diff --git a/reference-config/operations.yaml b/reference-config/operations.yaml
index 2410fc6d..cc7eed48 100644
--- a/reference-config/operations.yaml
+++ b/reference-config/operations.yaml
@@ -1,5 +1,20 @@
 schemaVersion: 1
 
+connect:
+  productionBaseUrl: https://sandbox.agentbox-runtime.ru
+  method: POST
+  headers:
+    - name: Agentbox-Sandbox-Id
+      required: true
+      description: Sandbox identifier.
+    - name: Agentbox-Sandbox-Port
+      required: true
+      description: Envd port routed by the sandbox proxy.
+      default: 49983
+    - name: X-Access-Token
+      required: false
+      description: Sandbox-scoped envd access token, when one was issued.
+
 controlPlane:
   source: spec/openapi.yml
   publicAuthSchemes:
diff --git a/reference/connect/filesystem.md b/reference/connect/filesystem.md
index ebc29ae2..72d8211a 100644
--- a/reference/connect/filesystem.md
+++ b/reference/connect/filesystem.md
@@ -1,11 +1,25 @@
 # Filesystem API
 
-Service: `Filesystem`
+## Transport
+
+AgentBox exposes this service through the Connect protocol over HTTP.
+The AgentBox SDK supplies the routing and authorization headers automatically.
+
+- Production base URL: `https://sandbox.agentbox-runtime.ru`
+- Fully qualified service: `filesystem.Filesystem`
+- RPC URL pattern: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/{RPC}`
+
+### Request headers
+
+- **`Agentbox-Sandbox-Id`** · required — Sandbox identifier.
+- **`Agentbox-Sandbox-Port`** · required — Envd port routed by the sandbox proxy. Default: `49983`.
+- **`X-Access-Token`** · conditional — Sandbox-scoped envd access token, when one was issued.
 
 ## Stat
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/Stat`
 - Request: `StatRequest`
 - Response: `StatResponse`
 
@@ -13,6 +27,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/MakeDir`
 - Request: `MakeDirRequest`
 - Response: `MakeDirResponse`
 
@@ -20,6 +35,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/Move`
 - Request: `MoveRequest`
 - Response: `MoveResponse`
 
@@ -27,6 +43,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/ListDir`
 - Request: `ListDirRequest`
 - Response: `ListDirResponse`
 
@@ -34,6 +51,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/Remove`
 - Request: `RemoveRequest`
 - Response: `RemoveResponse`
 
@@ -41,6 +59,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/WatchDir`
 - Request: `WatchDirRequest`
 - Response: `stream WatchDirResponse`
 
@@ -48,6 +67,7 @@ Public RPC exposed by envd.
 
 Non-streaming versions of WatchDir
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/CreateWatcher`
 - Request: `CreateWatcherRequest`
 - Response: `CreateWatcherResponse`
 
@@ -55,6 +75,7 @@ Non-streaming versions of WatchDir
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/GetWatcherEvents`
 - Request: `GetWatcherEventsRequest`
 - Response: `GetWatcherEventsResponse`
 
@@ -62,6 +83,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/RemoveWatcher`
 - Request: `RemoveWatcherRequest`
 - Response: `RemoveWatcherResponse`
 
@@ -126,6 +148,7 @@ Public RPC exposed by envd.
 | `group` | `string` | 8 |  |
 | `modified_time` | `google.protobuf.Timestamp` | 9 |  |
 | `symlink_target` | `optional string` | 10 | If the entry is a symlink, this field contains the target of the symlink. |
+| `metadata` | `map<string, string>` | 11 | User-defined metadata stored as extended attributes (xattrs) on the file. Keys live under the `user.agentbox.` xattr namespace; the prefix is stripped here. Plain `user.*` xattrs written by other tooling are not reflected. |
 
 ### ListDirRequest
 
@@ -147,7 +170,7 @@ Public RPC exposed by envd.
 | `path` | `string` | 1 |  |
 | `recursive` | `bool` | 2 |  |
 | `include_entry` | `bool` | 3 | If true, each FilesystemEvent includes the EntryInfo of the affected entry, when available. |
-| `allow_network_mounts` | `bool` | 4 | Events on network mounts may be unreliable or not delivered at all. |
+| `allow_network_mounts` | `bool` | 4 | If true, allows watching paths on network filesystem mounts (NFS, CIFS, SMB, FUSE). Events on network mounts may be unreliable or not delivered at all. |
 
 ### FilesystemEvent
 
@@ -155,19 +178,19 @@ Public RPC exposed by envd.
 | --- | --- | ---: | --- |
 | `name` | `string` | 1 |  |
 | `type` | `EventType` | 2 |  |
-| `entry` | `optional EntryInfo` | 3 | events, where the entry no longer exists at this path). |
+| `entry` | `optional EntryInfo` | 3 | Info of the entry that triggered the event. Only populated when include_entry was requested and the entry could be stat-ed (e.g. not set for remove/rename-away events, where the entry no longer exists at this path). |
 
 ### WatchDirResponse
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `start` | `StartEvent` | 1 |  |
-| `filesystem` | `FilesystemEvent` | 2 |  |
-| `keepalive` | `KeepAlive` | 3 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `start` | `StartEvent` | 1 | `event` |  |
+| `filesystem` | `FilesystemEvent` | 2 | `event` |  |
+| `keepalive` | `KeepAlive` | 3 | `event` |  |
 
-### StartEvent
+### WatchDirResponse.StartEvent
 
-### KeepAlive
+### WatchDirResponse.KeepAlive
 
 ### CreateWatcherRequest
 
@@ -176,7 +199,7 @@ Public RPC exposed by envd.
 | `path` | `string` | 1 |  |
 | `recursive` | `bool` | 2 |  |
 | `include_entry` | `bool` | 3 | If true, each FilesystemEvent includes the EntryInfo of the affected entry, when available. |
-| `allow_network_mounts` | `bool` | 4 | Events on network mounts may be unreliable or not delivered at all. |
+| `allow_network_mounts` | `bool` | 4 | If true, allows watching paths on network filesystem mounts (NFS, CIFS, SMB, FUSE). Events on network mounts may be unreliable or not delivered at all. |
 
 ### CreateWatcherResponse
 
@@ -203,3 +226,25 @@ Public RPC exposed by envd.
 | `watcher_id` | `string` | 1 |  |
 
 ### RemoveWatcherResponse
+
+## Enum types
+
+### FileType
+
+| Value | Number | Description |
+| --- | ---: | --- |
+| `FILE_TYPE_UNSPECIFIED` | 0 |  |
+| `FILE_TYPE_FILE` | 1 |  |
+| `FILE_TYPE_DIRECTORY` | 2 |  |
+| `FILE_TYPE_SYMLINK` | 3 |  |
+
+### EventType
+
+| Value | Number | Description |
+| --- | ---: | --- |
+| `EVENT_TYPE_UNSPECIFIED` | 0 |  |
+| `EVENT_TYPE_CREATE` | 1 |  |
+| `EVENT_TYPE_WRITE` | 2 |  |
+| `EVENT_TYPE_REMOVE` | 3 |  |
+| `EVENT_TYPE_RENAME` | 4 |  |
+| `EVENT_TYPE_CHMOD` | 5 |  |
diff --git a/reference/connect/process.md b/reference/connect/process.md
index 3d99106c..51c8d62b 100644
--- a/reference/connect/process.md
+++ b/reference/connect/process.md
@@ -1,11 +1,25 @@
 # Process API
 
-Service: `Process`
+## Transport
+
+AgentBox exposes this service through the Connect protocol over HTTP.
+The AgentBox SDK supplies the routing and authorization headers automatically.
+
+- Production base URL: `https://sandbox.agentbox-runtime.ru`
+- Fully qualified service: `process.Process`
+- RPC URL pattern: `POST https://sandbox.agentbox-runtime.ru/process.Process/{RPC}`
+
+### Request headers
+
+- **`Agentbox-Sandbox-Id`** · required — Sandbox identifier.
+- **`Agentbox-Sandbox-Port`** · required — Envd port routed by the sandbox proxy. Default: `49983`.
+- **`X-Access-Token`** · conditional — Sandbox-scoped envd access token, when one was issued.
 
 ## List
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/List`
 - Request: `ListRequest`
 - Response: `ListResponse`
 
@@ -13,6 +27,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/Connect`
 - Request: `ConnectRequest`
 - Response: `stream ConnectResponse`
 
@@ -20,6 +35,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/Start`
 - Request: `StartRequest`
 - Response: `stream StartResponse`
 
@@ -27,6 +43,7 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/Update`
 - Request: `UpdateRequest`
 - Response: `UpdateResponse`
 
@@ -34,6 +51,7 @@ Public RPC exposed by envd.
 
 Client input stream ensures ordering of messages
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/StreamInput`
 - Request: `stream StreamInputRequest`
 - Response: `StreamInputResponse`
 
@@ -41,6 +59,7 @@ Client input stream ensures ordering of messages
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/SendInput`
 - Request: `SendInputRequest`
 - Response: `SendInputResponse`
 
@@ -48,13 +67,15 @@ Public RPC exposed by envd.
 
 Public RPC exposed by envd.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/SendSignal`
 - Request: `SendSignalRequest`
 - Response: `SendSignalResponse`
 
 ## CloseStdin
 
-Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
+Close stdin to signal EOF to the process. Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 
+- Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/CloseStdin`
 - Request: `CloseStdinRequest`
 - Response: `CloseStdinResponse`
 
@@ -65,10 +86,8 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
 | `size` | `Size` | 1 |  |
-| `cols` | `uint32` | 1 |  |
-| `rows` | `uint32` | 2 |  |
 
-### Size
+### PTY.Size
 
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
@@ -81,6 +100,7 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 | --- | --- | ---: | --- |
 | `cmd` | `string` | 1 |  |
 | `args` | `repeated string` | 2 |  |
+| `envs` | `map<string, string>` | 3 |  |
 | `cwd` | `optional string` | 4 |  |
 
 ### ListRequest
@@ -106,7 +126,7 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 | `process` | `ProcessConfig` | 1 |  |
 | `pty` | `optional PTY` | 2 |  |
 | `tag` | `optional string` | 3 |  |
-| `stdin` | `optional bool` | 4 | We default to true. New SDK versions will set this to false by default. |
+| `stdin` | `optional bool` | 4 | This is optional for backwards compatibility. We default to true. New SDK versions will set this to false by default. |
 
 ### UpdateRequest
 
@@ -119,36 +139,28 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 
 ### ProcessEvent
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `start` | `StartEvent` | 1 |  |
-| `data` | `DataEvent` | 2 |  |
-| `end` | `EndEvent` | 3 |  |
-| `keepalive` | `KeepAlive` | 4 |  |
-| `pid` | `uint32` | 1 |  |
-| `stdout` | `bytes` | 1 |  |
-| `stderr` | `bytes` | 2 |  |
-| `pty` | `bytes` | 3 |  |
-| `exit_code` | `sint32` | 1 |  |
-| `exited` | `bool` | 2 |  |
-| `status` | `string` | 3 |  |
-| `error` | `optional string` | 4 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `start` | `StartEvent` | 1 | `event` |  |
+| `data` | `DataEvent` | 2 | `event` |  |
+| `end` | `EndEvent` | 3 | `event` |  |
+| `keepalive` | `KeepAlive` | 4 | `event` |  |
 
-### StartEvent
+### ProcessEvent.StartEvent
 
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
 | `pid` | `uint32` | 1 |  |
 
-### DataEvent
+### ProcessEvent.DataEvent
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `stdout` | `bytes` | 1 |  |
-| `stderr` | `bytes` | 2 |  |
-| `pty` | `bytes` | 3 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `stdout` | `bytes` | 1 | `output` |  |
+| `stderr` | `bytes` | 2 | `output` |  |
+| `pty` | `bytes` | 3 | `output` |  |
 
-### EndEvent
+### ProcessEvent.EndEvent
 
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
@@ -157,7 +169,7 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 | `status` | `string` | 3 |  |
 | `error` | `optional string` | 4 |  |
 
-### KeepAlive
+### ProcessEvent.KeepAlive
 
 ### StartResponse
 
@@ -182,34 +194,32 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 
 ### ProcessInput
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `stdin` | `bytes` | 1 |  |
-| `pty` | `bytes` | 2 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `stdin` | `bytes` | 1 | `input` |  |
+| `pty` | `bytes` | 2 | `input` |  |
 
 ### StreamInputRequest
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `start` | `StartEvent` | 1 |  |
-| `data` | `DataEvent` | 2 |  |
-| `keepalive` | `KeepAlive` | 3 |  |
-| `process` | `ProcessSelector` | 1 |  |
-| `input` | `ProcessInput` | 2 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `start` | `StartEvent` | 1 | `event` |  |
+| `data` | `DataEvent` | 2 | `event` |  |
+| `keepalive` | `KeepAlive` | 3 | `event` |  |
 
-### StartEvent
+### StreamInputRequest.StartEvent
 
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
 | `process` | `ProcessSelector` | 1 |  |
 
-### DataEvent
+### StreamInputRequest.DataEvent
 
 | Field | Type | Number | Description |
 | --- | --- | ---: | --- |
 | `input` | `ProcessInput` | 2 |  |
 
-### KeepAlive
+### StreamInputRequest.KeepAlive
 
 ### StreamInputResponse
 
@@ -238,7 +248,17 @@ Only works for non-PTY processes. For PTY, send Ctrl+D (0x04) instead.
 
