NylorunDocsBeta
Management APISettings

Get the Tenant's sandbox backend and Agent compute settings

GET
/v1/tenant/sandbox

Authorization

managementKey
headerAuthorizationBearer <token>

A management key of the Tenant (role management): it reaches the Management API (/v1/tenant/*) and /v1/me, as itself, never for a subject. Issued only on the Tenant's machine (nylorun-operate keys put <id> --role management) or from NYLORUN_MANAGEMENT_KEY_FILE. Never accepted from a browser (Origin).

Header Parameters

Nylorun-Protocol*string

The protocol version, 18

Response Body

The backend in use and the configuration in force

application/json
  1. response
preference*|
backend*|
Value in"virtual""local"null
isolation*|
Value in"process""container"null
reason*string
probes*array<>
defaultImage*string
config*
cluster?|null
import { createAdmin } from "@nylorun/admin";const admin = createAdmin();const sandbox = await admin.settings.sandbox.get();
{  "preference": "auto",  "backend": "virtual",  "isolation": "process",  "reason": "string",  "probes": [    {      "name": "virtual",      "available": true,      "isolation": "process",      "reason": "string",      "version": "string"    }  ],  "defaultImage": "string",  "config": {    "limits": {      "network": [        "string"      ],      "resources": {        "cpus": 0,        "memoryMiB": 0      },      "defaultResources": {        "cpus": 0,        "memoryMiB": 0      },      "idle": "string",      "environments": 0    },    "lifecycle": {      "stopGrace": "string"    },    "placement": {      "property1": {        "hosts": [          "harness-container"        ]      },      "property2": {        "hosts": [          "harness-container"        ]      }    }  },  "cluster": {    "namespace": "string",    "context": "string",    "ready": true,    "controllerVersion": "string",    "networkPolicy": {      "enforced": true,      "probedAt": "string"    }  }}

Preview an MCP server's tools POST

Connects to the remote MCP server at `url` with the credential for that URL in the vault of the Agent `agentId`, if given (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.

Set the Tenant's Agent compute settings PUT

The limits every Agent's runtime must fit, the pods' stop grace and where harnesses may run (Tenant setting `environments.config`).