> ## Documentation Index
> Fetch the complete documentation index at: https://checkfu.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Publish a SandboxProfileRevision

> Publishes the next immutable SandboxProfileRevision under the same logical name, guarded by `expected_version`. The payload is a complete replacement snapshot, not a patch: every template field you want retained must be sent. Existing Sessions keep the version they admitted. Returns the new version with 201; send `Idempotency-Key` to make retries safe.

Checkfu support posture: alpha; hosted. Required evidence journey: sandbox-conformance. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities.



## OpenAPI

````yaml /openapi.json post /v1/sandbox-profiles/{id}/revisions
openapi: 3.1.0
info:
  title: Checkfu API
  version: '2026-08-27'
  description: >-
    Authentication is declared per operation: API-key, runtime, or connector
    bearer; Automation signature; or credential-free pairing redemption. Every
    general Checkfu REST request requires the dated `Checkfu-Version` header
    (one of: 2026-08-27); the three MCP JSON-RPC transports use
    `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth
    callback carries neither Checkfu header. API keys resolve one Workspace
    without a request selector; authenticated responses identify it with
    `Checkfu-Workspace-Id`.
servers:
  - url: https://api.checkfu.com
security:
  - bearerAuth: []
tags:
  - name: organizations
  - name: sourceRepositories
  - name: tenants
  - name: workspaces
  - name: principals
  - name: principalGroups
  - name: principalAccessCredentials
  - name: apiKeys
  - name: agents
  - name: harnesses
  - name: harnessRuntime
  - name: sandboxProfiles
  - name: computerProfiles
  - name: permissionAssignments
  - name: actionPolicies
  - name: files
  - name: memoryStores
  - name: dreams
  - name: modelCredentials
  - name: modelRoutingProfiles
  - name: blueprintInstallations
  - name: toolSources
  - name: skills
  - name: skillSources
  - name: agentSources
  - name: skillProposals
  - name: instructionProposals
  - name: catalog
  - name: concepts
  - name: support
  - name: connections
  - name: connectionVaults
  - name: connectionAssignments
  - name: connectedRuntimes
  - name: projects
  - name: collaboration
  - name: automationGraphs
  - name: automations
  - name: actionApprovals
  - name: standingApprovals
  - name: usage
  - name: models
  - name: outcomes
  - name: budgets
  - name: billing
  - name: sessions
  - name: audit
  - name: sessionExports
  - name: runs
  - name: runnerPools
  - name: transcripts
  - name: sessionWatches
  - name: webhookEndpoints
  - name: integrationGateway
  - name: agentDeployments
  - name: workEnvironments
  - name: computers
  - name: computerScreens
  - name: computerBrowserObservations
  - name: computerBrowserActions
  - name: environments
  - name: vaults
  - name: apiMcp
  - name: a2a
paths:
  /v1/sandbox-profiles/{id}/revisions:
    post:
      tags:
        - sandboxProfiles
      summary: Publish a SandboxProfileRevision
      description: >-
        Publishes the next immutable SandboxProfileRevision under the same
        logical name, guarded by `expected_version`. The payload is a complete
        replacement snapshot, not a patch: every template field you want
        retained must be sent. Existing Sessions keep the version they admitted.
        Returns the new version with 201; send `Idempotency-Key` to make retries
        safe.


        Checkfu support posture: alpha; hosted. Required evidence journey:
        sandbox-conformance. Deployment-specific readiness and the latest proven
        release are available from GET /v1/support/capabilities.