 ### ProcessSelector
 
-| Field | Type | Number | Description |
-| --- | --- | ---: | --- |
-| `pid` | `uint32` | 1 |  |
-| `tag` | `string` | 2 |  |
+| Field | Type | Number | Oneof | Description |
+| --- | --- | ---: | --- | --- |
+| `pid` | `uint32` | 1 | `selector` |  |
+| `tag` | `string` | 2 | `selector` |  |
+
+## Enum types
+
+### Signal
+
+| Value | Number | Description |
+| --- | ---: | --- |
+| `SIGNAL_UNSPECIFIED` | 0 |  |
+| `SIGNAL_SIGTERM` | 15 |  |
+| `SIGNAL_SIGKILL` | 9 |  |
diff --git a/reference/manifest.json b/reference/manifest.json
index 7fae5cb3..2d9458c5 100644
--- a/reference/manifest.json
+++ b/reference/manifest.json
@@ -1,51 +1,51 @@
 {
   "files": {
-    "connect/filesystem.md": "1cc1e81386810d3c5c999458e02340e3becb3da8138d943558584094750e5aae",
-    "connect/process.md": "037574455e9e8c5159c391d8c007e7272560f62c4e5ee681f8aec29f9cd24539",
-    "openapi/control-plane.yml": "f3009ea28f824b61092142caf527a062f59c791bc760a7810a4fb9dec8226a29",
-    "openapi/envd.yml": "83bc85bf7b4084105ac9ffeec708d04d0e14ab275026d616c30de31caea62589",
-    "openapi/markdown/assignTemplateTags.md": "3ec3dc705cbda5780d0a9e78234c7777f014784b2ec193821b6f5bb2ea26ec57",
-    "openapi/markdown/composeFiles.md": "3e5c37b40268689b6e5287a906c75b80f71fefafe94205c6327c976ca0594d5c",
-    "openapi/markdown/connectSandbox.md": "9106d09a6f525aa0bcbd1eed06de62a4d015d1f6fa63496ccb6aebbebb3ad332",
-    "openapi/markdown/createSandbox.md": "42b8b28e9aac9bcbbacec9dec346d043340f8c94ac497147a80910341572226f",
-    "openapi/markdown/createSnapshot.md": "433724d1260fd60e68268a2984f7ca7ae54a1cad120fb25a026b6a6518af004f",
-    "openapi/markdown/createTemplate.md": "b31935eef9b0c29bcd9402f7401a4159c349bed8b3e5458c4490870574bc2974",
-    "openapi/markdown/deleteTemplate.md": "3f9a6ab1e0ab144f0a68e41938ef23fd07ac2509b16f6b4b9df5478e54a5865c",
-    "openapi/markdown/deleteTemplateTags.md": "1b907ed1b5d9cd55a3b21f46c207217af8a4efe0fe6ccb56a8f988567fc27395",
-    "openapi/markdown/downloadFile.md": "d687f0fadf42a0c8d40324fbf6a732677dae38ed1cf02a755cf86eb9a5155abc",
-    "openapi/markdown/forkSandbox.md": "bc7846648216b1104ed1d1661eb08b9881b3fef7616bfae49542eca1d228e76e",
-    "openapi/markdown/getEnvironmentHealth.md": "640c9435ce216a6fd0e5da7ee646d8527e5de428c946fad219946f5c1de5622a",
-    "openapi/markdown/getEnvironmentMetrics.md": "fb7ce3264e1500da24b21a07b5b180110fa573fc3fb476c146f4529c16e7c089",
-    "openapi/markdown/getEnvironmentVariables.md": "12803bbc7e3f2638e16f013ce05b2a688d8085739e38049c1022452fd7881e50",
-    "openapi/markdown/getSandbox.md": "9e9f1200583b9abb206e7c69e9d4157403297042d2dd1e57e5bd804962073a91",
-    "openapi/markdown/getSandboxLogs.md": "6641f57b0ef9f7e029b66deb472616ea4abe54f3884b3021bfcf97b37920a598",
-    "openapi/markdown/getSandboxMetrics.md": "1572d44d0ff539495dadcbb909bb1e640b73375fcb4b0840243e692066162ace",
-    "openapi/markdown/getTeamMetrics.md": "063860650df86f09f1119f441b1410b1e329dd20000cf1b1f8a1f84fdcbdac53",
-    "openapi/markdown/getTeamMetricsMax.md": "5e5e6578470d1710c993ae69a91b34badaaa86e62e141eb91e57c6e0f7594fe6",
-    "openapi/markdown/getTemplate.md": "fa972635535ecb1b19324216185f75c90fe81520ed79dc7e20a0894306e054b3",
-    "openapi/markdown/getTemplateBuildLogs.md": "c1dc222e7ab5268897e8fdda893d1264ac9162db146fb89bbe6c9833f350ab7f",
-    "openapi/markdown/getTemplateBuildStatus.md": "26741b144d7ce26f353173bd0665b30925e6161d914317fb994bae5c2b4d0d3d",
-    "openapi/markdown/getTemplateByAlias.md": "2a42010266038d50581e3526becf1f35ad3ada6eecd757522b083817fe435301",
-    "openapi/markdown/getTemplateUploadUrl.md": "b06cb4aaed389e75daa8e509e3437a23915aad2b03ef6e69597df67984a48b19",
-    "openapi/markdown/killSandbox.md": "c864528a36849a512be77bf144ef7d41356f01cb0dbbe1d2f5143712a95268f2",
-    "openapi/markdown/listSandboxMetrics.md": "b945d76f80dc2fef506d2f21183bca49ddb045773b8895b6412e435e5c9d6d7f",
-    "openapi/markdown/listSandboxes.md": "7744505b60b94d1c8db8c1b7a1a66bcf9bdb8f51a46b13b5a90349e562924f59",
-    "openapi/markdown/listSnapshots.md": "d7f7ae67491c5da2930181b0fe423ef8ad661f5f4e7e88f47ecfb58cb08ac83f",
-    "openapi/markdown/listTemplateTags.md": "df27ed0dc04e6b49a3dc92704842e30365f50e88c8e28e6a5323a16aa10b7c45",
-    "openapi/markdown/listTemplates.md": "e89b7d18efcfa6e16385e6b4e2f227ad2e5c9fa7608426ece673077a35468e12",
-    "openapi/markdown/pauseSandbox.md": "0d1e7dd52ca966d37742e7d34898559dfd03c4ba3ca7f83f1859ddaefa9b0464",
-    "openapi/markdown/refreshSandbox.md": "dea1862241aad45c17b194994722a23941263bb697b885e795ba97cf154469bd",
-    "openapi/markdown/setSandboxTimeout.md": "ee0aaf78e2c0ffcdf4df1bde703fd4442d5436efad290bc235d1acc120adb997",
-    "openapi/markdown/startTemplateBuild.md": "befd11983028352bd7bf727113deb9bbb7d86d7b02385441111f4de46087173c",
-    "openapi/markdown/updateSandboxNetwork.md": "3449bd43a4e46c35d3f8ec314a47876ec06f85a8a75e4255212a85cb7a4c3e53",
-    "openapi/markdown/updateTemplate.md": "ace7930be4091213fc2e29a7109f489eaaf3a0e1d210aa65d9663a5adbf92250",
-    "openapi/markdown/uploadFile.md": "fe1dcc1b1eaad25ecd73f8c00a49c94ca7c2686fbdb6f3e2fbbebbfec6928806",
+    "connect/filesystem.md": "82a407c0ed5bd7cc707821ab73a943b6640a9e3793b354e9fc2a842bc799347e",
+    "connect/process.md": "7e0348bb046382f6c624659b5d8d1281c03df898c411f9502e8caea12f40b3f9",
+    "openapi/control-plane.yml": "99e42c340a18ac1f3bda9321d347b01f6bd8326c39373e92797bfb179ee0a0bf",
+    "openapi/envd.yml": "334700432025fcdfd9f95f9e58d90e6290b835015a24f269548eba5500c0df4f",
+    "openapi/markdown/assignTemplateTags.md": "d537a5123d8d2f6a6e5bc533db96d530e372b8aa4a6dbad3808904ca59e232fb",
+    "openapi/markdown/composeFiles.md": "208ca29c5143720389bc82db267aa8aaa2e8e7780e8a6cd5c9e11717bb44c84a",
+    "openapi/markdown/connectSandbox.md": "f6fdd47bbc40c52b32e6f6513ff0919c0cd76e557d2e58131d0e5d309b28421d",
+    "openapi/markdown/createSandbox.md": "88ea663b9b6c945be793c204084301b53c1fc2babce5247c680d1c45a0559178",
+    "openapi/markdown/createSnapshot.md": "1af5dcb96e3217dfc98a54eb43cc721cdd58f875f88bd77cde0b4fe34df0cb0d",
+    "openapi/markdown/createTemplate.md": "1a8b379df9e0e03c7b1c1fe0308d693dc09e589c3d474ee521d71fe556a96db2",
+    "openapi/markdown/deleteTemplate.md": "c0dff20f19cb6d8958f8ee859154f9a2508bb0da6c6a4f8bdb517fd275974e83",
+    "openapi/markdown/deleteTemplateTags.md": "468d6c2299f22c0be084edbc0f248fcf28cdd671a8551a30433ad28081e22f8d",
+    "openapi/markdown/downloadFile.md": "b116ab967ca2d42bcadf8e2c2db90d90686126b58fe7275efc6e2df09fa45745",
+    "openapi/markdown/forkSandbox.md": "18c8a075c71e33f2a69539516aa6595c9542c632cbba664dacef52fbbbe41550",
+    "openapi/markdown/getEnvironmentHealth.md": "e340276ca13456d2feee70f7d68f2b9b58a8efaac792c0845cf328988674e500",
+    "openapi/markdown/getEnvironmentMetrics.md": "5a86cbd31c9fcdd2aa468a708527e8935d276ca2af4a33cb7d431f347b972a3a",
+    "openapi/markdown/getEnvironmentVariables.md": "e9f9dba427ff7cb37aad0a7fd248e57e68d0f09235755689fb4f0f3bd0898171",
+    "openapi/markdown/getSandbox.md": "e74bcb3591c1d354eaa2df1d7bea332576c8a959f019e89861ebaa4a946d5c2b",
+    "openapi/markdown/getSandboxLogs.md": "dd5e9fb5878527d9aedaa9b427a0588a6ff0af538be9229b5b975b926681e900",
+    "openapi/markdown/getSandboxMetrics.md": "a29b5481530c977a21a8075ecccf0f715389ae708061e4161f996160e13cb14c",
+    "openapi/markdown/getTeamMetrics.md": "fcfc757143c2b55f68775d55a686348716343498647eea7a5c814bcf261123d9",
+    "openapi/markdown/getTeamMetricsMax.md": "feacf538054234f8a8e57ebed6c57c7d0a0069b13a8c3fd156fa54149723142d",
+    "openapi/markdown/getTemplate.md": "80bd73ddc9829b56da6d2c932d58716eefcf9f56257914e46eb9f925b8382df1",
+    "openapi/markdown/getTemplateBuildLogs.md": "b90ed92a46c5e6a64d582ab10838e16868d34d3c1482716f24d9273795869f14",
+    "openapi/markdown/getTemplateBuildStatus.md": "324f065b3da99bc6c43642798f55cc65249123ab027fe014ff895e5d7a8b64b1",
+    "openapi/markdown/getTemplateByAlias.md": "9913868d5cfea775b960d9069e61c4e436b8d3eb007eb40c9b7fbb70ace60b26",
+    "openapi/markdown/getTemplateUploadUrl.md": "616532a0f7f6d9bed2000a153f7c00eda467e91039f597fe829e98725b19570a",
+    "openapi/markdown/killSandbox.md": "8d552c09878a176f3337456fa1506c8c8ce494e49cd66fc550210ed4d56b3876",
+    "openapi/markdown/listSandboxMetrics.md": "277a702d5201fbbc3fd232e3176e1d2ba9b07b1d0f394edcf9bc9546f0d7e8d5",
+    "openapi/markdown/listSandboxes.md": "45f88626c8008fbe999698c387755824240ac15361ffae71a50872c0040ab7cd",
+    "openapi/markdown/listSnapshots.md": "b3185937327ba170567ede74ed8176d38aca58c4a607ba814420a91d346930cb",
+    "openapi/markdown/listTemplateTags.md": "2fe73787ba32d2049a425377462dacbca9b80b36ec6551815eec3e987d135413",
+    "openapi/markdown/listTemplates.md": "09eba7ff44f91e80db23145d2213b7ab9acbf7ed39cf7805df393fc8cf763042",
+    "openapi/markdown/pauseSandbox.md": "d33a86ed2c8c48c9a1c81ac5e80dfa244fb92b1ff8ef2cdddfefc2f8270949d7",
+    "openapi/markdown/refreshSandbox.md": "9f8580277cd6ffd79c2313f8688ed796916c2d457a19355094efcce72fa4207d",
+    "openapi/markdown/setSandboxTimeout.md": "3474378751522f5ad93035aafcc0b74221ebdd3e76c04a7c0a2d9c8f241fa228",
+    "openapi/markdown/startTemplateBuild.md": "943323508ef7ff22c57ba1484c6797b5f47212fad948d9ab194e98ed08ec9079",
+    "openapi/markdown/updateSandboxNetwork.md": "20e9cd1722fbf1e0af5f1a925ef8e64b27ce98a26afba6fc1d6cdafd96f0e444",
+    "openapi/markdown/updateTemplate.md": "f067cc266d8eddeab02fb70f548703ec44f187ca9c3b79c9a908d71a14e067f9",
+    "openapi/markdown/uploadFile.md": "3a3b5ebadf3282a18f90d58a220152aea0eba9eb5ad455ac89483a0acc44e8c7",
     "openapi/operations.json": "f5097d93fb7eb5f6482e632624d5a212e29441ef8c558601ccbe2dae26db050d",
     "sdk/cli/auth.md": "0b2c75262b0c0670c7bc0f0f3cbed65fbe4a16d6fe4437789a5685b8bf2174a1",
     "sdk/cli/sandbox.md": "16b64c5a4e932eca2452e400e0faf154eba1d3c7373513aa7cd9744e02908313",
     "sdk/cli/template.md": "f270b22b9ee10a9b954a14f24e04c5449b4d5823bb28002ffde3ed682594cfc5",
     "sdk/javascript/code-interpreter/README.md": "a787206eb86f81fc306b373ce20bc6c91464b0ab3c3ec7650eccbb6be5f676c5",
-    "sdk/javascript/code-interpreter/classes/Sandbox.md": "0c380df735431ad98397ec32920159e4c6ba103e600603551ded77b2f472839a",
+    "sdk/javascript/code-interpreter/classes/Sandbox.md": "1f69d878e794b39c0ef2efd0770cb7385efb2795c5ff971622fd93f6e80030f3",
     "sdk/javascript/code-interpreter/enumerations/ChartType.md": "cf1ba00cd3258cc88814b7215e101b0d775ceb15dd833636d58ae538d8107ec1",
     "sdk/javascript/code-interpreter/enumerations/ScaleType.md": "8cf4764b2c7844578b492dc0126d4ca13bb11d3c93accb28369ea24b3be8c0a1",
     "sdk/javascript/code-interpreter/interfaces/CreateCodeContextOpts.md": "dccfd965ed1aaac775e2202db7779526ae5227b17757ab5e69933e7e900140ae",
@@ -77,7 +77,7 @@
     "sdk/javascript/commands/interfaces/CommandRequestOpts.md": "cafa91c729e7844793dc968f0c253e64f1f6c5b311e41e11b09f9ecb08e2e88b",
     "sdk/javascript/commands/interfaces/CommandResult.md": "eab8e374efe1042d89052d6535ec148f0fa45b7a42056bbf1f5f37d350910cab",
     "sdk/javascript/commands/interfaces/CommandStartOpts.md": "94b6b7b977696e8b013d09f545ccac254e46fd6b5ec2001ed5064579afdcc57e",
-    "sdk/javascript/commands/interfaces/Commands.md": "782a83ddcef47090d0d5dd5b237340c88c664730c3d58b12f79ba0027ca2bdbf",
+    "sdk/javascript/commands/interfaces/Commands.md": "abf7dee4fc2d5f7b0422d677115a3dd01418d2e29afc34eb22c2cee548de13a8",
     "sdk/javascript/commands/interfaces/ProcessInfo.md": "f3b3be4d6a94eb18df59ed226e689175e62d92cc4c708013f73799e63985319c",
     "sdk/javascript/commands/interfaces/Pty.md": "85962c5e714c73d23c38e64ee4936ecc945243d6c77f5fa6d9d790a2aaef56d8",
     "sdk/javascript/commands/type-aliases/CommandConnectOpts.md": "831b9eaee3a26e90a5d7f9003a66ce334a4ef650928846428b54d0309efa0893",
@@ -122,23 +122,23 @@
     "sdk/javascript/ready-commands/functions/waitForURL.md": "6d48c23ab42a46435af442d89652554b3972146db19f125ff77c7b03e91b744f",
     "sdk/javascript/sandbox/README.md": "4835e9b776ae1006374372fdb374e29a3dd46380b610f374f2d88c3e9f495780",
     "sdk/javascript/sandbox/classes/AgentBox.md": "eda95be473aab89d16d341ec9accf1d9afcae8b28c9cf3bb0783ef22241f0354",
-    "sdk/javascript/sandbox/classes/Sandbox.md": "3d3a29fb8c861829b0ceede40264ef1a1da8ba94134c6e13e3e4b740d7d11e03",
-    "sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md": "31969a24a0233a15b29dd5a4a3455d1afa7898c7db8b121ab00889df3b014dc7",
