> ## Documentation Index > Fetch the complete documentation index at: https://docs.zode.dev/llms.txt > Use this file to discover all available pages before exploring further. # Run a command > Run one command in a running sandbox and return its output. `command` runs under `bash -lc`; `argv` runs as-is. Output is buffered, 1 MiB per stream. Commands run as root in `/workspace` unless `cwd` says otherwise, and are killed after `timeout_ms` (default 30000, max 55000). Only the program name is written to the audit log. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/sandboxes/{id}/exec openapi: 3.1.0 info: title: Zode API version: 0.1.0 description: Sandboxes for coding agents. Every route takes an API key as a bearer token. servers: - url: https://api.zode.dev security: - bearerAuth: [] tags: - name: Sandboxes - name: Commands - name: Browser and desktop - name: Snapshots - name: Images - name: Environments - name: Flight recorder - name: Attestation - name: Agents - name: Proxying - name: Webhooks - name: OpenTelemetry - name: Alerts - name: CI - name: Usage and billing - name: Workspace - name: Platform paths: /v1/sandboxes/{id}/exec: parameters: - $ref: '#/components/parameters/SandboxID' post: tags: - Commands summary: Run a command description: |- Run one command in a running sandbox and return its output. `command` runs under `bash -lc`; `argv` runs as-is. Output is buffered, 1 MiB per stream. Commands run as root in `/workspace` unless `cwd` says otherwise, and are killed after `timeout_ms` (default 30000, max 55000). Only the program name is written to the audit log. operationId: execSandbox requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ExecRequest' responses: '200': description: The command ran (any exit code) content: application/json: schema: $ref: '#/components/schemas/ExecResult' '400': description: A bad request. content: application/json: schema: $ref: '#/components/schemas/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' '409': $ref: '#/components/responses/Error' '501': description: >- `exec_unavailable`: the control plane has no node that can run commands. content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: The node or guest agent failed. content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: SandboxID: name: id in: path required: true schema: type: string pattern: ^sbx_[a-z2-7]{16}$ schemas: ExecRequest: type: object properties: command: type: string maxLength: 16384 description: Shell command, run with bash -lc argv: type: array items: type: string description: Program and arguments; ignored when command is set cwd: type: string description: Working directory (default /workspace) env: type: array items: type: string description: | KEY=VALUE entries added to the command's environment, not a replacement for it: the defaults (PATH, HOME, LANG; the CA bundle variables behind the egress proxy), then the sandbox's environment variables and secrets, then these. On a clash these win. stdin: type: string maxLength: 1048576 timeout_ms: type: integer minimum: 0 maximum: 55000 ExecResult: type: object required: - exit_code - stdout - stderr - duration_ms properties: exit_code: type: integer description: '-1 when killed by a signal' signal: type: string timed_out: type: boolean oom_killed: type: boolean peak_rss_mb: type: number duration_ms: type: integer stdout: type: string stderr: type: string stdout_truncated: type: boolean stderr_truncated: type: boolean Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string examples: - not_found - rate_limited - plan_required description: | Stable machine code; branch on it rather than on `message`. Deliberately not a closed enum: new codes are added over time, so treat an unknown code by its HTTP status. The codes in use, by status (a few appear under two): - 400: `bad_request` (malformed JSON or unknown field), `invalid_request`, `bad_signature`, `confirm_required`, `default_environment`, `email_not_allowed`, `endpoint_required`, `invalid_code`, `invalid_email`, `invalid_image`, `invalid_name`, `invalid_nonce`, `invalid_state`, `invalid_token`, `not_admin`, `order_mismatch`, `org_required`, `owner_cannot_leave`, `password_too_long`, `password_too_short`, `personal_workspace`, `same_email`, `secret_unsupported`, `self`, `too_many`, `unknown_channel`, `unknown_environment`, `unknown_installation`, `url_not_allowed`, `use_transfer` - 401: `unauthorized`, `invalid_credentials`, `bad_signature` - 402: `plan_required` (the plan does not include it), `credit_exhausted` (no credit left and no card on file) - 403: `forbidden` (the role may not), `token_scope`, `csrf`, `cors`, `email_unverified`, `installation_not_yours`, `no_user`, `not_yours`, `subscriptions_off`, `wrong_account`, `wrong_password` - 404: `not_found`, `code_not_found`, `invalid_invite`, `not_configured`, `unknown_node`, `unknown_org`, `unknown_sandbox` - 409: `invalid_state` (wrong sandbox status), `concurrency_limit` (plan's running-sandbox cap), `daily_cap_reached` (workspace daily spend cap), `limit_reached`, `name_taken`, `node_full`, `not_running`, `browser_off`, `desktop_off`, `already_deleted`, `already_linked`, `already_member`, `already_on_plan`, `billing_not_open`, `checkout_required`, `code_not_applicable`, `code_redeemed`, `code_taken`, `endpoint_disabled`, `installation_taken`, `invite_pending`, `last_method`, `no_sandbox`, `not_placed`, `not_waiting`, `sandboxes_running`, `sole_owner`, `too_many_keys`, `trial_unavailable`, `trial_used` - 410: `expired`, `used`, `expired_token`, `expired_invite`, `code_expired`, `code_used_up` - 413: `too_large` - 415: `unsupported_media_type` - 429: `rate_limited` (see the RateLimited response), `too_many_viewers` (desktop viewers) - 500: `internal` - 501 (this server or host cannot do it yet): `feature_unavailable`, `attach_unavailable`, `exec_unavailable`, `snapshots_unavailable`, `images_unavailable`, `recorder_unavailable`, `attestation_unavailable` - 502: `node_error`, `host_unreachable`, `key_destroy_failed`, `provider_error`, `github_error`, `recorder_error` - 503: `no_capacity`, `unhealthy`, `alerts_unavailable`, `auth_unavailable`, `ci_unavailable`, `email_unavailable`, `ingest_unavailable`, `secrets_unavailable`, `webhook_not_ready` The device-flow code and token endpoints answer 400 in the RFC 6749/8628 shape instead (OAuthError). message: type: string responses: Error: description: Error content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: zode_tok_<64 hex chars> description: >- An API key (`zode_tok_...`). Create one in the console under API keys (https://console.zode.dev/tokens), or with `zode login`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.