---
search:
  tags:
    - timeline
    - GET
seo:
  description: >-
    What happened in the sandbox, for its org only: lifecycle calls and the…
    Reference for the GET /v1/sandboxes/{sandbox}/events endpoint in the pols.so
    API.
sidebar:
  label: The sandbox's timeline, newest first
  badge: GET
title: The sandbox's timeline, newest first
type: openapi-operation
---
What happened in the sandbox, for its org only: lifecycle calls and
the statuses the sandbox reached, commands run through exec (command
line, exit code and duration), desktop actions, and, when
`capture_content` is enabled, the first and last 4 KiB of command
output, typed text, and screenshots with thumbnails. Each event says
who caused it. Content capture is off by default.

Environment values, vault values and stdin are never recorded, nor
is the output of a command that received stdin: its stdout reads
`[output not recorded: command received stdin]`.
Before an event is stored, its command line, output, typed text and
errors are masked, best effort: the values of the sandbox's vault
entries (at least 4 bytes, as injected when the sandbox was created
and as they are now) and environment variables (at least 8 bytes,
the sandbox's and the command's own) become `[redacted NAME]`, and
common token formats become `[redacted]`: Authorization, Bearer and
Basic header values; `sk-`, `ghp_`, `gho_`, `github_pat_`, `xoxb-`
and `xoxp-` tokens; AWS access key IDs; PEM private keys; and the
values of `token`, `secret`, `password` and `api_key` pairs. Other
secrets in opted-in content may be recorded. The injected values are
held in memory only, so after a restart of the server a vault value
replaced since the sandbox was created is no longer masked.

Events are kept for `retention.events_days`, thumbnails for
`retention.screenshots_days`, and each org's timeline has a size cap
beyond which its oldest events are deleted. Deleting a sandbox
deletes its timeline, so a deleted sandbox has none. Page with
`before` set to `next_before`.

`GET /v1/sandboxes/{sandbox}/events`