+    "sdk/javascript/sandbox/classes/Sandbox.md": "fbf027c2ed827cf399f4406516c006f53911ac916c86deb5efdbfaec2db56d40",
+    "sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md": "0499c857c4836c39450268facfa1c53ffee70dcb4447b15a85edc095a2e69d0d",
     "sdk/javascript/sandbox/interfaces/McpServer.md": "80c715da37c6508052faed9f6c1ff5c96c92ddcf75dd1855dbf3e98b4217565d",
-    "sdk/javascript/sandbox/interfaces/SandboxApiOpts.md": "7d848b9c877ffb64855be04a5dcd3e3272186b69bb8d451bd7e37c2c69ae2647",
-    "sdk/javascript/sandbox/interfaces/SandboxForkOpts.md": "2b7f29dc36c0776fff31ca30bae8dd2da7c26e15e9956993cbf358b439b8d6de",
+    "sdk/javascript/sandbox/interfaces/SandboxApiOpts.md": "4276fd99536e8545f79fd12bbd479c7aa793a692fb4fe74b4df4f16e1eae0b98",
+    "sdk/javascript/sandbox/interfaces/SandboxForkOpts.md": "207cd816aa1725ce377ca5a3e56044c087a68aa81921cfdf5168bbad72c3218c",
     "sdk/javascript/sandbox/interfaces/SandboxIamOpts.md": "b0676dff6384475115b24f890d576020db5437b2539b1d1b34da8991ad85a3da",
     "sdk/javascript/sandbox/interfaces/SandboxIamToken.md": "8824bf3a069f681e39de27443c097595b3214111b0df3e10be613ee380841119",
     "sdk/javascript/sandbox/interfaces/SandboxInfo.md": "6512df3dc84cd5cf25122b2238f11c7391ac137faa8ae0cbd353e8d5d14da7b1",
-    "sdk/javascript/sandbox/interfaces/SandboxListOpts.md": "486f810b0127d72ab47928c487e9d73c9ad60dc41fd48539cfad0edd79edae07",
+    "sdk/javascript/sandbox/interfaces/SandboxListOpts.md": "887d28b99920a0230b582a35614f37365b3cbd715ee1f19c920d943b806383fe",
     "sdk/javascript/sandbox/interfaces/SandboxMetrics.md": "4e7b66fee2d60e552c193956efca47cb16fa4696800e0434209517099f83852b",
-    "sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md": "dbdf9c20c43aa1cfc608e32eb750cb010c637216616456a4109e0e4bbf6f3392",
-    "sdk/javascript/sandbox/interfaces/SandboxOpts.md": "5f948d29a09cf6a0a9adc92c51a4713ed3ca74edb2c63d8c91ad7891f12c7d1d",
-    "sdk/javascript/sandbox/interfaces/SandboxPaginator.md": "31e1b349de4638b1eada4a0dd23c3e0f7dbaca6d405b2ff29d00967950e08dba",
-    "sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md": "6759c87eedd7cb2333636aa8f7c05844aae8a14deb8f82e336aa6b4086e5e4f8",
+    "sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md": "54491a944b5c270e0648da4f29f48fa7b2b81d03892bd3c3d06d738ae39648ce",
+    "sdk/javascript/sandbox/interfaces/SandboxOpts.md": "0c5421aa90299319a702fe55323cf46920243c1d52d377a612f3b91b25962534",
+    "sdk/javascript/sandbox/interfaces/SandboxPaginator.md": "ced3c79f2cf1a52fcbaafea1f874a603dea7c8b3b11d6fea89873dc2e8aec438",
+    "sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md": "bd9ec9066cb5651041399ba43e5f7b69fa121dab2809807f1ffe572eab9825d1",
     "sdk/javascript/sandbox/interfaces/SnapshotInfo.md": "d54e8ee99f1fb9e1d43372b35ce42927cd33e9e21086d69f25e2ae1c6b9ec8c3",
-    "sdk/javascript/sandbox/interfaces/SnapshotListOpts.md": "631e3cf2bc3e9d402f8df4dd592e76d95549726b4dd307677dddfb606ff39dd6",
-    "sdk/javascript/sandbox/interfaces/SnapshotPaginator.md": "664425f9ee81f71adc63793fffdf505343352bbb1137f7d78271494b46dedfb1",
+    "sdk/javascript/sandbox/interfaces/SnapshotListOpts.md": "67a3e876779679fa91fb98f5678fc4a6e97c3c6605cef948d3c47ba06e756d91",
+    "sdk/javascript/sandbox/interfaces/SnapshotPaginator.md": "965ac1e0f6396d346f1a0e814bcf77902cecccd2bba651e08946fd499aa87158",
     "sdk/javascript/sandbox/type-aliases/AgentBoxClientOpts.md": "64aec729e35ec0814bc3301666d14642f18394a12f4aa238beccbb6315a35895",
     "sdk/javascript/sandbox/type-aliases/SandboxConnectOpts.md": "ae66e94fd6480eb211aa49bff925d5f9d01fb9536fba3ce6615975906fc4bdf3",
     "sdk/javascript/sandbox/type-aliases/SandboxIamTokenType.md": "1f575132918286ee1cbca5c0e3a223accd0fe00d28ccf031cf8e736b088d7e5b",
diff --git a/reference/openapi/control-plane.yml b/reference/openapi/control-plane.yml
index f31a0adb..80481e01 100644
--- a/reference/openapi/control-plane.yml
+++ b/reference/openapi/control-plane.yml
@@ -6,15 +6,6 @@ servers:
 - url: https://api.agentbox-runtime.ru
 components:
   parameters:
-    idempotencyKey:
-      name: Idempotency-Key
-      in: header
-      required: true
-      description: Stable operation identity. Reusing it with different input is rejected.
-      schema:
-        type: string
-        minLength: 1
-        maxLength: 255
     templateID:
       name: templateID
       in: path
@@ -39,38 +30,6 @@ components:
       required: true
       schema:
         type: string
-    nodeID:
-      name: nodeID
-      in: path
-      required: true
-      schema:
-        type: string
-    apiKeyID:
-      name: apiKeyID
-      in: path
-      required: true
-      schema:
-        type: string
-    accessTokenID:
-      name: accessTokenID
-      in: path
-      required: true
-      schema:
-        type: string
-    snapshotID:
-      name: snapshotID
-      in: path
-      required: true
-      schema:
-        type: string
-        description: Identifier of the snapshot (template ID)
-    tag:
-      name: tag
-      in: path
-      required: true
-      schema:
-        type: string
-        description: Tag name
     paginationLimit:
       name: limit
       in: query
@@ -89,12 +48,6 @@ components:
       required: false
       schema:
         type: string
-    volumeID:
-      name: volumeID
-      in: path
-      required: true
-      schema:
-        type: string
   headers:
     XNextToken:
       description: Cursor to fetch the next page of results, if more exist
@@ -139,12 +92,6 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/Error'
-    '410':
-      description: Gone
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/Error'
     '500':
       description: Server error
       content:
@@ -152,25 +99,6 @@ components:
           schema:
             $ref: '#/components/schemas/Error'
   schemas:
-    Team:
-      required:
-      - teamID
-      - name
-      - apiKey
-      - isDefault
-      properties:
-        teamID:
-          type: string
-          description: Identifier of the team
-        name:
-          type: string
-          description: Name of the team
-        apiKey:
-          type: string
-          description: API key for the team
-        isDefault:
-          type: boolean
-          description: Whether the team is the default team
     TeamUser:
       required:
       - id
@@ -365,19 +293,6 @@ components:
           description: Whether the sandbox can auto-resume.
         onTimeout:
           $ref: '#/components/schemas/SandboxOnTimeout'
-    SandboxLog:
-      description: Log entry with timestamp and line
-      required:
-      - timestamp
-      - line
-      properties:
-        timestamp:
-          type: string
-          format: date-time
-          description: Timestamp of the log entry
-        line:
-          type: string
-          description: Log line content
     SandboxLogEntry:
       required:
       - timestamp
@@ -401,21 +316,6 @@ components:
           type: object
           additionalProperties:
             type: string
-    SandboxLogs:
-      required:
-      - logs
-      - logEntries
-      properties:
-        logs:
-          description: Logs of the sandbox
-          type: array
-          items:
-            $ref: '#/components/schemas/SandboxLog'
-        logEntries:
-          description: Structured logs of the sandbox
-          type: array
-          items:
-            $ref: '#/components/schemas/SandboxLogEntry'
     SandboxLogsV2Response:
       required:
       - logs
@@ -667,14 +567,6 @@ components:
         tokenType:
           type: string
           description: Workload token type.
-    ResumedSandbox:
-      properties:
-        timeout:
-          type: integer
-          format: int32
-          minimum: 0
-          default: 15
-          description: Time to live for the sandbox in seconds.
     ConnectSandbox:
       type: object
       required:
@@ -786,28 +678,6 @@ components:
         value:
           type: number
           description: The maximum value of the requested metric in the given interval
-    AdminSandboxKillResult:
-      required:
-      - killedCount
-      - failedCount
-      properties:
-        killedCount:
-          type: integer
-          description: Number of sandboxes successfully killed
-        failedCount:
-          type: integer
-          description: Number of sandboxes that failed to kill
-    AdminBuildCancelResult:
-      required:
-      - cancelledCount
-      - failedCount
-      properties:
-        cancelledCount:
-          type: integer
-          description: Number of builds successfully cancelled
-        failedCount:
-          type: integer
-          description: Number of builds that failed to cancel
     Template:
       required:
       - templateID
@@ -992,29 +862,6 @@ components:
         public:
           type: boolean
           description: Whether the template is public or only accessible by the team
-    TemplateBuildRequest:
-      required:
-      - dockerfile
-      properties:
-        alias:
-          description: Alias of the template
-          type: string
-        dockerfile:
-          description: Dockerfile for the template
-          type: string
-        teamID:
-          type: string
-          description: Identifier of the team
-        startCmd:
-          description: Start command to execute in the template after the build
-          type: string
-        readyCmd:
-          description: Ready check command to execute in the template after the build
-          type: string
-        cpuCount:
-          $ref: '#/components/schemas/CPUCount'
-        memoryMB:
-          $ref: '#/components/schemas/MemoryMB'
     TemplateStep:
       description: Step in the template build process
       required:
@@ -1054,17 +901,6 @@ components:
           $ref: '#/components/schemas/CPUCount'
         memoryMB:
           $ref: '#/components/schemas/MemoryMB'
-    TemplateBuildRequestV2:
-      required:
-      - alias
-      properties:
-        alias:
-          description: Alias of the template
-          type: string
-        cpuCount:
-          $ref: '#/components/schemas/CPUCount'
-        memoryMB:
-          $ref: '#/components/schemas/MemoryMB'
     FromImageRegistry:
       oneOf:
       - $ref: '#/components/schemas/AWSRegistry'
@@ -1280,322 +1116,6 @@ components:
       enum:
       - temporary
       - persistent
-    NodeStatus:
-      type: string
-      description: 'Status of the node.
-
-        - draining: the node is bound to be shut down. It will not accept new sandboxes
-        and will stop once all existing sandboxes are done.
-
-        - standby: the node is not actively used, but it can return to ready and continue
-        serving traffic.
-
-        '
-      enum:
-      - ready
-      - draining
-      - connecting
-      - unhealthy
-      - standby
-    NodeStatusChange:
-      required:
-      - status
-      properties:
-        clusterID:
-          type: string
-          format: uuid
-          description: Identifier of the cluster
-        status:
-          $ref: '#/components/schemas/NodeStatus'
-    DiskMetrics:
-      required:
-      - mountPoint
-      - device
-      - filesystemType
-      - usedBytes
-      - totalBytes
-      properties:
-        mountPoint:
-          type: string
-          description: Mount point of the disk
-        device:
-          type: string
-          description: Device name
-        filesystemType:
-          type: string
-          description: Filesystem type (e.g., ext4, xfs)
-        usedBytes:
-          type: integer
-          format: uint64
-          description: Used space in bytes
-        totalBytes:
-          type: integer
-          format: uint64
-          description: Total space in bytes
-    NodeMetrics:
-      description: Node metrics
-      required:
-      - allocatedCPU
-      - allocatedMemoryBytes
-      - cpuPercent
-      - memoryUsedBytes
-      - cpuCount
-      - memoryTotalBytes
-      - disks
-      - hugePagesTotal
-      - hugePagesUsed
-      - hugePagesReserved
-      - hugePageSizeBytes
-      properties:
-        allocatedCPU:
-          type: integer
-          format: uint32
-          description: Number of allocated CPU cores
-        cpuPercent:
-          type: integer
-          format: uint32
