curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"path": "src",
"recursive": true,
"max_depth": 2
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory"
payload = {
"path": "src",
"recursive": True,
"max_depth": 2
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({path: 'src', recursive: true, max_depth: 2})
};
fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'path' => 'src',
'recursive' => true,
'max_depth' => 2
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory"
payload := strings.NewReader("{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}"
response = http.request(request)
puts response.read_body{
"entries": [
{
"name": "pages",
"path": "src/pages",
"type": "directory"
},
{
"name": "Home.jsx",
"path": "src/pages/Home.jsx",
"size": 214,
"type": "file"
}
],
"truncated": false
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}List app files
Lists the files and directories in the app’s sandbox.
Every sandbox-bridge endpoint runs against the app’s live sandbox, the same filesystem the AI edits, so a change here is visible in the app editor immediately.
Defaults to the app root, one level deep. Set path to list a subtree, and recursive: true to go deeper, up to max_depth (3 by default, 10 at most). Dotfiles are left out unless you set include_hidden.
Directory entries carry no size; files do. Listings are capped at 1000 entries with truncated reporting it, and Base44’s own protected trees never appear. Dependency and build directories such as node_modules, dist and build are pruned, so the listing stays the app’s own source.
A path that exists but isn’t a directory answers 400, and one that doesn’t exist answers 404.
This endpoint is limited to 120 requests per minute per app, shared with the other sandbox-bridge endpoints that only read.
CREDITS_EXHAUSTED. Otherwise the bridge needs a Builder plan or higher on the app’s workspace, and answers 402 below that (PREMIUM_REQUIRED). Workspace API keys are not authorized and are rejected with a 403, and it is unavailable for agent apps. A personal API key works as-is. An OAuth access token needs the apps:read scope; the read endpoints don’t require sandbox:write.extra_data.code alongside the human-readable message. Branch on the code rather than on the message text or the status.curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"path": "src",
"recursive": true,
"max_depth": 2
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory"
payload = {
"path": "src",
"recursive": True,
"max_depth": 2
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({path: 'src', recursive: true, max_depth: 2})
};
fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'path' => 'src',
'recursive' => true,
'max_depth' => 2
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory"
payload := strings.NewReader("{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/list_directory")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"path\": \"src\",\n \"recursive\": true,\n \"max_depth\": 2\n}"
response = http.request(request)
puts response.read_body{
"entries": [
{
"name": "pages",
"path": "src/pages",
"type": "directory"
},
{
"name": "Home.jsx",
"path": "src/pages/Home.jsx",
"size": 214,
"type": "file"
}
],
"truncated": false
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.
Path Parameters
ID of the app whose sandbox to operate on.
Body
Optional Base44 branch ID. Omit to operate on main.
Directory relative to the app root. Default: app root.
List nested entries.
Max depth when recursive.
1 <= x <= 10Include dotfiles.
Response
The listing.
The listing, and whether you got all of it.
Files and directories, capped at 1000 entries.
Show child attributes
Show child attributes
[
{
"name": "pages",
"path": "src/pages",
"type": "directory"
},
{
"name": "Home.jsx",
"path": "src/pages/Home.jsx",
"size": 214,
"type": "file"
}
]
true when the listing hit the 1000-entry cap. Narrow it with path or a smaller max_depth.
false
Was this page helpful?