simstudioai · icecrasher321 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/apps/docs/content/docs/api-reference/meta.json b/apps/docs/content/docs/api-reference/meta.json
@@ -19,6 +19,7 @@
     "(generated)/mcp-servers",
     "(generated)/skills",
     "(generated)/custom-tools",
+    "(generated)/sandboxes",
     "(generated)/credentials",
     "(generated)/secrets",
     "(generated)/billing",

diff --git a/apps/docs/content/docs/cli/commands.mdx b/apps/docs/content/docs/cli/commands.mdx
@@ -43,6 +43,7 @@ These apply to every command, and may be written before or after it.
 | [`sim logs`](/cli/logs) | Manage logs |
 | [`sim mcp-servers`](/cli/mcp-servers) | Manage mcp servers |
 | [`sim meta`](/cli/meta) | Manage meta |
+| [`sim sandboxes`](/cli/sandboxes) | Manage sandboxes |
 | [`sim secrets`](/cli/secrets) | Manage secrets |
 | [`sim skills`](/cli/skills) | Manage skills |
 | [`sim tables`](/cli/tables) | Manage tables |

diff --git a/apps/docs/content/docs/cli/meta.json b/apps/docs/content/docs/cli/meta.json
@@ -24,6 +24,7 @@
     "logs",
     "mcp-servers",
     "meta",
+    "sandboxes",
     "secrets",
     "skills",
     "tables",