-          description: Node CPU usage percentage
-        cpuCount:
-          type: integer
-          format: uint32
-          description: Total number of CPU cores on the node
-        allocatedMemoryBytes:
-          type: integer
-          format: uint64
-          description: Amount of allocated memory in bytes
-        memoryUsedBytes:
-          type: integer
-          format: uint64
-          description: Node memory used in bytes
-        memoryTotalBytes:
-          type: integer
-          format: uint64
-          description: Total node memory in bytes
-        hugePagesTotal:
-          type: integer
-          format: uint64
-          description: Total number of preallocated hugepages on the node
-        hugePagesUsed:
-          type: integer
-          format: uint64
-          description: Number of hugepages in use (total - free)
-        hugePagesReserved:
-          type: integer
-          format: uint64
-          description: Number of reserved hugepages (committed but not yet faulted)
-        hugePageSizeBytes:
-          type: integer
-          format: uint64
-          description: Size of a single hugepage in bytes
-        disks:
-          type: array
-          description: Detailed metrics for each disk/mount point
-          items:
-            $ref: '#/components/schemas/DiskMetrics'
-    MachineInfo:
-      required:
-      - cpuFamily
-      - cpuModel
-      - cpuModelName
-      - cpuArchitecture
-      properties:
-        cpuFamily:
-          type: string
-          description: CPU family of the node
-        cpuModel:
-          type: string
-          description: CPU model of the node
-        cpuModelName:
-          type: string
-          description: CPU model name of the node
-        cpuArchitecture:
-          type: string
-          description: CPU architecture of the node
-    Node:
-      required:
-      - id
-      - serviceInstanceID
-      - clusterID
-      - status
-      - statusChangedAt
-      - sandboxCount
-      - metrics
-      - createSuccesses
-      - createFails
-      - sandboxStartingCount
-      - version
-      - commit
-      - machineInfo
-      properties:
-        version:
-          type: string
-          description: Version of the orchestrator
-        commit:
-          type: string
-          description: Commit of the orchestrator
-        id:
-          type: string
-          description: Identifier of the node
-        serviceInstanceID:
-          type: string
-          description: Service instance identifier of the node
-        clusterID:
-          type: string
-          description: Identifier of the cluster
-        machineInfo:
-          $ref: '#/components/schemas/MachineInfo'
-        status:
-          $ref: '#/components/schemas/NodeStatus'
-        statusChangedAt:
-          type: string
-          format: date-time
-          description: Time when the node status was last changed
-        sandboxCount:
-          type: integer
-          format: uint32
-          description: Number of sandboxes running on the node
-        metrics:
-          $ref: '#/components/schemas/NodeMetrics'
-        createSuccesses:
-          type: integer
-          format: uint64
-          description: Number of sandbox create successes
-        createFails:
-          type: integer
-          format: uint64
-          description: Number of sandbox create fails
-        sandboxStartingCount:
-          type: integer
-          format: int
-          description: Number of starting Sandboxes
-    NodeDetail:
-      required:
-      - id
-      - serviceInstanceID
-      - clusterID
-      - status
-      - statusChangedAt
-      - sandboxCount
-      - createSuccesses
-      - createFails
-      - version
-      - commit
-      - metrics
-      - machineInfo
-      properties:
-        clusterID:
-          type: string
-          description: Identifier of the cluster
-        version:
-          type: string
-          description: Version of the orchestrator
-        commit:
-          type: string
-          description: Commit of the orchestrator
-        id:
-          type: string
-          description: Identifier of the node
-        serviceInstanceID:
-          type: string
-          description: Service instance identifier of the node
-        machineInfo:
-          $ref: '#/components/schemas/MachineInfo'
-        status:
-          $ref: '#/components/schemas/NodeStatus'
-        statusChangedAt:
-          type: string
-          format: date-time
-          description: Time when the node status was last changed
-        sandboxCount:
-          type: integer
-          format: uint32
-          description: Number of sandboxes running on the node
-        metrics:
-          $ref: '#/components/schemas/NodeMetrics'
-        createSuccesses:
-          type: integer
-          format: uint64
-          description: Number of sandbox create successes
-        createFails:
-          type: integer
-          format: uint64
-          description: Number of sandbox create fails
-    TeamAPIKey:
-      required:
-      - id
-      - name
-      - mask
-      - createdAt
-      properties:
-        id:
-          type: string
-          format: uuid
-          description: Identifier of the API key
-        name:
-          type: string
-          description: Name of the API key
-        mask:
-          $ref: '#/components/schemas/IdentifierMaskingDetails'
-        createdAt:
-          type: string
-          format: date-time
-          description: Timestamp of API key creation
-        createdBy:
-          allOf:
-          - $ref: '#/components/schemas/TeamUser'
-          nullable: true
-        lastUsed:
-          type: string
-          format: date-time
-          description: Last time this API key was used
-          nullable: true
-    CreatedTeamAPIKey:
-      required:
-      - id
-      - key
-      - mask
-      - name
-      - createdAt
-      properties:
-        id:
-          type: string
-          format: uuid
-          description: Identifier of the API key
-        key:
-          type: string
-          description: Raw value of the API key
-        mask:
-          $ref: '#/components/schemas/IdentifierMaskingDetails'
-        name:
-          type: string
-          description: Name of the API key
-        createdAt:
-          type: string
-          format: date-time
-          description: Timestamp of API key creation
-        createdBy:
-          allOf:
-          - $ref: '#/components/schemas/TeamUser'
-          nullable: true
-        lastUsed:
-          type: string
-          format: date-time
-          description: Last time this API key was used
-          nullable: true
-    NewTeamAPIKey:
-      required:
-      - name
-      properties:
-        name:
-          type: string
-          description: Name of the API key
-    UpdateTeamAPIKey:
-      required:
-      - name
-      properties:
-        name:
-          type: string
-          description: New name for the API key
     AssignedTemplateTags:
       required:
       - tags
@@ -1665,25 +1185,6 @@ components:
         message:
           type: string
           description: Error
-    IdentifierMaskingDetails:
-      required:
-      - prefix
-      - valueLength
-      - maskedValuePrefix
-      - maskedValueSuffix
-      properties:
-        prefix:
-          type: string
-          description: Prefix that identifies the token or key type
-        valueLength:
-          type: integer
-          description: Length of the token or key
-        maskedValuePrefix:
-          type: string
-          description: Prefix used in masked version of the token or key
-        maskedValueSuffix:
-          type: string
-          description: Suffix used in masked version of the token or key
   securitySchemes:
     ApiKeyAuth:
       type: apiKey
diff --git a/reference/openapi/envd.yml b/reference/openapi/envd.yml
index ff1ae074..c72960ac 100644
--- a/reference/openapi/envd.yml
+++ b/reference/openapi/envd.yml
@@ -16,6 +16,9 @@ paths:
       operationId: getEnvironmentHealth
       tags:
       - environment
+      parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       security: []
   /metrics:
     get:
@@ -30,6 +33,9 @@ paths:
       operationId: getEnvironmentMetrics
       tags:
       - environment
+      parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       security:
       - {}
       - AccessTokenAuth: []
@@ -46,6 +52,9 @@ paths:
       operationId: getEnvironmentVariables
       tags:
       - environment
+      parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       security:
       - {}
       - AccessTokenAuth: []
@@ -55,6 +64,8 @@ paths:
       tags:
       - files
       parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       - $ref: '#/components/parameters/FilePath'
       - $ref: '#/components/parameters/User'
       - $ref: '#/components/parameters/Signature'
@@ -122,6 +133,8 @@ paths:
       tags:
       - files
       parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       - $ref: '#/components/parameters/FilePath'
       - $ref: '#/components/parameters/User'
       - $ref: '#/components/parameters/Signature'
@@ -173,6 +186,9 @@ paths:
         '507':
           $ref: '#/components/responses/NotEnoughDiskSpace'
       operationId: composeFiles
+      parameters:
+      - $ref: '#/components/parameters/AgentboxSandboxId'
+      - $ref: '#/components/parameters/AgentboxSandboxPort'
       security:
       - {}
       - AccessTokenAuth: []
@@ -209,6 +225,21 @@ components:
         used with the signature parameter.
       schema:
         type: integer
+    AgentboxSandboxId:
+      name: Agentbox-Sandbox-Id
+      in: header
+      required: true
+      description: Identifier of the sandbox that receives the request.
+      schema:
+        type: string
+    AgentboxSandboxPort:
+      name: Agentbox-Sandbox-Port
+      in: header
+      required: true
+      description: Internal envd HTTP port exposed through the sandbox proxy.
+      schema:
+        type: integer
+        default: 49983
   requestBodies:
     File:
       required: true
@@ -377,31 +408,6 @@ components:
         disk_total:
           type: integer
           description: Total disk space in bytes
-    CollapseResult:
-      type: object
-      description: Per-call statistics from a heap collapse
-      properties:
-        regions:
-          type: integer
-          description: Anonymous read-write regions scanned
-        chunks:
-          type: integer
-          description: 2 MiB chunks attempted
-        collapsed:
-          type: integer
-          description: Chunks whose base pages were actually migrated into a new hugepage
-            (real work)
-        alreadyHuge:
-          type: integer
-          description: Chunks MADV_COLLAPSE accepted but were already hugepages (no
-            work)
-        skipped:
-          type: integer
-          description: Chunks that could not be collapsed (empty or ineligible)
-        elapsedMs:
-          type: integer
-          format: int64
-          description: Wall-clock time spent collapsing, in milliseconds
     ComposeRequest:
       type: object
       required:
@@ -419,22 +425,11 @@ components:
         username:
           type: string
           description: User for setting ownership and resolving relative paths
-    VolumeMount:
-      type: object
-      description: Volume mount configuration
-      additionalProperties: false
-      properties:
-        nfs_target:
-          type: string
-          description: Server target address
-        path:
-          type: string
-          description: Mount path inside the sandbox
-      required:
-      - nfs_target
-      - path
   securitySchemes:
     AccessTokenAuth:
       type: apiKey
       in: header
       name: X-Access-Token
+servers:
+- url: https://sandbox.agentbox-runtime.ru
+  description: AgentBox sandbox proxy. Routing headers are required.
diff --git a/reference/openapi/markdown/assignTemplateTags.md b/reference/openapi/markdown/assignTemplateTags.md
index 6dbc575f..0368007b 100644
--- a/reference/openapi/markdown/assignTemplateTags.md
+++ b/reference/openapi/markdown/assignTemplateTags.md
@@ -38,6 +38,8 @@ Schema: `AssignedTemplateTags`
 
