Skip to main content
POST
Create box

Authorizations

Authorization
string
header
required

Box bearer token in the form box_.... Service API keys authenticate Box operations.

Body

application/json

Options for provisioning a new cloud computer.

type
enum<string>
default:default

Machine size. small is 2 vCPUs / 4 GB RAM and consumes machine time at half rate; default is 4 vCPUs / 8 GB RAM; large is 8 vCPUs / 16 GB RAM and consumes machine time twice as fast (see the Billing guide). A box keeps its type for life: stopping, resuming and forking all preserve it, and forks inherit the source box's type.

Available options:
small,
default,
large
ttlSeconds
integer | null
default:3600

Number of seconds before automatic archival. null disables auto-stop. The backend also accepts the string infinite for legacy compatibility; new clients should send null.

Required range: 1 <= x <= 2592000
env
object

Per-box environment variables injected into the box's tool environment, on top of the account environment's variables (per-box values win on conflicts). Keys must match [A-Za-z_][A-Za-z0-9_]{0,127}; at most 100 variables and 64KB total. Reserved names (ASCII_TOKEN, ASCII_API_URL, AGENT_ID, PRODUCT_MODE, ENVIRONMENT_ID, BOX_ID, SERVICE_PREVIEW_TOKEN, BOX_CLI_TOKEN) are rejected with invalid_env. Forked boxes inherit the source box's env unless the fork request supplies its own env.

environment
string
default:base

Name of the Box environment to attach to this box. Environments are managed in the Box dashboard and bundle the repositories, secrets, and credential toggles a box gets. Omit to use your default environment (base unless you changed it). Unknown names are rejected with unknown_environment. An environment marked "safe for third parties" passes nothing to the box, exactly like noEnv.

Examples:

"base"

"customer-demos"

noEnv
boolean
default:false

Create a box with none of the secrets attached to your account (no environment variables, secret files, or credentials), confined to itself so it cannot act on your account or other boxes. For boxes you give to your own users. SSH, SCP, desktop, snapshots, and public URLs still work; pass env to give the box a secret of its own. A fork of a no-env box is always no-env. Equivalent to attaching an environment marked "safe for third parties".

setupScript
string

Shell script that runs on the box after it is ready. Ready means "ready to accept the user", not "setup done": the script starts in the background once provisioning completes and never blocks the box becoming usable. It runs as the box user via bash, with the box's environment applied, and its output goes to a log file on the box. Observe the outcome as setupStatus (pending/running/done/failed) and setupError on the box. Rejected with a 400 invalid_setup_script error when it is not a string or exceeds 64KB.

Maximum string length: 65536
from
string

Create the box from a named snapshot (saved with POST /named-snapshots, or box snapshot <id> <name> in the CLI). The box starts from that exact frozen state. Omitting type inherits the type the snapshot was saved from; env and no-env inherit from the snapshot's source box unless the request passes its own, with the same rules as forking.

Response

Box accepted for provisioning.

ok
boolean
required
Example:

true

type
string
required

Stable success envelope discriminator added by v1.

Allowed value: "box.created"
status
enum<string>
required
Available options:
provisioning
ttlSeconds
integer | null
required
box
object
required