diff --git a/apps/docs/content/docs/cli/reference.mdx b/apps/docs/content/docs/cli/reference.mdx
@@ -2741,6 +2741,131 @@ Show what this API supports and which limits apply
 sim meta status
 ```
 
+## sim sandboxes
+
+Also spelled `sim sandbox`.
+
+### sim sandboxes create
+
+Create Sandbox (personal API key required)
+
+```bash
+sim sandboxes create [options]
+```
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | Yes | Display name, unique within the workspace; 1 to 64 characters. |
+| `--language <value>` | Yes | Dependency ecosystem: `javascript` installs from npm, `python` from PyPI. Accepted values: `javascript`, `python`. |
+| `--dependencies <value...>` | No | Package specifiers installed into the sandbox, one per entry. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+| `--cli-tools <value...>` | No | Pinned managed CLI ids installed into the sandbox, at most 10, no duplicates. (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
+| `--system-packages <value...>` | No | Debian packages installed into the sandbox, one per entry. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+
+</CommandTable>
+
+### sim sandboxes delete
+
+Delete Sandbox (personal API key required)
+
+```bash
+sim sandboxes delete <sandboxId> [options]
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `-y, --yes` | Yes | Confirm this operation. |
+
+</CommandTable>
+
+### sim sandboxes get
+
+Get Sandbox
+
+```bash
+sim sandboxes get <sandboxId>
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+### sim sandboxes list
+
+List Sandboxes
+
+```bash
+sim sandboxes list [options]
+```
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--search <value>` | No | Case-insensitive substring match against the sandbox name. |
+| `--sort-by <value>` | No | Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order. Accepted values: `name`, `createdAt`, `updatedAt`. |
+| `--sort-order <value>` | No | Sort direction. Accepted values: `asc`, `desc`. |
+| `--limit <n>` | No | Maximum items to return (0 for everything). Defaults to `100`. |
+
+</CommandTable>
+
+### sim sandboxes update
+
+Update Sandbox (personal API key required)
+
+```bash
+sim sandboxes update <sandboxId> [options]
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | No | New display name, unique within the workspace; 1 to 64 characters. |
+| `--language <value>` | No | Replacement dependency ecosystem. The whole spec is revalidated against it, so a Python dependency list does not survive a switch to JavaScript. Accepted values: `javascript`, `python`. |
+| `--dependencies <value...>` | No | Replacement package list; replaces the whole list. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+| `--cli-tools <value...>` | No | Replacement managed CLI list; replaces the whole list. (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
+| `--system-packages <value...>` | No | Replacement Debian package list; replaces the whole list. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+
+</CommandTable>
+
 ## sim secrets
 
 Also spelled `sim secret`.

diff --git a/apps/docs/content/docs/cli/sandboxes.mdx b/apps/docs/content/docs/cli/sandboxes.mdx
@@ -0,0 +1,127 @@
+---
+title: Sandboxes
+description: Manage sandboxes — every subcommand, argument, and flag
+---
+
+import { CommandTable } from '@/components/ui/command-table'
+
+`sim sandboxes` is also spelled `sim sandbox`.
+
+Every command below also accepts the [global options](/cli/commands#global-options).
+
+## Create sandbox
+
+```bash
+sim sandboxes create [options]
+```
+
+Create Sandbox (personal API key required)
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | Yes | Display name, unique within the workspace; 1 to 64 characters. |
+| `--language <value>` | Yes | Dependency ecosystem: `javascript` installs from npm, `python` from PyPI. Accepted values: `javascript`, `python`. |
+| `--dependencies <value...>` | No | Package specifiers installed into the sandbox, one per entry. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+| `--cli-tools <value...>` | No | Pinned managed CLI ids installed into the sandbox, at most 10, no duplicates. (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
+| `--system-packages <value...>` | No | Debian packages installed into the sandbox, one per entry. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+
+</CommandTable>
+
+## Delete sandbox
+
+```bash
+sim sandboxes delete <sandboxId> [options]
+```
+
+Delete Sandbox (personal API key required)
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `-y, --yes` | Yes | Confirm this operation. |
+
+</CommandTable>
+
+## Get sandbox
+
+```bash
+sim sandboxes get <sandboxId>
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+## List sandboxes
+
+```bash
+sim sandboxes list [options]
+```
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--search <value>` | No | Case-insensitive substring match against the sandbox name. |
+| `--sort-by <value>` | No | Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order. Accepted values: `name`, `createdAt`, `updatedAt`. |
+| `--sort-order <value>` | No | Sort direction. Accepted values: `asc`, `desc`. |
+| `--limit <n>` | No | Maximum items to return (0 for everything). Defaults to `100`. |
+
+</CommandTable>
+
+## Update sandbox
+
+```bash
+sim sandboxes update <sandboxId> [options]
+```
+
+Update Sandbox (personal API key required)
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `sandboxId` | Yes | Unique sandbox identifier. |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | No | New display name, unique within the workspace; 1 to 64 characters. |
+| `--language <value>` | No | Replacement dependency ecosystem. The whole spec is revalidated against it, so a Python dependency list does not survive a switch to JavaScript. Accepted values: `javascript`, `python`. |
+| `--dependencies <value...>` | No | Replacement package list; replaces the whole list. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+| `--cli-tools <value...>` | No | Replacement managed CLI list; replaces the whole list. (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
+| `--system-packages <value...>` | No | Replacement Debian package list; replaces the whole list. (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @). |
+
+</CommandTable>
diff --git a/apps/docs/content/docs/platform/enterprise/access-control.mdx b/apps/docs/content/docs/platform/enterprise/access-control.mdx
@@ -97,6 +97,7 @@ Controls the modules, actions, and credentials available to group members. Every
 |---------|---------------------------|
 | Chat | Revokes Chat. Members cannot ask Sim to build or edit anything. |
 | Sim Mailer | Revokes the Sim Mailer inbox. Members cannot read or send mail. |
+| Sandboxes | Revokes the Sandboxes module. Members cannot view, create, or change a workspace sandbox. |
 
 **Knowledge Base**
 

diff --git a/apps/docs/lib/openapi-download.test.ts b/apps/docs/lib/openapi-download.test.ts
@@ -33,7 +33,7 @@ describe('OpenAPI download', () => {
     const tags = document.tags as Array<{ name: string }>
 
     expect(document.openapi).toBe('3.1.0')
-    expect(Object.keys(paths)).toHaveLength(130)
+    expect(Object.keys(paths)).toHaveLength(132)
     expect(tags.map((tag) => tag.name)).toEqual([
       'Workflows',
       'Workflow Runs',
@@ -48,6 +48,7 @@ describe('OpenAPI download', () => {
       'MCP Servers',
       'Skills',
       'Custom Tools',
+      'Sandboxes',
       'Credentials',
       'Secrets',
       'Catalog',