   Identifier of the build associated with these tags
 
+  Format: `uuid`
+
 ### 400
 
 Bad request
@@ -50,6 +52,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +70,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -82,6 +88,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -98,6 +106,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/composeFiles.md b/reference/openapi/markdown/composeFiles.md
index 41ea5efd..d199fb3a 100644
--- a/reference/openapi/markdown/composeFiles.md
+++ b/reference/openapi/markdown/composeFiles.md
@@ -2,6 +2,18 @@
 
 Compose multiple files into a single file using zero-copy concatenation. Source files are deleted after successful composition.
 
+## Parameters
+
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 ## Request body
 
 Required: yes
@@ -44,10 +56,14 @@ Schema: `EntryInfo`
 
   Type of the file
 
+  Allowed values: `file`
+
 - **`metadata`** · `object` · optional
 
   User-defined metadata stored as extended attributes on the file.
 
+- **`metadata.*`** · `string` · additional property
+
 ### 400
 
 Invalid path
diff --git a/reference/openapi/markdown/connectSandbox.md b/reference/openapi/markdown/connectSandbox.md
index b71e7204..59b7e86b 100644
--- a/reference/openapi/markdown/connectSandbox.md
+++ b/reference/openapi/markdown/connectSandbox.md
@@ -20,6 +20,10 @@ Schema: `ConnectSandbox`
 
   Timeout in seconds from the current time after which the sandbox should expire
 
+  Format: `int32`
+
+  Minimum: `0`
+
 ## Responses
 
 ### 200
@@ -46,7 +50,7 @@ Schema: `Sandbox`
 
   Version of the envd running in the sandbox
 
-- **`domain`** · `string` · optional
+- **`domain`** · `string | null` · optional
 
   Base domain where the sandbox traffic is accessible
 
@@ -74,7 +78,7 @@ Schema: `Sandbox`
 
   Version of the envd running in the sandbox
 
-- **`domain`** · `string` · optional
+- **`domain`** · `string | null` · optional
 
   Base domain where the sandbox traffic is accessible
 
@@ -90,6 +94,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -106,6 +112,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -122,6 +130,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -138,6 +148,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/createSandbox.md b/reference/openapi/markdown/createSandbox.md
index ec627b95..0fba81ea 100644
--- a/reference/openapi/markdown/createSandbox.md
+++ b/reference/openapi/markdown/createSandbox.md
@@ -20,18 +20,34 @@ Schema: `NewSandbox`
 
   Time to live for the sandbox in seconds.
 
+  Format: `int32`
+
+  Default: `15`
+
+  Minimum: `0`
+
 - **`autoPause`** · `boolean` · optional
 
   Automatically pauses the sandbox after the timeout
 
+  Default: `false`
+
 - **`autoPauseMemory`** · `boolean` · optional
 
   Controls the snapshot kind taken when the sandbox auto-pauses on timeout (only relevant when autoPause is true). When false, the auto-pause drops the in-memory state and persists only the filesystem (a filesystem-only snapshot); resuming it cold-boots (reboots) the sandbox from disk. Such a snapshot cannot be auto-resumed by traffic and must be resumed explicitly, so it cannot be combined with autoResume. Defaults to true (full memory snapshot).
 
+  Default: `true`
+
 - **`autoResume`** · `SandboxAutoResumeConfig` · optional
 
   Auto-resume configuration for paused sandboxes.
 
+- **`autoResume.enabled`** · `SandboxAutoResumeEnabled` · required
+
+  Auto-resume enabled flag for paused sandboxes. Default false.
+
+  Default: `false`
+
 - **`secure`** · `boolean` · optional
 
   Secure all system communication with sandbox
@@ -42,18 +58,76 @@ Schema: `NewSandbox`
 
 - **`network`** · `SandboxNetworkConfig` · optional
 
+- **`network.allowPublicTraffic`** · `boolean` · optional
+
+  Specify if the sandbox URLs should be accessible only with authentication.
+
+  Default: `true`
+
+- **`network.allowOut`** · `array<string>` · optional
+
+  List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
+
+- **`network.denyOut`** · `array<string>` · optional
+
+  List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.
+
+- **`network.maskRequestHost`** · `string` · optional
+
+  Specify host mask which will be used for all sandbox requests
+
+- **`network.rules`** · `object` · optional
+
+  Per-domain transform rules applied to matching egress HTTP/HTTPS requests. Keys are domains (e.g. "api.example.com", "example.com"). A domain listed here is not automatically allowed - use allowOut to permit the traffic.
+
+- **`network.rules.*`** · `array<SandboxNetworkRule>` · additional property
+
+- **`network.rules.*.transform`** · `SandboxNetworkTransform` · optional
+
+  Transformations applied to matching egress requests before forwarding.
+
+- **`network.rules.*.transform.headers`** · `object` · optional
+
+  HTTP headers to inject or override in matching requests. An existing header with the same name is replaced. Values are plain strings; secret resolution happens client-side before sending to the API.
+
+- **`network.rules.*.transform.headers.*`** · `string` · additional property
+
 - **`metadata`** · `SandboxMetadata` · optional
 
+- **`metadata.*`** · `string` · additional property
+
+  Metadata of the sandbox
+
 - **`envVars`** · `EnvVars` · optional
 
-- **`mcp`** · `Mcp` · optional
+- **`envVars.*`** · `string` · additional property
+
+  Environment variables for the sandbox
+
+- **`mcp`** · `Mcp | null` · optional
 
   MCP configuration for the sandbox
 
+- **`mcp.*`** · `any` · additional property
+
 - **`iam`** · `SandboxIam` · optional
 
   Sandbox workload identity configuration. A non-empty, valid tokens map enables workload identity for the sandbox.
 
+- **`iam.tokens`** · `SandboxIamTokens` · optional
+
+  Named workload-token definitions, keyed by a caller-chosen token name.
+
+- **`iam.tokens.*`** · `SandboxIamToken` · additional property
+
+- **`iam.tokens.*.audience`** · `string` · required
+
+  Audience of the workload token, stored exactly as provided.
+
+- **`iam.tokens.*.tokenType`** · `string` · required
+
+  Workload token type.
+
 ## Responses
 
 ### 201
@@ -80,7 +154,7 @@ Schema: `Sandbox`
 
   Version of the envd running in the sandbox
 
-- **`domain`** · `string` · optional
+- **`domain`** · `string | null` · optional
 
   Base domain where the sandbox traffic is accessible
 
@@ -96,6 +170,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -112,6 +188,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -128,6 +206,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/createSnapshot.md b/reference/openapi/markdown/createSnapshot.md
index 988c1b8f..b41c5841 100644
--- a/reference/openapi/markdown/createSnapshot.md
+++ b/reference/openapi/markdown/createSnapshot.md
@@ -50,6 +50,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +68,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -82,6 +86,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -98,6 +104,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/createTemplate.md b/reference/openapi/markdown/createTemplate.md
index a8c4c5c0..916b99e0 100644
--- a/reference/openapi/markdown/createTemplate.md
+++ b/reference/openapi/markdown/createTemplate.md
@@ -16,6 +16,8 @@ Schema: `TemplateBuildRequestV3`
 
   Name of the template. Can include a tag with colon separator (e.g. "my-template" or "my-template:v1"). If tag is included, it will be treated as if the tag was provided in the tags array.
 
+  Maximum length: `128`
+
 - **`tags`** · `array<string>` · optional
 
   Tags to assign to the template build
@@ -24,10 +26,18 @@ Schema: `TemplateBuildRequestV3`
 
   CPU cores for the sandbox
 
+  Format: `int32`
+
+  Minimum: `1`
+
 - **`memoryMB`** · `MemoryMB` · optional
 
   Memory for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `128`
+
 ## Responses
 
 ### 202
@@ -70,6 +80,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -86,6 +98,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -102,6 +116,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -118,6 +134,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/deleteTemplate.md b/reference/openapi/markdown/deleteTemplate.md
index 8b623956..61f98ffb 100644
--- a/reference/openapi/markdown/deleteTemplate.md
+++ b/reference/openapi/markdown/deleteTemplate.md
@@ -26,6 +26,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -42,6 +44,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/deleteTemplateTags.md b/reference/openapi/markdown/deleteTemplateTags.md
index 4f8cba8b..c412a253 100644
--- a/reference/openapi/markdown/deleteTemplateTags.md
+++ b/reference/openapi/markdown/deleteTemplateTags.md
@@ -38,6 +38,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -54,6 +56,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -70,6 +74,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -86,6 +92,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/downloadFile.md b/reference/openapi/markdown/downloadFile.md
index fb804f78..f38448de 100644
--- a/reference/openapi/markdown/downloadFile.md
+++ b/reference/openapi/markdown/downloadFile.md
@@ -4,6 +4,16 @@ Download a file
 
 ## Parameters
 
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 - **`path`** · `string` · query · optional
 
   Path to the file, URL encoded. Can be relative to the user's home directory (e.g. "file.txt" resolves to ~/file.txt).
@@ -30,6 +40,10 @@ Content-Type: `application/octet-stream`
 
 Schema: `string`
 
+The raw file content
+
+Format: `binary`
+
 ### 400
 
 Invalid path
diff --git a/reference/openapi/markdown/forkSandbox.md b/reference/openapi/markdown/forkSandbox.md
index 930cb006..0ce09a4e 100644
--- a/reference/openapi/markdown/forkSandbox.md
+++ b/reference/openapi/markdown/forkSandbox.md
@@ -20,10 +20,24 @@ Schema: `SandboxForkRequest`
 
   Time to live for the new forked sandboxes in seconds.
 