      operationId: sandboxProfiles.publishSandboxProfileRevision
      parameters:
        - name: id
          in: path
          schema:
            $ref: '#/components/schemas/SandboxProfileId'
          required: true
        - name: checkfu-version
          in: header
          schema:
            type: string
            enum:
              - '2026-08-27'
          required: true
        - name: idempotency-key
          in: header
          schema:
            type: string
            allOf:
              - maxLength: 255
          required: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                expected_resource_version:
                  type: integer
                  allOf:
                    - exclusiveMinimum: 0
                tier:
                  $ref: '#/components/schemas/Union_19'
                base_image:
                  $ref: '#/components/schemas/Objects_37'
                packages:
                  $ref: '#/components/schemas/Arrays_12'
                network_policy:
                  $ref: '#/components/schemas/Union_89'
                resource_limits:
                  $ref: '#/components/schemas/Objects_10'
                retention_mode:
                  $ref: '#/components/schemas/Union_21'
              required:
                - expected_resource_version
                - tier
                - base_image
                - packages
                - network_policy
                - resource_limits
                - retention_mode
              additionalProperties: false
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  sandbox_profile_id:
                    $ref: '#/components/schemas/SandboxProfileId'
                  workspace_id:
                    $ref: '#/components/schemas/WorkspaceId'
                  revision_number:
                    type: integer
                    allOf:
                      - exclusiveMinimum: 0
                  template:
                    $ref: '#/components/schemas/Objects_36'
                  derived_image_digest:
                    type: string
                    allOf:
                      - pattern: ^sha256:[0-9a-f]{64}$
                  published_by:
                    $ref: '#/components/schemas/Union_90'
                  published_at:
                    type: string
                required:
                  - sandbox_profile_id
                  - workspace_id
                  - revision_number
                  - template
                  - derived_image_digest
                  - published_by
                  - published_at
                additionalProperties: false
          headers:
            checkfu-workspace-id:
              description: The Workspace resolved from the authenticated bearer credential.
              required: true
              schema:
                $ref: '#/components/schemas/WorkspaceId'
        '400':
          description: Typed Checkfu wire error
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                        enum:
                          - validation.malformed
                      message:
                        type: string
                      more:
                        type: string
                        enum:
                          - >-
                            https://docs.checkfu.com/reference/errors#validation-malformed
                        description: >-
                          Stable public documentation and remedy for this error
                          type.
                    required:
                      - type
                      - message
                      - more
                    additionalProperties: false
                additionalProperties: false
        '401':
          description: Typed Checkfu wire error
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - type
                      - message
                      - more
                    properties:
                      type:
                        type: string
                        enum:
                          - auth.invalid_key
                      message:
                        type: string
                      more:
                        type: string
                        enum:
                          - >-
                            https://docs.checkfu.com/reference/errors#auth-invalid-key
                        description: >-
                          Stable public documentation and remedy for this error
                          type.
                    additionalProperties: false
                additionalProperties: false
        '403':
          description: >-
            The organization, tenant, or workspace backing this key is
            administratively disabled. | Deployment governance or retention
            policy denied the request.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
                    required:
                      - error
                    properties:
                      error:
                        type: object
                        properties:
                          type:
                            type: string
                            enum:
                              - auth.disabled_tenancy
                          message:
                            type: string
                          more:
                            type: string
                            enum:
                              - >-
                                https://docs.checkfu.com/reference/errors#auth-disabled-tenancy
                            description: >-
                              Stable public documentation and remedy for this
                              error type.
                        required:
                          - type
                          - message
                          - more
                        additionalProperties: false
                    additionalProperties: false
                  - $ref: '#/components/schemas/PolicyDeniedError'
        '404':
          description: >-
            The requested resource does not exist in the resolved deployment
            boundary.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationNotFoundError'
        '409':
          description: >-
            The request conflicts with the resource's current state. | An
            idempotent mutation conflicts with a completed or in-progress
            request for the same key.
