POST /api/workspaces/{workspace_id}/tools/{tool}.
Two kinds of path
This trips people up once and then never again.- File tools (
read-file,write-file,edit-file,multi-edit) take workspace paths:/data.csv,/reports/august.mdx. They read and write storage directly and never start a sandbox. - Shell tools (
run-bash,grep) run inside the sandbox, where the workspace is mounted at/ws- which is also the working directory. Solslists the workspace root, and/ws/data.csvis the same file as/data.csv.
Run bash
status is completed or failed; a non-zero exit is failed, not an HTTP error. Commands are cut off after 10 minutes.
The sandbox keeps a persistent shell between calls, so cd and exported variables survive to the next command. Two consequences worth knowing: a bare exit in your command kills that shell (state is lost, a fresh one starts on the next call), and files written anywhere under /ws land in the workspace.
Pass sandbox_id to run in an isolated named container instead of the workspace’s default one - useful for keeping a long build away from everything else. Ids are scoped to the workspace, so the same id in two workspaces cannot collide.
Read a file
Output is line-numbered by default, which is what makes
edit-file easy to aim. Set raw: true when a program is going to parse the result. Binary files return 400 - download them instead.
Write a file
PUT /files/content with createOnly or baseRevision.
Edit a file
old_string must appear in the file or the call returns 400. By default only the first occurrence is replaced; set replace_all: true for every occurrence. The response reports how many replacements it made.
Apply several edits at once
Grep
Matches come back with
/ws-prefixed paths, because grep runs in the sandbox. Output is capped at 10,000 characters, so narrow the path or include rather than paging. Large binary and media files are skipped.
For meaning rather than exact text - “the doc about refund policy” - use semantic search.
Permissions
run-bash and grep need workspace-wide access, not access to a single file, because a shell command can reach anything mounted.
Related
- Agents overview - when to let an agent choose the tools instead
- Files - uploads, downloads, versions, and conditional writes
- Actions - typed capabilities beyond files and shell
- Agent Tools API reference - full schemas