Admin

Compute quotas (always). Credential-plane / KeyHive BYOK when KeyHive is enabled; HTTP 410 when SANDBOX_LLM_EGRESS=gateway

Every request needs a credential — see Authentication.

Always live: compute quotas. Credential plane: KeyHive BYOK when SANDBOX_LLM_EGRESS=direct (admin key); returns HTTP 410 when egress is gateway. See Provisioning credentials.

Method	Path	Summary
`GET`	`/sandbox/v1/admin/credential-plane/keys`	Admin: list provider key ids (KeyHive; 410 when Gateway egress)
`POST`	`/sandbox/v1/admin/credential-plane/keys`	Admin: append LLM provider key (KeyHive; 410 when Gateway egress)
`DELETE`	`/sandbox/v1/admin/credential-plane/keys/{key_id}`	Admin: deactivate a provider key (KeyHive; 410 when Gateway egress)
`POST`	`/sandbox/v1/admin/credential-plane/keys/{key_id}/rotate`	Admin: rotate a provider key (KeyHive; 410 when Gateway egress)
`POST`	`/sandbox/v1/admin/credential-plane/teams`	Admin: create team (KeyHive credential plane; 410 when Gateway egress)
`POST`	`/sandbox/v1/admin/keyhive/keys`	Admin: add LLM provider key (legacy KeyHive path; 410 when Gateway egress)
`POST`	`/sandbox/v1/admin/keyhive/teams`	Admin: create team (legacy KeyHive path; 410 when Gateway egress)
`DELETE`	`/sandbox/v1/admin/quotas/{tenant}/{project}`	Admin: delete a tenant/project concurrency quota
`GET`	`/sandbox/v1/admin/quotas/{tenant}/{project}`	Admin: inspect a tenant/project concurrency quota
`PUT`	`/sandbox/v1/admin/quotas/{tenant}/{project}`	Admin: create or replace a tenant/project concurrency quota

Common headers

Accepted on every endpoint on this page.

Name	In	Type	Required	Description
`x-correlation-id`	header	string	no	End-to-end correlation id for this eval run. When set, the gateway and downstream services honor it verbatim in logs, Cloud Trace span attributes, async job payloads, and Langfuse trace.id. When omitted, the gateway generates a ULID and echoes it on the response.

Endpoints

Admin: list provider key ids (KeyHive; 410 when Gateway egress)

GET /sandbox/v1/admin/credential-plane/keys

Parameters

Name	In	Type	Required	Description
`namespace`	query	string	yes

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: append LLM provider key (KeyHive; 410 when Gateway egress)

POST /sandbox/v1/admin/credential-plane/keys

Parameters

Name	In	Type	Required	Description
`X-Sandbox-Project-Id`	header	string \| null	no	Project to bill and rate-limit this request against. Validated against the credential: a project-scoped token may only name its own project, and gets 403 otherwise. Defaults to the token's project when omitted.
`X-Sandbox-Tenant-Id`	header	string \| null	no	Tenant for this request. Must match the credential's tenant when the credential carries one.

Request body

application/json, required

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: deactivate a provider key (KeyHive; 410 when Gateway egress)

DELETE /sandbox/v1/admin/credential-plane/keys/{key_id}

Parameters

Name	In	Type	Required	Description
`key_id`	path	string	yes

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: rotate a provider key (KeyHive; 410 when Gateway egress)

POST /sandbox/v1/admin/credential-plane/keys/{key_id}/rotate

Parameters

Name	In	Type	Required	Description
`key_id`	path	string	yes

Request body

application/json, required

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: create team (KeyHive credential plane; 410 when Gateway egress)

POST /sandbox/v1/admin/credential-plane/teams

Parameters

Name	In	Type	Required	Description
`X-Sandbox-Project-Id`	header	string \| null	no	Project to bill and rate-limit this request against. Validated against the credential: a project-scoped token may only name its own project, and gets 403 otherwise. Defaults to the token's project when omitted.
`X-Sandbox-Tenant-Id`	header	string \| null	no	Tenant for this request. Must match the credential's tenant when the credential carries one.

Request body

application/json, required

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: add LLM provider key (legacy KeyHive path; 410 when Gateway egress)

POST /sandbox/v1/admin/keyhive/keys

Parameters

Name	In	Type	Required	Description
`X-Sandbox-Project-Id`	header	string \| null	no	Project to bill and rate-limit this request against. Validated against the credential: a project-scoped token may only name its own project, and gets 403 otherwise. Defaults to the token's project when omitted.
`X-Sandbox-Tenant-Id`	header	string \| null	no	Tenant for this request. Must match the credential's tenant when the credential carries one.

Request body

application/json, required

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: create team (legacy KeyHive path; 410 when Gateway egress)

POST /sandbox/v1/admin/keyhive/teams

Parameters

Name	In	Type	Required	Description
`X-Sandbox-Project-Id`	header	string \| null	no	Project to bill and rate-limit this request against. Validated against the credential: a project-scoped token may only name its own project, and gets 403 otherwise. Defaults to the token's project when omitted.
`X-Sandbox-Tenant-Id`	header	string \| null	no	Tenant for this request. Must match the credential's tenant when the credential carries one.

Request body

application/json, required

Responses

Status	Description	Body
`200`	Successful Response	object
`410`	Credential plane off (Gateway egress)	—
`422`	Validation Error	HTTPValidationError

Admin: delete a tenant/project concurrency quota

DELETE /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

Name	In	Type	Required	Description
`tenant`	path	string	yes
`project`	path	string	yes

Responses

Status	Description	Body
`200`	Successful Response	any
`422`	Validation Error	HTTPValidationError

Admin: inspect a tenant/project concurrency quota

GET /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

Name	In	Type	Required	Description
`tenant`	path	string	yes
`project`	path	string	yes

Responses

Status	Description	Body
`200`	Successful Response	any
`422`	Validation Error	HTTPValidationError

Admin: create or replace a tenant/project concurrency quota

PUT /sandbox/v1/admin/quotas/{tenant}/{project}

Parameters

Name	In	Type	Required	Description
`tenant`	path	string	yes
`project`	path	string	yes

Request body

application/json, required — QuotaPolicyRequest

Field	Type	Required	Description
`max_concurrent`	integer	yes

Responses

Status	Description	Body
`200`	Successful Response	any
`422`	Validation Error	HTTPValidationError

Schemas

The object shapes referenced above.

HTTPValidationError

Field	Type	Required	Description
`detail`	ValidationError[]	no

QuotaPolicyRequest

Admin request to set one project or tenant-default concurrency limit.

Field	Type	Required	Description
`max_concurrent`	integer	yes

ValidationError

Field	Type	Required
`loc`	string \| integer[]	yes
`msg`	string	yes
`type`	string	yes
`input`	any	no
`ctx`	object	no

Machine-readable spec: OpenAPI YAML.

Admin

On this page