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/ValidationConflictError'
                  - $ref: '#/components/schemas/IdempotencyConflictError'
        '429':
          description: Typed Checkfu wire error
          headers:
            retry-after:
              description: >-
                Delay in seconds for rate limits or deployment quotas with a
                known release or UTC reset boundary
              required: false
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - type
                      - message
                      - more
                    properties:
                      type:
                        type: string
                        enum:
                          - budget.exceeded
                      message:
                        type: string
                      more:
                        type: string
                        enum:
                          - >-
                            https://docs.checkfu.com/reference/errors#budget-exceeded
                        description: >-
                          Stable public documentation and remedy for this error
                          type.
                    additionalProperties: false
                additionalProperties: false
        '500':
          description: >-
            An unexpected internal failure occurred; the message contains an
            opaque incident reference.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeInternalError'
      security:
        - bearerAuth: []
components:
  schemas:
    SandboxProfileId:
      type: string
      allOf:
        - pattern: ^sprof_[0-9a-f]{32}$
    Union_19:
      type: string
      enum:
        - container
        - microvm
    Objects_37:
      type: object
      properties:
        reference:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 255
        digest:
          type: string
          allOf:
            - pattern: ^sha256:[0-9a-f]{64}$
      required:
        - reference
        - digest
      additionalProperties: false
    Arrays_12:
      type: array
      items:
        type: object
        properties:
          manager:
            type: string
            enum:
              - apt
              - cargo
              - gem
              - go
              - npm
              - pip
          name:
            $ref: '#/components/schemas/SandboxPackageCoordinate'
          version:
            $ref: '#/components/schemas/SandboxPackageCoordinate'
        required:
          - manager
          - name
        additionalProperties: false
      allOf:
        - maxItems: 256
    Union_89:
      anyOf:
        - type: object
          properties:
            mode:
              type: string
              enum:
                - none
            allowed_hosts:
              $ref: '#/components/schemas/Arrays_16'
          required:
            - mode
            - allowed_hosts
          additionalProperties: false
        - type: object
          properties:
            mode:
              type: string
              enum:
                - unrestricted
            allowed_hosts:
              $ref: '#/components/schemas/Arrays_16'
          required:
            - mode
            - allowed_hosts
          additionalProperties: false
        - $ref: '#/components/schemas/SandboxAllowlistWithinHostLimit'
    Objects_10:
      type: object
      properties:
        cpu_millis:
          type: integer
          allOf:
            - exclusiveMinimum: 0
        memory_mib:
          type: integer
          allOf:
            - exclusiveMinimum: 0
        disk_mib:
          type: integer
          allOf:
            - exclusiveMinimum: 0
        max_duration_seconds:
          type: integer
          allOf:
            - exclusiveMinimum: 0
      required:
        - cpu_millis
        - memory_mib
        - disk_mib
        - max_duration_seconds
      additionalProperties: false
    Union_21:
      type: string
      enum:
        - durable
        - ephemeral_zdr
    WorkspaceId:
      type: string
      allOf:
        - pattern: ^wrkspc_[0-9a-f]{32}$
    Objects_36:
      type: object
      properties:
        tier:
          $ref: '#/components/schemas/Union_19'
        base_image:
          $ref: '#/components/schemas/Objects_37'
        packages:
          $ref: '#/components/schemas/Arrays_12'
        network_policy:
          $ref: '#/components/schemas/Objects_38'
        resource_limits:
          $ref: '#/components/schemas/Objects_10'
        retention_mode:
          $ref: '#/components/schemas/Union_21'
      required:
        - tier
        - base_image
        - packages
        - network_policy
        - resource_limits
        - retention_mode
      additionalProperties: false
    Union_90:
      anyOf:
        - type: object
          properties:
            kind:
              type: string
              enum:
                - system
          required:
            - kind
          additionalProperties: false
        - type: object
          properties:
            kind:
              type: string
              enum:
                - api_key
            id:
              $ref: '#/components/schemas/ApiKeyId'
          required:
            - kind
            - id
          additionalProperties: false
        - type: object
          properties:
            kind:
              type: string
              enum:
                - principal
            id:
              $ref: '#/components/schemas/PrincipalId'
            authenticated_by:
              $ref: '#/components/schemas/ApiKeyId'
          required:
            - kind
            - id
          additionalProperties: false
        - type: object
          properties:
            kind:
              type: string
              enum:
                - console_user
            id:
              type: string
              allOf:
                - minLength: 1
            authenticated_by:
              $ref: '#/components/schemas/ApiKeyId'
          required:
            - kind
            - id
          additionalProperties: false
        - type: object
          properties:
            kind:
              type: string
              enum:
                - operator
            id:
              type: string
              allOf:
                - minLength: 1
          required:
            - kind
            - id
          additionalProperties: false
    PolicyDeniedError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - policy.denied
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#policy-denied
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: Deployment governance or retention policy denied the request.
