> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreload.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a ticket for a box

> Checks the caller's API key at the edge and returns a short-lived ticket for one box: the box's URL, the TLS server name to check, and the `authorization` header to send it. Call the box at `url` with that header until `expiresAt` (at most a minute). The ticket is bound to your address.



## OpenAPI

````yaml /openapi.json post /v1/tickets
openapi: 3.1.0
info:
  title: Coreload sandbox API
  version: '1'
  description: >-
    Create short-lived sandboxes, run commands in them and move files in and
    out. The API is in beta and not offered to outside callers yet: there are no
    API keys for outside callers. A call gets a ticket for a box from the edge
    with an API key, then calls the box at the ticket's URL with the ticket's
    `authorization` header. Answers are JSON, except a file download (its bytes)
    and a tunnel (a 101 upgrade); a JSON error is `{ok: false, error: {code,
    message}}`.
servers:
  - url: '{box}'
    description: The box URL from your ticket (`url`).
    variables:
      box:
        default: https://box.coreload.example
        description: The ticket's url.
security:
  - ticket: []
  - apiKey: []
tags:
  - name: Access
    description: 'Tickets: how a key reaches a box.'
  - name: Sandboxes
    description: Create, list, get and destroy sandboxes.
  - name: Runs
    description: Run commands in a sandbox and read their results and output.
  - name: Files
    description: Move files in and out of a sandbox.
  - name: Tunnels
    description: >-
      Byte tunnels over an HTTP upgrade: to a sandbox's SSH server or desktop,
      and the relay that answers a sandbox's outbound connections from your
      side.
paths:
  /v1/tickets:
    post:
      tags:
        - Access
      summary: Get a ticket for a box
      description: >-
        Checks the caller's API key at the edge and returns a short-lived ticket
        for one box: the box's URL, the TLS server name to check, and the
        `authorization` header to send it. Call the box at `url` with that
        header until `expiresAt` (at most a minute). The ticket is bound to your
        address.
      operationId: createTicket
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TicketRequest'
      responses:
        '200':
          description: The ticket.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
        '400':
          description: Notably `invalid_value`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Notably `unauthorized`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Notably `ip_not_allowed`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Notably `not_found`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: Notably `backend_error`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: >-
            An error: `{ok: false, error: {code, message}}`. This route may
            answer any code in this table (code, then status): `invalid_value`
            400, `unauthorized` 401, `scope_missing` 403, `ip_not_allowed` 403,
            `not_found` 404, `backend_error` 503.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - apiKey: []
      servers:
        - url: https://edge.coreload.example
          description: 'The edge: placeholder for its URL.'
components:
  schemas:
    TicketRequest:
      type: object
      required:
        - box
      properties:
        box:
          type: string
          description: The box to reach (`box-` and its number).
    Ticket:
      type: object
      required:
        - box
        - url
        - servername
        - servingCa
        - authorization
        - expiresAt
      properties:
        box:
          type: string
          description: The box.
        url:
          type: string
          description: 'The box''s URL: call the sandbox routes here.'
        servername:
          type: string
          description: 'The TLS server name the box''s certificate carries: check it.'
        servingCa:
          type: string
          description: >-
            The PEM certificate of the CA that signs boxes' serving
            certificates: pin it.
        authorization:
          type: string
          description: The `authorization` header to send the box.
        expiresAt:
          type: string
          description: When the ticket stops working (at most a minute).
          format: date-time
    Error:
      type: object
      required:
        - ok
        - error
      properties:
        ok:
          const: false
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: The error code.
              enum:
                - invalid_value
                - unauthorized
                - scope_missing
                - ip_not_allowed
                - not_found
                - backend_error
                - idempotency_conflict
                - sandbox_not_ready
                - too_large
                - quota_exceeded
                - busy
                - wait_timeout
            message:
              type: string
              description: What went wrong, and what to do.
  securitySchemes:
    ticket:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        The ticket's `authorization` value, sent as it is (its own scheme, not
        Bearer), until the ticket's `expiresAt`.
    apiKey:
      type: http
      scheme: bearer
      description: >-
        An API key: `Authorization: Bearer <key>`. The edge takes it for a
        ticket; a box takes a key issued for that box. Keys are not issued to
        outside callers yet.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.