> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a tunnel

> Creates a public tunnel to a sandbox port Served by the live controller (answers 401 unauthenticated) but absent from its published /openapi.json — verified…

<Warning>
  **Confirm your deployment before running this request.** This page describes an API contract;
  a published reference does not establish hosted availability. Check the dated
  [host report](/api-reference/hosts) and obtain your deployment URL and credentials.
  Replace the example host if your provisioned service uses a different URL.
</Warning>

Creates a public tunnel to a sandbox port

Served by the live controller (answers 401 unauthenticated) but absent from its published `/openapi.json` — verified 2026-08-31.

### Path parameters

<ParamField path="id" type="string (uuid)" required>
  Unique sandbox identifier
</ParamField>

### Request body

`CreateTunnelRequest`

<ParamField body="port" type="integer" required>
  Port to expose. Minimum: `1`. Maximum: `65535`.
</ParamField>

<ParamField body="protocol" type="string">
  Protocol (http or https). Allowed values: `'http'`, `'https'`.
</ParamField>

<ParamField body="expires_in" type="integer">
  TTL in seconds. Minimum: `60`. Maximum: `86400`.
</ParamField>

<ParamField body="public" type="boolean">
  When true, no token is required.
</ParamField>

### Response

`Tunnel`

<ResponseField name="tunnel_id" type="string" />

<ResponseField name="sandbox_id" type="string" />

<ResponseField name="port" type="integer" />

<ResponseField name="protocol" type="string" />

<ResponseField name="url" type="string" />

<ResponseField name="expires_at" type="string (date-time)" />

<ResponseField name="token" type="string" />

### Status codes

| Code | Meaning |
| - | - |
| `200` | Tunnel created |
| `400` | — |
| `401` | — |
| `404` | — |

### Using this contract

Read the [source OpenAPI document](/spec/sandbox.json) for declared schemas and alternatives.
This page also includes documented corrections from the [spec overlays](https://github.com/stateset/docs/tree/main/spec/overlays).
Example IDs and values are illustrative; replace them with records from your workspace.

<RequestExample>
  ```bash cURL theme={null}
  curl --silent --show-error --fail-with-body --request POST \
    --url 'https://api.sandbox.stateset.app/api/v1/sandbox/{id}/tunnels' \
    --header "Authorization: ApiKey $STATESET_SANDBOX_API_KEY" \
    --header 'Content-Type: application/json' \
    --data '{
    "port": 1,
    "protocol": "http",
    "expires_in": 60,
    "public": true
  }'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "tunnel_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "sandbox_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "port": 1,
    "protocol": "string",
    "url": "https://example.com/webhooks/stateset",
    "expires_at": "2026-08-31T14:22:05Z",
    "token": "YOUR_API_KEY"
  }
  ```
</ResponseExample>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.