    ValidationNotFoundError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - validation.not_found
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#validation-not-found
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: >-
        The requested resource does not exist in the resolved deployment
        boundary.
    ValidationConflictError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - validation.conflict
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#validation-conflict
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: The request conflicts with the resource's current state.
    IdempotencyConflictError:
      anyOf:
        - $ref: '#/components/schemas/ValidationIdempotencyConflictError'
        - $ref: '#/components/schemas/ValidationIdempotencyInProgressError'
      description: >-
        An idempotent mutation conflicts with a completed or in-progress request
        for the same key.
    RuntimeInternalError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - runtime.internal
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#runtime-internal
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: >-
        An unexpected internal failure occurred; the message contains an opaque
        incident reference.
    SandboxPackageCoordinate:
      type: string
      allOf:
        - minLength: 1
        - maxLength: 255
    Arrays_16:
      type: array
      items:
        $ref: '#/components/schemas/SandboxAllowedHost'
      allOf:
        - maxItems: 0
    SandboxAllowlistWithinHostLimit:
      type: object
      properties:
        mode:
          type: string
          enum:
            - allowlist
        allowed_hosts:
          type: array
          items:
            $ref: '#/components/schemas/SandboxAllowedHost'
          allOf:
            - maxItems: 256
        required_egress_certification:
          type: string
          enum:
            - advisory_filter
            - security_boundary
        allow_package_managers:
          type: boolean
        allow_mcp_servers:
          type: boolean
      required:
        - mode
        - allowed_hosts
      additionalProperties: false
    Objects_38:
      type: object
      properties:
        mode:
          $ref: '#/components/schemas/Union_20'
        allowed_hosts:
          type: array
          items:
            type: string
            allOf:
              - pattern: >-
                  ^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::[1-9][0-9]{0,4})?$
          allOf:
            - maxItems: 256
        required_egress_certification:
          type: string
          enum:
            - advisory_filter
            - security_boundary
        egress_presets:
          type: object
          properties:
            version:
              anyOf:
                - type: number
                  enum:
                    - 1
            presets:
              $ref: '#/components/schemas/UniqueSandboxEgressPresets'
          required:
            - version
            - presets
          additionalProperties: false
      required:
        - mode
        - allowed_hosts
      additionalProperties: false
    ApiKeyId:
      type: string
      allOf:
        - pattern: ^akey_[0-9a-f]{32}$
    PrincipalId:
      type: string
      allOf:
        - pattern: ^prin_[0-9a-f]{32}$
    ValidationIdempotencyConflictError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - validation.idempotency_conflict
            message:
              type: string
            more:
              type: string
              enum:
                - >-
                  https://docs.checkfu.com/reference/errors#validation-idempotency-conflict
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: The Idempotency-Key is already bound to a different request.
    ValidationIdempotencyInProgressError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - validation.idempotency_in_progress
            message:
              type: string
            more:
              type: string
              enum:
                - >-
                  https://docs.checkfu.com/reference/errors#validation-idempotency-in-progress
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: >-
        An identical idempotent request is still in progress and may be retried
        later.
    SandboxAllowedHost:
      type: string
      description: >-
        A lower-case public DNS hostname, never localhost or an IP literal, with
        an optional leading wildcard and TCP port from 1 through 65535.
      allOf:
        - maxLength: 261
        - pattern: >-
            ^(?:\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+(?::[1-9][0-9]{0,4})?$
    Union_20:
      type: string
      enum:
        - none
        - allowlist
        - unrestricted
    UniqueSandboxEgressPresets:
      type: array
      items:
        type: string
        enum:
          - package_managers
          - mcp_servers
      allOf:
        - minItems: 1
        - maxItems: 2
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````