curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"path": "src/pages/Home.jsx",
"edits": [
{
"old_text": "<h1>Hello</h1>",
"new_text": "<h1>Welcome</h1>"
}
]
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file"
payload = {
"path": "src/pages/Home.jsx",
"edits": [
{
"old_text": "<h1>Hello</h1>",
"new_text": "<h1>Welcome</h1>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
path: 'src/pages/Home.jsx',
edits: [{old_text: '<h1>Hello</h1>', new_text: '<h1>Welcome</h1>'}]
})
};
fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'path' => 'src/pages/Home.jsx',
'edits' => [
[
'old_text' => '<h1>Hello</h1>',
'new_text' => '<h1>Welcome</h1>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file"
payload := strings.NewReader("{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"path": "src/pages/Home.jsx",
"diff": "--- src/pages/Home.jsx\n+++ src/pages/Home.jsx\n@@ -1,3 +1,3 @@\n- return <h1>Hello</h1>;\n+ return <h1>Welcome</h1>;\n",
"applied": true,
"warnings": []
}Edit an app file
Applies exact-string edits to a file in the app’s sandbox and returns the diff.
Every sandbox-bridge endpoint runs against the app’s live sandbox, the same filesystem the AI edits, so a change here is visible in the app editor immediately.
Send up to 100 edits and Base44 applies them in order, all or nothing: if any one fails to match, the file is left untouched and the request answers 400. Each old_text has to match exactly, and has to be unique in the file unless you set replace_all on that edit.
Set dry_run: true to get the same diff back without writing. A dry run answers with applied as false and no warnings key at all, so read applied rather than checking for warnings. A dry run still needs write access, because it is the edit tool.
Prefer this over Write an app file for changing part of a file: you send only the strings involved, and the response shows exactly what changed.
An entity file is named after its entity: base44/entities/TeamMember.jsonc defines TeamMember. A file that would define a new entity whose name isn’t letters, numbers and underscores answers 400 with INVALID_ENTITY_NAME, since it would never become a table; the message names the file to write instead.
This endpoint is limited to 60 requests per minute per app, shared with the other sandbox-bridge endpoints that change files.
CREDITS_EXHAUSTED. Otherwise the bridge needs a Builder plan or higher on the app’s workspace, and answers 402 below that (PREMIUM_REQUIRED). Workspace API keys are not authorized and are rejected with a 403, and it is unavailable for agent apps. A personal API key works as-is. An OAuth access token needs the sandbox:write scope.extra_data.code alongside the human-readable message. Branch on the code rather than on the message text or the status.curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"path": "src/pages/Home.jsx",
"edits": [
{
"old_text": "<h1>Hello</h1>",
"new_text": "<h1>Welcome</h1>"
}
]
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file"
payload = {
"path": "src/pages/Home.jsx",
"edits": [
{
"old_text": "<h1>Hello</h1>",
"new_text": "<h1>Welcome</h1>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
path: 'src/pages/Home.jsx',
edits: [{old_text: '<h1>Hello</h1>', new_text: '<h1>Welcome</h1>'}]
})
};
fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'path' => 'src/pages/Home.jsx',
'edits' => [
[
'old_text' => '<h1>Hello</h1>',
'new_text' => '<h1>Welcome</h1>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file"
payload := strings.NewReader("{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/edit_file")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"path\": \"src/pages/Home.jsx\",\n \"edits\": [\n {\n \"old_text\": \"<h1>Hello</h1>\",\n \"new_text\": \"<h1>Welcome</h1>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"path": "src/pages/Home.jsx",
"diff": "--- src/pages/Home.jsx\n+++ src/pages/Home.jsx\n@@ -1,3 +1,3 @@\n- return <h1>Hello</h1>;\n+ return <h1>Welcome</h1>;\n",
"applied": true,
"warnings": []
}Authorizations
Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.
Path Parameters
ID of the app whose sandbox to operate on.
Body
File path relative to the app root.
Ordered exact-string edits. Applied all-or-nothing.
1 - 100 elementsShow child attributes
Show child attributes
Optional Base44 branch ID. Omit to operate on main.
Return the unified diff without writing.
Response
The diff, applied unless you asked for a dry run.
The diff, and whether it landed.
The normalized path that was edited.
"src/pages/Home.jsx"
Unified diff of the change, whether or not it was applied.
"--- src/pages/Home.jsx\n+++ src/pages/Home.jsx\n@@ -1,3 +1,3 @@\n- return <h1>Hello</h1>;\n+ return <h1>Welcome</h1>;\n"
true when the file was changed, false on a dry_run preview.
true
Advisories about the write that did not stop it. Absent entirely on a dry_run, since nothing was written.
[]
Was this page helpful?