Read app files

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "paths": [
    "src/pages/Home.jsx",
    "package.json"
  ]
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file"

payload = { "paths": ["src/pages/Home.jsx", "package.json"] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({paths: ['src/pages/Home.jsx', 'package.json']})
};

fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'paths' => [
        'src/pages/Home.jsx',
        'package.json'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file"

	payload := strings.NewReader("{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "files": [
    {
      "content": "export default function Home() {\n  return <h1>Hello</h1>;\n}\n",
      "end_line": 3,
      "path": "src/pages/Home.jsx",
      "start_line": 1,
      "total_lines": 3,
      "truncated": false
    },
    {
      "error": {
        "code": "NOT_FOUND",
        "message": "File not found."
      },
      "path": "src/pages/Missing.jsx"
    }
  ]
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Code and sandbox

Read app files

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Reads one or more files from the app’s sandbox.

Every sandbox-bridge endpoint runs against the app’s live sandbox, the same filesystem the AI edits, so a change here is visible in the app editor immediately.

Ask for up to 50 paths in one call. Set offset and limit to read a line range instead of whole files, which is what keeps a large file inside the response budget. A successful entry reports total_lines and truncated, so you can tell a partial read from a complete one.

A path that fails does not fail the request. Every per-path problem rides inside the 200 as an error on that entry: a file that doesn’t exist, one that isn’t UTF-8 text, a path outside the app or in a protected tree, the point where the batch exhausts its aggregate read budget, and a read the sandbox itself refused. So a mixed response is normal, and a request where every path failed is still a 200. Check each entry for error before reading content, and branch on error.code.

This is a read, so a viewer on the workspace can call it and a read-only branch is no obstacle.

This endpoint is limited to 120 requests per minute per app, shared with the other sandbox-bridge endpoints that only read.

Where sandbox calls are metered, the bridge is open to every plan: each call is charged to the app’s integration credits and a workspace that has none left answers 402 with CREDITS_EXHAUSTED. Otherwise the bridge needs a Builder plan or higher on the app’s workspace, and answers 402 below that (PREMIUM_REQUIRED). Workspace API keys are not authorized and are rejected with a 403, and it is unavailable for agent apps. A personal API key works as-is. An OAuth access token needs the apps:read scope; the read endpoints don’t require sandbox:write.

Every error response carries a stable extra_data.code alongside the human-readable message. Branch on the code rather than on the message text or the status.

POST

api

apps

{app_id}

sandbox-bridge

read_file

Read app files

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "paths": [
    "src/pages/Home.jsx",
    "package.json"
  ]
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file"

payload = { "paths": ["src/pages/Home.jsx", "package.json"] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({paths: ['src/pages/Home.jsx', 'package.json']})
};

fetch('https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'paths' => [
        'src/pages/Home.jsx',
        'package.json'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file"

	payload := strings.NewReader("{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/sandbox-bridge/read_file")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"paths\": [\n    \"src/pages/Home.jsx\",\n    \"package.json\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "files": [
    {
      "content": "export default function Home() {\n  return <h1>Hello</h1>;\n}\n",
      "end_line": 3,
      "path": "src/pages/Home.jsx",
      "start_line": 1,
      "total_lines": 3,
      "truncated": false
    },
    {
      "error": {
        "code": "NOT_FOUND",
        "message": "File not found."
      },
      "path": "src/pages/Missing.jsx"
    }
  ]
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

required

Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.

Path Parameters

app_id

string

required

ID of the app whose sandbox to operate on.

Body

application/json

paths

string[]

required

One or more file paths relative to the app root.

Required array length: 1 - 50 elements

branch_id

string | null

Optional Base44 branch ID. Omit to operate on main.

offset

integer | null

1-based start line (optional).

Required range: x >= 1

limit

integer | null

Max lines to return from offset (optional).

Required range: x >= 1

Response

One entry per requested path, each either a read or an error.

The files you asked for, in the order you asked for them.

files

ReadFileEntry · object[]

required

One entry per requested path, in request order. Each is either a successful read or an error for that path, so check for error before reading content.

Show child attributes

Example:

[
  {
    "content": "export default function Home() {\n  return <h1>Hello</h1>;\n}\n",
    "end_line": 3,
    "path": "src/pages/Home.jsx",
    "start_line": 1,
    "total_lines": 3,
    "truncated": false
  },
  {
    "error": {
      "code": "NOT_FOUND",
      "message": "File not found."
    },
    "path": "src/pages/Missing.jsx"
  }
]

Base44 APIs

Apps API (Beta)

Workspace API (Beta)

Superagents API (Beta)

Monitoring API

Audit Logs API

Outbound webhooks

Read app files

Authorizations

Path Parameters

Body

Response