API reference
The public HTTP API, generated from the OpenAPI spec that ships with the service.
These pages are generated at build time from service/openapi.yml in the
repository, so they cannot drift from the spec the service ships with.
Base URL
The API component listens on port 3112 and serves every route under the /v1
prefix:
http://your-host:3112/v1Authentication
Requests carry a short-lived EdDSA JWT unless the service runs with
LOCAL_MODE=true or CODEAPI_AUTH_PROVIDER=none:
Authorization: Bearer <token>See Authentication for setup, and Connecting LibreChat for the signer side.
Endpoints
Execute code
POST /v1/exec — run code and get its output and files.
Execute with tool calling
POST /v1/exec/programmatic — run code that can call back into your tools.
Upload files
POST /v1/upload — stage inputs for later runs.
Download a file
GET /v1/download/{session_id}/{fileId}
Things worth knowing before you read the schemas
A failed program is still HTTP 200. The status code reports whether the
service did its job. A crashed program shows up as a non-zero code or a
non-null signal on a 200 response.
The exec response is flat. stdout, stderr, and files sit at the top
level of the response, not nested under a run object.
Two different session ids exist. session_id identifies an execution (and
prefixes its outputs); storage_session_id says where a particular file's bytes
live. See core concepts.
You never choose a storage namespace. It is derived server-side from your authenticated identity, which is what keeps one caller out of another's files.
Rate limits
Per principal, backed by Redis so they hold across API replicas:
| Operation | Default |
|---|---|
| Executions | 20 per 30 s |
| Uploads | 30 per 5 min |
| Downloads | 60 per min |
| File list / metadata | 120 per min |
Rejections return 429 with RateLimit-Limit, RateLimit-Remaining, and
Retry-After. Tune them in configuration.
The internal API
The sandbox runner has its own API on port 2000, documented under
Developers → Sandbox runner API.
It is called only by the worker and must never be exposed publicly.