Secret Injection

The Secret Injection API manages HTTPS request injection rules stored by the platform. When creating a sandbox, you can reference saved rules through injections, or pass inline rules directly. Real secrets are held by the platform and are not directly readable by processes inside the sandbox.

Supported Injection Types

Type	Required Parameters	Description
http	base_url	Custom HTTP header injection
openai	api_key	OpenAI-compatible API injection. Matches api.openai.com by default
anthropic	api_key	Anthropic API injection. Matches api.anthropic.com by default
gemini	api_key	Google Gemini API injection. Matches generativelanguage.googleapis.com by default
sufy	api_key	Sufy AI API injection. Matches the default Sufy AI API host
github	token	GitHub HTTPS request injection. Matches github.com and api.github.com

List Injection Rules

Description

Lists saved injection rules under the current account.

Request Path

GET /injection-rules

Response Fields

Returns an array of injection rules:

Field	Type	Description
ruleID	string	Injection rule ID
name	string	Injection rule name. Unique under the same user
createdAt	string	Creation time
updatedAt	string	Update time
injection	object	Injection rule configuration

Request Example

curl -X GET "$SUFY_SANDBOX_API_URL/injection-rules" \
  -H "Authorization: Sufy <SignedToken>"

SignedToken is generated by signing the request with your Sufy AK/SK.

Create an Injection Rule

Description

Creates a reusable injection rule.

Request Path

POST /injection-rules

Request Parameters

Parameter	Type	Required	Description
name	string	Yes	Injection rule name. Maximum 64 characters and unique under the same user
injection	object	Yes	Injection rule configuration

Parameters for the http type:

Parameter	Type	Required	Description
injection.type	string	Yes	Always http
injection.base_url	string	Yes	Base URL matched by HTTPS requests. If the protocol is not specified, https is used by default
injection.headers	object	No	HTTP headers to inject or override. Up to 20 entries

Parameters for AI service types:

Parameter	Type	Required	Description
injection.type	string	Yes	One of openai, anthropic, gemini, or sufy
injection.api_key	string	Yes	API key for the corresponding service
injection.base_url	string	No	Custom base URL. When omitted, the default host for the selected type is used

Parameters for the GitHub type:

Parameter	Type	Required	Description
injection.type	string	Yes	Always github
injection.token	string	Yes	GitHub token

Response Fields

The fields are the same as a single rule object in the injection rule list.

Request Example

curl -X POST "$SUFY_SANDBOX_API_URL/injection-rules" \
  -H "Authorization: Sufy <SignedToken>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "openai-prod",
    "injection": {
      "type": "openai",
      "api_key": "sk-xxx"
    }
  }'

Response Example

{
  "ruleID": "ir_123456",
  "name": "openai-prod",
  "createdAt": "2026-01-01T00:00:00Z",
  "updatedAt": "2026-01-01T00:00:00Z",
  "injection": {
    "type": "openai"
  }
}

Get Injection Rule Details

Request Path

GET /injection-rules/{ruleID}

Path Parameters

Parameter	Type	Required	Description
ruleID	string	Yes	Injection rule ID

Returns a single injection rule object on success.

Update an Injection Rule

Request Path

PUT /injection-rules/{ruleID}

Request Parameters

Parameter	Type	Required	Description
name	string	No	New injection rule name. Maximum 64 characters
injection	object	No	New injection rule configuration

Returns the updated injection rule object on success.

Delete an Injection Rule

Request Path

DELETE /injection-rules/{ruleID}

Returns 204 No Content on success.

Reference a Rule When Creating a Sandbox

Saved injection rules can be referenced with type: id when creating a sandbox:

curl -X POST "$SUFY_SANDBOX_API_URL/sandboxes" \
  -H "X-API-Key: $SUFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "templateID": "base",
    "injections": [
      {
        "type": "id",
        "id": "ir_123456"
      }
    ]
  }'

Related Documents

• API Overview
• Sandbox Instances