default residency. Org owners administer every workspace of the org; billing members see the org's money but not its work.

A workspace (ws_…) belongs to one org and is where work happens: members, API keys, sandboxes, budgets and usage. A member holds one relation in it: admin, developer or viewer, each including the next. Every org starts with a workspace called default.

API keys

An API key (key_…, secret rc_live_…) belongs to one person and acts in one workspace, as developer (reads and writes) or viewer (reads). A key is never an admin, never acts at org level, and does nothing once its person leaves the workspace. The secret is shown once; only its hash is kept. Personal tokens, which act as their person in every workspace that person belongs to, arrive with the CLI.

Sandboxes

A sandbox (sbx_…) is a full virtual machine: its own Linux kernel, systemd, Docker, nested virtualization when you ask for it, a persistent disk, and a network. Its id carries the code of the cell it lives in.

A sandbox is queued, starting, running, stopping, stopped or failed, as its cell last reported it (unknown before its cell has reported). You pay compute only while it runs, per second, and storage for its disk while it is stopped (Pricing). Creating, starting, resuming and forking cost nothing.

Snapshots and forks

A snapshot (snp_…) captures a sandbox's disk, and, for a running sandbox, its memory. A fork is a new sandbox started from a snapshot or from a running sandbox; it keeps the parent's files and state and diverges from there. Storage is billed on unique bytes: blocks shared between a sandbox, its snapshots and its forks are counted once. Forking a sandbox is POST /v1/sandboxes/{id}/fork (API › Acting on a sandbox). A workspace's snapshots are listed by GET /v1/snapshots (raw snapshots list, and under Machines in the console) as soon as the cell that holds them reports them; taking and deleting one are its cell's to do, answered once cells are open (API › Snapshots and templates). A snapshot outlives its sandbox.

Templates

A template (tpl_…) is a disk image to start sandboxes from: one of ours, or one your workspace built. Templates are stored once per CPU baseline, so a sandbox started from one can run on any host of its pool. GET /v1/templates (raw templates list, and Machines in the console) lists the workspace's own and our public ones (workspace is null) as the cells report them; POST /v1/sandboxes with "template": "tpl_…" starts from one once cells are open.

Sizes

A size is <vCPU>x<GiB of memory>. Each class sells the sizes marked for it; asking a class for another is 400 invalid_request.

Classes

Prices for every size in each class are on Pricing.

Cells

A cell is a group of our hosts in one region that runs sandboxes. Each sandbox lives in exactly one cell, and its id names that cell: sbx_<cell code>_…. The regions a workspace may use follow its residency.

• When every cell that serves a start's class and region is full, the start waits in line with an ETA (The queue); with "on_full": "fail" it answers 503 capacity_full instead.
• 503 capacity_unavailable means no cell serves that class and region at all. During early access that is true of every class and region.
• EU residency means EU cells only.

The queue

A start never fails just because a cell is busy. When cells exist but are full, the default is to wait in line: the answer is 202 with the sandbox queued, its place in the queue and when it is expected to start.

{
	"object": "sandbox",
	"id": "sbx_ny1_01m6xxh3k2q8v7c4t9r5wdz6ya",
	"name": null,
	"class": "std",
	"size": "4x8",
	"state": "queued",
	"created_at": "2026-11-08T17:02:11.000Z",
	"queue": { "position": 3, "eta": "2026-11-08T17:04:00.000Z" }
}

Queued time is not billed. A caller that would rather fail says so:

{ "class": "perf", "size": "8x16", "on_full": "fail" }

and gets 503 capacity_full, with Retry-After in seconds and the expected time in the message.

When no cell serves the requested class in the workspace's residency, the answer is 503 capacity_unavailable, whatever on_full says, with no Retry-After. Nothing would ever drain that queue, so we don't pretend it would. That is the answer during early access (Limits › Early access).

Residency

An org has a default residency: any (the default) or eu. A workspace may set its own. With eu, the workspace's sandboxes, disks, snapshots and templates are placed only in EU cells, and a request that would place them elsewhere is refused. EU placement carries a multiplier on compute (Pricing).