APIZ guide

Choose And Use An APIZ SDK

APIZ provides host SDKs for running agents and a separate SDK for writing Scripted Policies. They serve different execution environments.

What you want to do	Use	Your code runs in
Give an E2B, Daytona, Modal or Vercel sandbox temporary access	Python `apiz-sdk` or TypeScript `@apiz/sdk`	Your trusted application / orchestrator
Issue and revoke Client credential groups	The same host SDKs	Your trusted application / orchestrator
Inspect a request and allow, deny or modify it in a Policy	`@apiz/policy-sdk`	APIZ's restricted Policy evaluator after compilation
Let an agent call an upstream service	APIZ CLI setup plus that service's official CLI/SDK	The sandbox

Install apiz-sdk from PyPI, or @apiz/sdk and @apiz/policy-sdk from npm. Each language guide starts with a new project and includes the files needed for its tutorial. You do not need the APIZ source repository.

Start With Your Language

Guide	What you will learn
Python SDK	Installation, complete E2B + CLI + boto3 tutorial, async, explicit lifetime, management APIs and recovery
TypeScript SDK	ESM setup, full Node host tutorial, native sandbox customization, cancellation, management APIs and errors
Policy SDK	Installation, build/test a project, allow/deny/edit/reply/rate-limit cases and publication workflow

Pick A Sandbox Provider

Use each provider’s native SDK for creation, images, files, commands and deletion. APIZ receives no sandbox object. Each provider guide includes Python and TypeScript code, dependencies, configuration, cleanup, troubleshooting and evidence limits.

Provider	Guide focus	Validation scope
E2B	First tutorial; sync/async Python and Node commands/files	Earlier hosted toolchain evidence; this API revision validated locally
Daytona	Process API and organization network restrictions	Local simulation/native contracts; hosted acceptance deferred
Modal	App/image/client ownership and Python `.aio`	Native contracts/local tests; earlier hosted toolchain evidence is separately dated
Vercel	Scoped Python session, account credentials and native commands	Native contracts/local tests; earlier hosted toolchain evidence is separately dated

Follow The Credential Flow

Trusted host                        Native sandbox
User API Key + provider key         APIZ Client credentials only
  |                                   |
  +-- create native sandbox ----------+
  +-- optional CLI installation ------> install.sh
  +-- issue credentials
  +-- run with exported env ---------> APIZ CLI setup
                                      |
                                      +-- official SDK / CLI --> APIZ --> upstream
  +-- revoke credential group
  +-- delete sandbox (caller-owned)

The guest uses its ordinary tools. The host SDK provisions access; it does not replace the agent's official upstream SDK. Upstream secrets stay inside APIZ. Default handoff token authority is not narrowed by selecting a setup Binding; configure Client Bindings and Policies for that boundary.

Complete Your First Run

In the Web Console, configure an API connection, Policy, Client and Binding.
Create a scoped User API Key and keep it on the host.
Follow the language guide's install and environment steps.
Run the E2B tutorial, or adapt the native provider guide to your environment.
Confirm the official-tool request in Access Logs, then confirm credential revocation and caller-owned sandbox cleanup.

The host SDK and Policy SDK remain separate packages with different execution contracts. Use the language and provider guides above to build your integration.