+  Format: `int32`
+
+  Default: `15`
+
+  Minimum: `0`
+
 - **`count`** · `integer` · optional
 
   Number of forked sandboxes to create. All forks boot from the same snapshot, so the snapshot is captured once regardless of count. Each fork succeeds or fails independently; the outcome of each is reported in its entry of the response list.
 
+  Format: `int32`
+
+  Default: `1`
+
+  Minimum: `1`
+
+  Maximum: `100`
+
 ## Responses
 
 ### 201
@@ -36,8 +50,38 @@ Schema: `array<SandboxForkResult>`
 
 - **`sandbox`** · `Sandbox` · optional
 
+- **`sandbox.templateID`** · `string` · required
+
+  Identifier of the template from which is the sandbox created
+
+- **`sandbox.sandboxID`** · `string` · required
+
+  Identifier of the sandbox
+
+- **`sandbox.alias`** · `string` · optional
+
+  Alias of the template
+
+- **`sandbox.envdVersion`** · `EnvdVersion` · required
+
+  Version of the envd running in the sandbox
+
+- **`sandbox.domain`** · `string | null` · optional
+
+  Base domain where the sandbox traffic is accessible
+
 - **`error`** · `Error` · optional
 
+- **`error.code`** · `integer` · required
+
+  Error code
+
+  Format: `int32`
+
+- **`error.message`** · `string` · required
+
+  Error
+
 ### 409
 
 Conflict
@@ -50,6 +94,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +112,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -82,6 +130,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -98,6 +148,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getEnvironmentHealth.md b/reference/openapi/markdown/getEnvironmentHealth.md
index 6340668e..d2fcc5f2 100644
--- a/reference/openapi/markdown/getEnvironmentHealth.md
+++ b/reference/openapi/markdown/getEnvironmentHealth.md
@@ -2,6 +2,18 @@
 
 Check the health of the service
 
+## Parameters
+
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 ## Responses
 
 ### 204
diff --git a/reference/openapi/markdown/getEnvironmentMetrics.md b/reference/openapi/markdown/getEnvironmentMetrics.md
index 11fdd6c1..7526597a 100644
--- a/reference/openapi/markdown/getEnvironmentMetrics.md
+++ b/reference/openapi/markdown/getEnvironmentMetrics.md
@@ -2,6 +2,18 @@
 
 Service stats
 
+## Parameters
+
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 ## Responses
 
 ### 200
@@ -12,10 +24,14 @@ Content-Type: `application/json`
 
 Schema: `Metrics`
 
+Resource usage metrics
+
 - **`ts`** · `integer` · optional
 
   Unix timestamp in UTC for current sandbox time
 
+  Format: `int64`
+
 - **`cpu_count`** · `integer` · optional
 
   Number of CPU cores
@@ -24,6 +40,8 @@ Schema: `Metrics`
 
   CPU usage percentage
 
+  Format: `float`
+
 - **`mem_total`** · `integer` · optional
 
   Total virtual memory in bytes
diff --git a/reference/openapi/markdown/getEnvironmentVariables.md b/reference/openapi/markdown/getEnvironmentVariables.md
index 41b53968..e5801669 100644
--- a/reference/openapi/markdown/getEnvironmentVariables.md
+++ b/reference/openapi/markdown/getEnvironmentVariables.md
@@ -2,6 +2,18 @@
 
 Environment variables
 
+## Parameters
+
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 ## Responses
 
 ### 200
@@ -11,3 +23,7 @@ Environment variables
 Content-Type: `application/json`
 
 Schema: `EnvVars`
+
+Environment variables to set
+
+- **`*`** · `string` · additional property
diff --git a/reference/openapi/markdown/getSandbox.md b/reference/openapi/markdown/getSandbox.md
index 92440830..ff0b77e0 100644
--- a/reference/openapi/markdown/getSandbox.md
+++ b/reference/openapi/markdown/getSandbox.md
@@ -34,19 +34,23 @@ Schema: `SandboxDetail`
 
   Time when the sandbox was started
 
+  Format: `date-time`
+
 - **`endAt`** · `string` · required
 
   Time when the sandbox will expire
 
+  Format: `date-time`
+
 - **`envdVersion`** · `EnvdVersion` · required
 
   Version of the envd running in the sandbox
 
-- **`allowInternetAccess`** · `boolean` · optional
+- **`allowInternetAccess`** · `boolean | null` · optional
 
   Whether internet access was explicitly enabled or disabled for the sandbox. Null means it was not explicitly set.
 
-- **`domain`** · `string` · optional
+- **`domain`** · `string | null` · optional
 
   Base domain where the sandbox traffic is accessible
 
@@ -54,26 +58,88 @@ Schema: `SandboxDetail`
 
   CPU cores for the sandbox
 
+  Format: `int32`
+
+  Minimum: `1`
+
 - **`memoryMB`** · `MemoryMB` · required
 
   Memory for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `128`
+
 - **`diskSizeMB`** · `DiskSizeMB` · required
 
   Disk size for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `0`
+
 - **`metadata`** · `SandboxMetadata` · optional
 
+- **`metadata.*`** · `string` · additional property
+
+  Metadata of the sandbox
+
 - **`state`** · `SandboxState` · required
 
   State of the sandbox
 
+  Allowed values for `SandboxState`: `running` | `paused`
+
 - **`network`** · `SandboxNetworkConfig` · optional
 
+- **`network.allowPublicTraffic`** · `boolean` · optional
+
+  Specify if the sandbox URLs should be accessible only with authentication.
+
+  Default: `true`
+
+- **`network.allowOut`** · `array<string>` · optional
+
+  List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
+
+- **`network.denyOut`** · `array<string>` · optional
+
+  List of denied CIDR blocks or IP addresses for egress traffic. Domain names are not supported for deny rules.
+
+- **`network.maskRequestHost`** · `string` · optional
+
+  Specify host mask which will be used for all sandbox requests
+
+- **`network.rules`** · `object` · optional
+
+  Per-domain transform rules applied to matching egress HTTP/HTTPS requests. Keys are domains (e.g. "api.example.com", "example.com"). A domain listed here is not automatically allowed - use allowOut to permit the traffic.
+
+- **`network.rules.*`** · `array<SandboxNetworkRule>` · additional property
+
+- **`network.rules.*.transform`** · `SandboxNetworkTransform` · optional
+
+  Transformations applied to matching egress requests before forwarding.
+
+- **`network.rules.*.transform.headers`** · `object` · optional
+
+  HTTP headers to inject or override in matching requests. An existing header with the same name is replaced. Values are plain strings; secret resolution happens client-side before sending to the API.
+
+- **`network.rules.*.transform.headers.*`** · `string` · additional property
+
 - **`lifecycle`** · `SandboxLifecycle` · optional
 
   Sandbox lifecycle policy returned by sandbox info.
 
+- **`lifecycle.autoResume`** · `boolean` · required
+
+  Whether the sandbox can auto-resume.
+
+- **`lifecycle.onTimeout`** · `SandboxOnTimeout` · required
+
+  Action taken when the sandbox times out.
+
+  Allowed values for `SandboxOnTimeout`: `kill` | `pause`
+
 ### 404
 
 Not found
@@ -86,6 +152,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -102,6 +170,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -118,6 +188,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getSandboxLogs.md b/reference/openapi/markdown/getSandboxLogs.md
index b8128fa8..e7977b8b 100644
--- a/reference/openapi/markdown/getSandboxLogs.md
+++ b/reference/openapi/markdown/getSandboxLogs.md
@@ -12,26 +12,46 @@ Get sandbox logs
 
   Opaque continuation cursor returned as nextCursor by the previous page
 
+  Maximum length: `512`
+
 - **`cursor`** · `integer` · query · optional
 
   Starting timestamp of the logs that should be returned in milliseconds
 
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`limit`** · `integer` · query · optional
 
   Maximum number of logs that should be returned
 
+  Format: `int32`
+
+  Default: `1000`
+
+  Minimum: `0`
+
+  Maximum: `1000`
+
 - **`direction`** · `LogsDirection` · query · optional
 
   Direction of the logs that should be returned
 
+  Allowed values for `LogsDirection`: `forward` | `backward`
+
 - **`level`** · `LogLevel` · query · optional
 
   Minimum log level to return. Logs below this level are excluded
 
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
 - **`search`** · `string` · query · optional
 
   Case-sensitive substring match on log message content
 
+  Maximum length: `256`
+
 ## Responses
 
 ### 200
@@ -46,6 +66,32 @@ Schema: `SandboxLogsV2Response`
 
   Sandbox logs structured
 
+  Default: `[]`
+
+- **`logs.id`** · `string` · optional
+
+  Stable identifier used to reconcile overlapping live log pages
+
+- **`logs.timestamp`** · `string` · required
+
+  Timestamp of the log entry
+
+  Format: `date-time`
+
+- **`logs.message`** · `string` · required
+
+  Log message content
+
+- **`logs.level`** · `LogLevel` · required
+
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
+- **`logs.fields`** · `object` · required
+
+- **`logs.fields.*`** · `string` · additional property
+
 - **`nextCursor`** · `string` · optional
 
   Opaque continuation cursor for the next page
@@ -62,6 +108,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -78,6 +126,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -94,6 +144,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getSandboxMetrics.md b/reference/openapi/markdown/getSandboxMetrics.md
index 602a6f1c..bc6e2f95 100644
--- a/reference/openapi/markdown/getSandboxMetrics.md
+++ b/reference/openapi/markdown/getSandboxMetrics.md
@@ -12,8 +12,18 @@ Get sandbox metrics
 
   Unix timestamp for the start of the interval, in seconds, for which the metrics
 
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`end`** · `integer` · query · optional
 
+  Unix timestamp for the end of the interval, in seconds, for which the metrics
+
+  Format: `int64`
+
+  Minimum: `0`
+
 ## Responses
 
 ### 200
@@ -28,34 +38,50 @@ Schema: `array<SandboxMetric>`
 
   Timestamp of the metric entry in Unix time (seconds since epoch)
 
+  Format: `int64`
+
 - **`cpuCount`** · `integer` · required
 
   Number of CPU cores
 
+  Format: `int32`
+
 - **`cpuUsedPct`** · `number` · required
 
   CPU usage percentage
 
+  Format: `float`
+
 - **`memUsed`** · `integer` · required
 
   Memory used in bytes
 
+  Format: `int64`
+
 - **`memTotal`** · `integer` · required
 
   Total memory in bytes
 
+  Format: `int64`
+
 - **`memCache`** · `integer` · required
 
   Cached memory (page cache) in bytes
 
+  Format: `int64`
+
 - **`diskUsed`** · `integer` · required
 
   Disk used in bytes
 
+  Format: `int64`
+
 - **`diskTotal`** · `integer` · required
 
   Total disk space in bytes
 
+  Format: `int64`
+
 ### 400
 
 Bad request
@@ -68,6 +94,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -84,6 +112,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -100,6 +130,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -116,6 +148,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTeamMetrics.md b/reference/openapi/markdown/getTeamMetrics.md
index a18919cc..3043137f 100644
--- a/reference/openapi/markdown/getTeamMetrics.md
+++ b/reference/openapi/markdown/getTeamMetrics.md
@@ -12,8 +12,18 @@ Get metrics for the team
 
   Unix timestamp for the start of the interval, in seconds, for which the metrics
 
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`end`** · `integer` · query · optional
 
+  Unix timestamp for the end of the interval, in seconds, for which the metrics
+
+  Format: `int64`
+
+  Minimum: `0`
+
 ## Responses
 
 ### 200
@@ -28,14 +38,20 @@ Schema: `array<TeamMetric>`
 
   Timestamp of the metric entry in Unix time (seconds since epoch)
 
+  Format: `int64`
+
 - **`concurrentSandboxes`** · `integer` · required
 
   The number of concurrent sandboxes for the team
 
+  Format: `int32`
+
 - **`sandboxStartRate`** · `number` · required
 
   Number of sandboxes started per second
 
+  Format: `float`
+
 ### 400
 
 Bad request
@@ -48,6 +64,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -64,6 +82,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -80,6 +100,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -96,6 +118,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTeamMetricsMax.md b/reference/openapi/markdown/getTeamMetricsMax.md
index cfe44d32..95ff861f 100644
--- a/reference/openapi/markdown/getTeamMetricsMax.md
+++ b/reference/openapi/markdown/getTeamMetricsMax.md
@@ -12,12 +12,24 @@ Get the maximum metrics for the team in the given interval
 
   Unix timestamp for the start of the interval, in seconds, for which the metrics
 
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`end`** · `integer` · query · optional
 
+  Unix timestamp for the end of the interval, in seconds, for which the metrics
+
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`metric`** · `concurrent_sandboxes | sandbox_start_rate` · query · required
 
   Metric to retrieve the maximum value for
 
+  Allowed values: `concurrent_sandboxes` | `sandbox_start_rate`
+
 ## Responses
 
 ### 200
@@ -28,10 +40,14 @@ Content-Type: `application/json`
 
 Schema: `MaxTeamMetric`
 
+Team metric with timestamp
+
 - **`timestampUnix`** · `integer` · required
 
   Timestamp of the metric entry in Unix time (seconds since epoch)
 
