Error

A valid request URL is required to generate request examples

{
  "download_url": "<string>",
  "token": "<string>",
  "expires_at": "<string>"
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

Generate a sandbox file download link

Generate a tokenized link that downloads a single file from a sandbox with no further authentication. This mints a token rather than creating an addressable resource, so it returns 200 with no Location header. The token pins the sandbox, the file path, the response content type and disposition, and the sandbox flags, so a link cannot be repointed at another file or served under a weaker policy. The file is always served with a Content-Security-Policy: a sandbox directive, plus a default-src holding every fetch to the file’s own download host and a set of pre-approved third-party origins. csp_sandbox_flags may loosen the sandbox with allow-downloads, allow-forms, allow-modals, allow-orientation-lock, allow-pointer-lock, allow-popups, allow-presentation, allow-same-origin, allow-scripts, or allow-top-navigation-by-user-activation. Every file is served from its own host, derived from the sandbox and the path, so allow-same-origin gives a page localStorage and IndexedDB that no other file can read, and re-minting a link for the same file keeps them. csp_sandbox set to false drops the sandbox directive altogether, and csp_sandbox_flags must then be omitted. csp_source_bundles selects the third-party origins: cdnjs, google-fonts, jsdelivr, and unpkg are all allowed when the field is omitted, ‘none’ holds the file to its own host, and ‘any’ sends no default-src at all. Links never expire unless expires_in_seconds is set. The link is served from the sandbox service domain, not the API host.

POST

api

sandboxes

boxes

{name}

download-url

Error

A valid request URL is required to generate request examples

{
  "download_url": "<string>",
  "token": "<string>",
  "expires_at": "<string>"
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

{
  "detail": {
    "error": "<string>",
    "error_id": "<string>",
    "message": "<string>"
  }
}

Authorizations

X-API-Key

string

header

required

Path Parameters

name

string

required

Sandbox ID or name

Body

application/json

path

string

required

content_disposition

string

content_type

string

csp_sandbox

boolean

CSPSandbox false serves the file with no CSP sandbox directive; omit to keep it.

csp_sandbox_flags

enum<string>[]

CSPSandboxFlags loosen the CSP sandbox the file is served under; omit for the most restrictive policy.

Available options:

allow-downloads,

allow-forms,

allow-modals,

allow-orientation-lock,

allow-pointer-lock,

allow-popups,

allow-presentation,

allow-scripts,

allow-top-navigation-by-user-activation,

allow-same-origin

csp_source_bundles

enum<string>[]

CSPSourceBundles allow the served file to fetch from named third-party origins; omit to send no fetch directive.

Available options:

cdnjs,

google-fonts,

jsdelivr,

unpkg,

none,

any

expires_in_seconds

integer

ExpiresInSeconds is optional; a link with no expiry never expires.

Response

download_url

string

required

token

string

required

expires_at

string | null

ExpiresAt is null for a link that never expires.

SmithDB SDK migration

LangSmith REST API

Generate a sandbox file download link

Authorizations

Path Parameters

Body

Response