@spec create(
  ArchAstro.Client.t(),
  ArchAstro.Types.Operations.PostApiV1Sandboxes.Input.t()
) ::
  {:ok, ArchAstro.Types.Sandbox.t()} | {:error, ArchAstro.Error.reason()}

Create a sandbox

Creates a new sandbox for the caller's app. A sandbox is an isolated environment that can hold its own set of API keys, allowing you to test integrations without affecting production data.

The caller must authenticate with app-scoped credentials. Org-scoped viewers may create sandboxes for their organization; developers and all-powerful callers may create app-level or org-scoped sandboxes. If org is supplied the sandbox is scoped to that organization; otherwise it defaults to the authenticated viewer's organization.

Remote-eval sandboxes may set purpose: "eval" with expires_at at creation; TTL is the sole cleanup mechanism for those sandboxes. Returns the new sandbox with the auto-issued publishable key — use the create key endpoint to issue secret keys.

The newly created sandbox.

@spec delete(ArchAstro.Client.t(), String.t()) ::
  {:ok, :ok} | {:error, ArchAstro.Error.reason()}

Delete a sandbox

Soft-deletes the specified sandbox. The sandbox is marked deleted and immediately hidden from list/get queries; all of its active keys are revoked. Hard deletion (child data cascade) is scheduled immediately via the background sandbox deletion worker — the same path used for developer-app soft-delete.

The caller must authenticate with app-scoped credentials and be allowed to modify the sandbox. Returns 204 on success. If the sandbox is missing or already deleted, a 404 is returned.

Empty response with HTTP 204 status on successful deletion.

@spec get(ArchAstro.Client.t(), String.t()) ::
  {:ok, ArchAstro.Types.Sandbox.t()} | {:error, ArchAstro.Error.reason()}

Retrieve a sandbox

Returns the sandbox identified by sandbox that belongs to the caller's app. The response includes the sandbox's associated keys (without full secret key values — full keys are only available at creation time).

The caller must authenticate with app-scoped credentials. Org members may view their org's sandboxes; developers and all-powerful callers may view app-level and org-scoped sandboxes in their app. Returns 404 if the sandbox does not exist or is not visible to the caller.

The requested sandbox.

@spec keys(
  ArchAstro.Client.t(),
  String.t(),
  ArchAstro.Types.Operations.PostApiV1SandboxesSandboxKeys.Input.t()
) :: {:ok, ArchAstro.Types.SandboxKey.t()} | {:error, ArchAstro.Error.reason()}

Create a sandbox key

Issues a new API key for the specified sandbox. Keys can be either "publishable" (safe to embed in client-side code) or "secret" (server-side only). The full key value is returned once in the full_key field of this response and is never retrievable again — store it securely immediately.

The caller must authenticate with app-scoped credentials and be able to modify the sandbox (org members for org sandboxes; developers / all-powerful for app-level). If the sandbox does not belong to the caller's app or is not visible, a 404 is returned. Multiple active keys per sandbox are supported; revoke individual keys with the revoke key endpoint.

The newly created sandbox key, including the one-time full_key value.