+  Format: `int64`
+
 - **`value`** · `number` · required
 
   The maximum value of the requested metric in the given interval
@@ -48,6 +64,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -64,6 +82,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -80,6 +100,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -96,6 +118,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTemplate.md b/reference/openapi/markdown/getTemplate.md
index 9cc53b83..bb3ecbbc 100644
--- a/reference/openapi/markdown/getTemplate.md
+++ b/reference/openapi/markdown/getTemplate.md
@@ -16,12 +16,26 @@ List all builds for a template
 
   Maximum number of items to return per page
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `1`
+
+  Maximum: `100`
+
 ## Responses
 
 ### 200
 
 Successfully returned the template with its builds
 
+#### Response headers
+
+- **`X-Next-Token`** · `string` · response header
+
+  Cursor to fetch the next page of results, if more exist
+
 Content-Type: `application/json`
 
 Schema: `TemplateWithBuilds`
@@ -42,22 +56,88 @@ Schema: `TemplateWithBuilds`
 
   Time when the template was created
 
+  Format: `date-time`
+
 - **`updatedAt`** · `string` · required
 
   Time when the template was last updated
 
-- **`lastSpawnedAt`** · `string` · required
+  Format: `date-time`
+
+- **`lastSpawnedAt`** · `string | null` · required
 
   Time when the template was last used
 
+  Format: `date-time`
+
 - **`spawnCount`** · `integer` · required
 
   Number of times the template was used
 
+  Format: `int64`
+
 - **`builds`** · `array<TemplateBuild>` · required
 
   List of builds for the template
 
+- **`builds.buildID`** · `string` · required
+
+  Identifier of the build
+
+  Format: `uuid`
+
+- **`builds.status`** · `TemplateBuildStatus` · required
+
+  Status of the template build
+
+  Allowed values for `TemplateBuildStatus`: `building` | `waiting` | `ready` | `error`
+
+- **`builds.createdAt`** · `string` · required
+
+  Time when the build was created
+
+  Format: `date-time`
+
+- **`builds.updatedAt`** · `string` · required
+
+  Time when the build was last updated
+
+  Format: `date-time`
+
+- **`builds.finishedAt`** · `string` · optional
+
+  Time when the build was finished
+
+  Format: `date-time`
+
+- **`builds.cpuCount`** · `CPUCount` · required
+
+  CPU cores for the sandbox
+
+  Format: `int32`
+
+  Minimum: `1`
+
+- **`builds.memoryMB`** · `MemoryMB` · required
+
+  Memory for the sandbox in MiB
+
+  Format: `int32`
+
+  Minimum: `128`
+
+- **`builds.diskSizeMB`** · `DiskSizeMB` · optional
+
+  Disk size for the sandbox in MiB
+
+  Format: `int32`
+
+  Minimum: `0`
+
+- **`builds.envdVersion`** · `EnvdVersion` · optional
+
+  Version of the envd running in the sandbox
+
 ### 401
 
 Authentication error
@@ -70,6 +150,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -86,6 +168,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTemplateBuildLogs.md b/reference/openapi/markdown/getTemplateBuildLogs.md
index c2e07605..3e025be7 100644
--- a/reference/openapi/markdown/getTemplateBuildLogs.md
+++ b/reference/openapi/markdown/getTemplateBuildLogs.md
@@ -14,22 +14,46 @@ Get template build logs
 
   Opaque continuation cursor returned as nextCursor by the previous page
 
+  Maximum length: `512`
+
 - **`cursor`** · `integer` · query · optional
 
   Starting timestamp of the logs that should be returned in milliseconds
 
+  Format: `int64`
+
+  Minimum: `0`
+
 - **`limit`** · `integer` · query · optional
 
   Maximum number of logs that should be returned
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `0`
+
+  Maximum: `100`
+
 - **`direction`** · `LogsDirection` · query · optional
 
+  Direction of the logs that should be returned
+
+  Allowed values for `LogsDirection`: `forward` | `backward`
+
 - **`level`** · `LogLevel` · query · optional
 
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
 - **`source`** · `LogsSource` · query · optional
 
   Source of the logs that should be returned from
 
+  Allowed values for `LogsSource`: `temporary` | `persistent`
+
 ## Responses
 
 ### 200
@@ -44,13 +68,41 @@ Schema: `TemplateBuildLogsResponse`
 
   Build logs structured
 
+  Default: `[]`
+
+- **`logs.id`** · `string` · optional
+
+  Stable identifier used to reconcile overlapping live log pages
+
+- **`logs.timestamp`** · `string` · required
+
+  Timestamp of the log entry
+
+  Format: `date-time`
+
+- **`logs.message`** · `string` · required
+
+  Log message content
+
+- **`logs.level`** · `LogLevel` · required
+
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
+- **`logs.step`** · `string` · optional
+
+  Step in the build process related to the log entry
+
 - **`nextCursor`** · `string` · optional
 
   Opaque continuation cursor for the next page
 
 - **`source`** · `LogsSource` · optional
 
-  Source of the logs that should be returned
+  Actual source used to serve this page
+
+  Allowed values for `LogsSource`: `temporary` | `persistent`
 
 ### 401
 
@@ -64,6 +116,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -80,6 +134,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -96,6 +152,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTemplateBuildStatus.md b/reference/openapi/markdown/getTemplateBuildStatus.md
index e435cbd8..d2dea04d 100644
--- a/reference/openapi/markdown/getTemplateBuildStatus.md
+++ b/reference/openapi/markdown/getTemplateBuildStatus.md
@@ -14,12 +14,30 @@ Get template build info
 
   Index of the starting build log that should be returned with the template
 
+  Format: `int32`
+
+  Default: `0`
+
+  Minimum: `0`
+
 - **`limit`** · `integer` · query · optional
 
   Maximum number of logs that should be returned
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `0`
+
+  Maximum: `100`
+
 - **`level`** · `LogLevel` · query · optional
 
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
 ## Responses
 
 ### 200
@@ -34,10 +52,38 @@ Schema: `TemplateBuildInfo`
 
   Build logs
 
+  Default: `[]`
+
 - **`logEntries`** · `array<BuildLogEntry>` · required
 
   Build logs structured
 
+  Default: `[]`
+
+- **`logEntries.id`** · `string` · optional
+
+  Stable identifier used to reconcile overlapping live log pages
+
+- **`logEntries.timestamp`** · `string` · required
+
+  Timestamp of the log entry
+
+  Format: `date-time`
+
+- **`logEntries.message`** · `string` · required
+
+  Log message content
+
+- **`logEntries.level`** · `LogLevel` · required
+
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
+- **`logEntries.step`** · `string` · optional
+
+  Step in the build process related to the log entry
+
 - **`templateID`** · `string` · required
 
   Identifier of the template
@@ -50,8 +96,48 @@ Schema: `TemplateBuildInfo`
 
   Status of the template build
 
+  Allowed values for `TemplateBuildStatus`: `building` | `waiting` | `ready` | `error`
+
 - **`reason`** · `BuildStatusReason` · optional
 
+- **`reason.message`** · `string` · required
+
+  Message with the status reason, currently reporting only for error status
+
+- **`reason.step`** · `string` · optional
+
+  Step that failed
+
+- **`reason.logEntries`** · `array<BuildLogEntry>` · optional
+
+  Log entries related to the status reason
+
+  Default: `[]`
+
+- **`reason.logEntries.id`** · `string` · optional
+
+  Stable identifier used to reconcile overlapping live log pages
+
+- **`reason.logEntries.timestamp`** · `string` · required
+
+  Timestamp of the log entry
+
+  Format: `date-time`
+
+- **`reason.logEntries.message`** · `string` · required
+
+  Log message content
+
+- **`reason.logEntries.level`** · `LogLevel` · required
+
+  State of the sandbox
+
+  Allowed values for `LogLevel`: `debug` | `info` | `warn` | `error`
+
+- **`reason.logEntries.step`** · `string` · optional
+
+  Step in the build process related to the log entry
+
 ### 401
 
 Authentication error
@@ -64,6 +150,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -80,6 +168,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -96,6 +186,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTemplateByAlias.md b/reference/openapi/markdown/getTemplateByAlias.md
index 1999b7bf..4ccff115 100644
--- a/reference/openapi/markdown/getTemplateByAlias.md
+++ b/reference/openapi/markdown/getTemplateByAlias.md
@@ -8,6 +8,8 @@ Check if template with given alias exists
 
 - **`alias`** · `string` · path · required
 
+  Template alias
+
 ## Responses
 
 ### 200
@@ -38,6 +40,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -54,6 +58,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -70,6 +76,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -86,6 +94,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/getTemplateUploadUrl.md b/reference/openapi/markdown/getTemplateUploadUrl.md
index 84cb6f66..ea3221ab 100644
--- a/reference/openapi/markdown/getTemplateUploadUrl.md
+++ b/reference/openapi/markdown/getTemplateUploadUrl.md
@@ -10,6 +10,8 @@ Get an upload link for a tar file containing build layer files
 
 - **`hash`** · `string` · path · required
 
+  Hash of the files
+
 ## Responses
 
 ### 201
@@ -40,6 +42,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -56,6 +60,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -72,6 +78,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -88,6 +96,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/killSandbox.md b/reference/openapi/markdown/killSandbox.md
index 01401f83..73abee4d 100644
--- a/reference/openapi/markdown/killSandbox.md
+++ b/reference/openapi/markdown/killSandbox.md
@@ -26,6 +26,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -42,6 +44,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -58,6 +62,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/listSandboxMetrics.md b/reference/openapi/markdown/listSandboxMetrics.md
index 50bb1609..f57b34cf 100644
--- a/reference/openapi/markdown/listSandboxMetrics.md
+++ b/reference/openapi/markdown/listSandboxMetrics.md
@@ -10,6 +10,12 @@ List metrics for given sandboxes
 
   Comma-separated list of sandbox IDs to get metrics for
 
+  Maximum items: `100`
+
+  Unique items: `yes`
+
+  Serialization: style `form`; explode `false`; wire format `sandbox_ids=value1,value2`
+
 ## Responses
 
 ### 200
@@ -22,6 +28,58 @@ Schema: `SandboxesWithMetrics`
 
 - **`sandboxes`** · `object` · required
 
+- **`sandboxes.*`** · `SandboxMetric` · additional property
+
+  Metric entry with timestamp and line
+
+- **`sandboxes.*.timestampUnix`** · `integer` · required
+
+  Timestamp of the metric entry in Unix time (seconds since epoch)
+
+  Format: `int64`
+
+- **`sandboxes.*.cpuCount`** · `integer` · required
+
+  Number of CPU cores
+
+  Format: `int32`
+
+- **`sandboxes.*.cpuUsedPct`** · `number` · required
+
+  CPU usage percentage
+
+  Format: `float`
+
+- **`sandboxes.*.memUsed`** · `integer` · required
+
+  Memory used in bytes
+
+  Format: `int64`
+
+- **`sandboxes.*.memTotal`** · `integer` · required
+
+  Total memory in bytes
+
+  Format: `int64`
+
+- **`sandboxes.*.memCache`** · `integer` · required
+
+  Cached memory (page cache) in bytes
+
+  Format: `int64`
+
+- **`sandboxes.*.diskUsed`** · `integer` · required
+
+  Disk used in bytes
+
+  Format: `int64`
+
+- **`sandboxes.*.diskTotal`** · `integer` · required
+
+  Total disk space in bytes
+
+  Format: `int64`
+
 ### 401
 
 Authentication error
@@ -34,6 +92,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -50,6 +110,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +128,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/listSandboxes.md b/reference/openapi/markdown/listSandboxes.md
index 31b7ee59..89f411db 100644
--- a/reference/openapi/markdown/listSandboxes.md
+++ b/reference/openapi/markdown/listSandboxes.md
@@ -14,6 +14,10 @@ List all sandboxes
 
   Filter sandboxes by one or more states
 
+  Allowed values for `SandboxState`: `running` | `paused`
+
+  Serialization: style `form`; explode `false`; wire format `state=value1,value2`
+
 - **`nextToken`** · `string` · query · optional
 
   Cursor to start the list from
@@ -22,12 +26,32 @@ List all sandboxes
 
   Maximum number of items to return per page
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `1`
+
+  Maximum: `100`
+
 ## Responses
 
 ### 200
 
 Successfully returned all running sandboxes
 
+#### Response headers
+
+- **`X-Next-Token`** · `string` · response header
+
+  Cursor to fetch the next page of results, if more exist
+
+- **`X-Total-Running`** · `integer` · response header
+
+  Number of running sandboxes matching the filters, before pagination is applied. Only present when running sandboxes were requested.
+
+  Format: `int32`
+
 Content-Type: `application/json`
 
 Schema: `array<ListedSandbox>`
@@ -48,28 +72,50 @@ Schema: `array<ListedSandbox>`
 
   Time when the sandbox was started
 
+  Format: `date-time`
+
 - **`endAt`** · `string` · required
 
   Time when the sandbox will expire
 
+  Format: `date-time`
+
 - **`cpuCount`** · `CPUCount` · required
 
   CPU cores for the sandbox
 
+  Format: `int32`
+
+  Minimum: `1`
+
 - **`memoryMB`** · `MemoryMB` · required
 
   Memory for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `128`
+
 - **`diskSizeMB`** · `DiskSizeMB` · required
 
   Disk size for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `0`
+
 - **`metadata`** · `SandboxMetadata` · optional
 
+- **`metadata.*`** · `string` · additional property
+
+  Metadata of the sandbox
+
 - **`state`** · `SandboxState` · required
 
   State of the sandbox
 
+  Allowed values for `SandboxState`: `running` | `paused`
+
 - **`envdVersion`** · `EnvdVersion` · required
 
   Version of the envd running in the sandbox
@@ -86,6 +132,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -102,6 +150,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -118,6 +168,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/listSnapshots.md b/reference/openapi/markdown/listSnapshots.md
index 5fddbcf0..c1756101 100644
--- a/reference/openapi/markdown/listSnapshots.md
+++ b/reference/openapi/markdown/listSnapshots.md
@@ -8,6 +8,8 @@ List all snapshots for the team
 
 - **`sandboxID`** · `string` · query · optional
 
+  Filter snapshots by source sandbox ID
+
 - **`name`** · `string` · query · optional
 
   Filter snapshots by name or ID, optionally tag-qualified (e.g. "my-snapshot", "my-team/my-snapshot" or "my-snapshot:v1").
@@ -16,6 +18,14 @@ List all snapshots for the team
 
   Maximum number of items to return per page
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `1`
+
+  Maximum: `100`
+
 - **`nextToken`** · `string` · query · optional
 
   Cursor to start the list from
@@ -26,6 +36,12 @@ List all snapshots for the team
 
 Successfully returned snapshots
 
+#### Response headers
+
+- **`X-Next-Token`** · `string` · response header
+
+  Cursor to fetch the next page of results, if more exist
+
 Content-Type: `application/json`
 
 Schema: `array<SnapshotInfo>`
@@ -50,6 +66,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +84,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/listTemplateTags.md b/reference/openapi/markdown/listTemplateTags.md
index c4440abb..3ad49f58 100644
--- a/reference/openapi/markdown/listTemplateTags.md
+++ b/reference/openapi/markdown/listTemplateTags.md
@@ -26,10 +26,14 @@ Schema: `array<TemplateTag>`
 
   Identifier of the build associated with this tag
 
+  Format: `uuid`
+
 - **`createdAt`** · `string` · required
 
   Time when the tag was assigned
 
+  Format: `date-time`
+
 ### 401
 
 Authentication error
@@ -42,6 +46,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -58,6 +64,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -74,6 +82,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -90,6 +100,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/listTemplates.md b/reference/openapi/markdown/listTemplates.md
index cfa70e70..99a08983 100644
--- a/reference/openapi/markdown/listTemplates.md
+++ b/reference/openapi/markdown/listTemplates.md
@@ -8,6 +8,8 @@ List all templates
 
 - **`teamID`** · `string` · query · optional
 
+  Identifier of the team
+
 - **`nextToken`** · `string` · query · optional
 
   Cursor to start the list from
@@ -16,12 +18,26 @@ List all templates
 
   Maximum number of items to return per page
 
+  Format: `int32`
+
+  Default: `100`
+
+  Minimum: `1`
+
+  Maximum: `100`
+
 ## Responses
 
 ### 200
 
 Successfully returned all templates
 
+#### Response headers
+
+- **`X-Next-Token`** · `string` · response header
+
+  Cursor to fetch the next page of results, if more exist
+
 Content-Type: `application/json`
 
 Schema: `array<Template>`
@@ -38,14 +54,26 @@ Schema: `array<Template>`
 
   CPU cores for the sandbox
 
+  Format: `int32`
+
+  Minimum: `1`
+
 - **`memoryMB`** · `MemoryMB` · required
 
   Memory for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `128`
+
 - **`diskSizeMB`** · `DiskSizeMB` · required
 
   Disk size for the sandbox in MiB
 
+  Format: `int32`
+
+  Minimum: `0`
+
 - **`public`** · `boolean` · required
 
   Whether the template is public or only accessible by the team
@@ -58,24 +86,40 @@ Schema: `array<Template>`
 
   Time when the template was created
 
+  Format: `date-time`
+
 - **`updatedAt`** · `string` · required
 
   Time when the template was last updated
 
-- **`createdBy`** · `object` · required
+  Format: `date-time`
+
+- **`createdBy`** · `TeamUser | null` · required
+
+- **`createdBy.id`** · `string` · required
+
+  Identifier of the user
 
-- **`lastSpawnedAt`** · `string` · required
+  Format: `uuid`
+
+- **`lastSpawnedAt`** · `string | null` · required
 
   Time when the template was last used
 
+  Format: `date-time`
+
 - **`spawnCount`** · `integer` · required
 
   Number of times the template was used
 
+  Format: `int64`
+
 - **`buildCount`** · `integer` · required
 
   Number of times the template was built
 
+  Format: `int32`
+
 - **`envdVersion`** · `EnvdVersion` · required
 
   Version of the envd running in the sandbox
@@ -84,6 +128,8 @@ Schema: `array<Template>`
 
   Status of the template build
 
+  Allowed values for `TemplateBuildStatus`: `building` | `waiting` | `ready` | `error`
+
 ### 400
 
 Bad request
@@ -96,6 +142,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -112,6 +160,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -128,6 +178,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -144,6 +196,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/pauseSandbox.md b/reference/openapi/markdown/pauseSandbox.md
index 578d79f7..035dc0b5 100644
--- a/reference/openapi/markdown/pauseSandbox.md
+++ b/reference/openapi/markdown/pauseSandbox.md
@@ -20,6 +20,8 @@ Schema: `SandboxPauseRequest`
 
   Whether to capture a full memory snapshot. When false, only the filesystem is persisted and resuming the sandbox cold-boots (reboots) it from disk, losing in-memory state, running processes, and open connections. Resume it with an explicit request (connect or resume); auto-resume, which can be triggered by arbitrary traffic, refuses such a sandbox. Defaults to true.
 
+  Default: `true`
+
 ## Responses
 
 ### 204
@@ -38,6 +40,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -54,6 +58,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -70,6 +76,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -86,6 +94,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/refreshSandbox.md b/reference/openapi/markdown/refreshSandbox.md
index 2f6da8b5..0e761e0c 100644
--- a/reference/openapi/markdown/refreshSandbox.md
+++ b/reference/openapi/markdown/refreshSandbox.md
@@ -20,6 +20,10 @@ Schema: `SandboxRefreshRequest`
 
   Duration for which the sandbox should be kept alive in seconds
 
+  Minimum: `0`
+
+  Maximum: `3600`
+
 ## Responses
 
 ### 204
@@ -38,6 +42,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -54,6 +60,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/setSandboxTimeout.md b/reference/openapi/markdown/setSandboxTimeout.md
index a2d23020..e7eafcd9 100644
--- a/reference/openapi/markdown/setSandboxTimeout.md
+++ b/reference/openapi/markdown/setSandboxTimeout.md
@@ -20,6 +20,10 @@ Schema: `SandboxTimeoutRequest`
 
   Timeout in seconds from the current time after which the sandbox should expire
 
+  Format: `int32`
+
+  Minimum: `0`
+
 ## Responses
 
 ### 204
@@ -38,6 +42,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -54,6 +60,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -70,6 +78,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/startTemplateBuild.md b/reference/openapi/markdown/startTemplateBuild.md
index 2249f043..4d3ddd03 100644
--- a/reference/openapi/markdown/startTemplateBuild.md
+++ b/reference/openapi/markdown/startTemplateBuild.md
@@ -28,14 +28,86 @@ Schema: `TemplateBuildStartV2`
 
 - **`fromImageRegistry`** · `FromImageRegistry` · optional
 
+- **Variant `AWSRegistry`** · discriminator `type` = `aws`
+
+- **`fromImageRegistry<AWSRegistry>.type`** · `aws` · required
+
+  Type of registry authentication
+
+  Allowed values: `aws`
+
+- **`fromImageRegistry<AWSRegistry>.awsAccessKeyId`** · `string` · required
+
+  AWS Access Key ID for ECR authentication
+
+- **`fromImageRegistry<AWSRegistry>.awsSecretAccessKey`** · `string` · required
+
+  AWS Secret Access Key for ECR authentication
+
+- **`fromImageRegistry<AWSRegistry>.awsRegion`** · `string` · required
+
+  AWS Region where the ECR registry is located
+
+- **Variant `GCPRegistry`** · discriminator `type` = `gcp`
+
+- **`fromImageRegistry<GCPRegistry>.type`** · `gcp` · required
+
+  Type of registry authentication
+
+  Allowed values: `gcp`
+
+- **`fromImageRegistry<GCPRegistry>.serviceAccountJson`** · `string` · required
+
+  Service Account JSON for GCP authentication
+
+- **Variant `GeneralRegistry`** · discriminator `type` = `registry`
+
+- **`fromImageRegistry<GeneralRegistry>.type`** · `registry` · required
+
+  Type of registry authentication
+
+  Allowed values: `registry`
+
+- **`fromImageRegistry<GeneralRegistry>.username`** · `string` · required
+
+  Username to use for the registry
+
+- **`fromImageRegistry<GeneralRegistry>.password`** · `string` · required
+
+  Password to use for the registry
+
 - **`force`** · `boolean` · optional
 
   Whether the whole build should be forced to run regardless of the cache
 
+  Default: `false`
+
 - **`steps`** · `array<TemplateStep>` · optional
 
   List of steps to execute in the template build
 
+  Default: `[]`
+
+- **`steps.type`** · `string` · required
+
+  Type of the step
+
+- **`steps.args`** · `array<string>` · optional
+
+  Arguments for the step
+
+  Default: `[]`
+
+- **`steps.filesHash`** · `string` · optional
+
+  Hash of the files used in the step
+
+- **`steps.force`** · `boolean` · optional
+
+  Whether the step should be forced to run regardless of the cache
+
+  Default: `false`
+
 - **`startCmd`** · `string` · optional
 
   Start command to execute in the template after the build
@@ -62,6 +134,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -78,6 +152,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/updateSandboxNetwork.md b/reference/openapi/markdown/updateSandboxNetwork.md
index 08e2281c..ea73abf4 100644
--- a/reference/openapi/markdown/updateSandboxNetwork.md
+++ b/reference/openapi/markdown/updateSandboxNetwork.md
@@ -16,6 +16,8 @@ Required: yes
 
 Schema: `SandboxNetworkUpdateConfig`
 
+Network configuration update for a running sandbox. Replaces the current egress rules with the provided configuration. Omitting a field clears it.
+
 - **`allowOut`** · `array<string>` · optional
 
   List of allowed destinations for egress traffic. Each entry can be a CIDR block (e.g. "8.8.8.8/32"), a bare IP address (e.g. "8.8.8.8"), or a domain name (e.g. "example.com", "*.example.com"). Allowed entries always take precedence over denied entries.
@@ -28,6 +30,18 @@ Schema: `SandboxNetworkUpdateConfig`
 
   Per-domain transform rules. Replaces all existing rules when provided.
 
+- **`rules.*`** · `array<SandboxNetworkRule>` · additional property
+
+- **`rules.*.transform`** · `SandboxNetworkTransform` · optional
+
+  Transformations applied to matching egress requests before forwarding.
+
+- **`rules.*.transform.headers`** · `object` · optional
+
+  HTTP headers to inject or override in matching requests. An existing header with the same name is replaced. Values are plain strings; secret resolution happens client-side before sending to the API.
+
+- **`rules.*.transform.headers.*`** · `string` · additional property
+
 - **`allow_internet_access`** · `boolean` · optional
 
   Allow sandbox to access the internet. When set to false, it behaves the same as specifying denyOut to 0.0.0.0/0 in the network config.
@@ -50,6 +64,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -66,6 +82,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -82,6 +100,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -98,6 +118,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/updateTemplate.md b/reference/openapi/markdown/updateTemplate.md
index 07803972..c52fac98 100644
--- a/reference/openapi/markdown/updateTemplate.md
+++ b/reference/openapi/markdown/updateTemplate.md
@@ -46,6 +46,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -62,6 +64,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
@@ -78,6 +82,8 @@ Schema: `Error`
 
   Error code
 
+  Format: `int32`
+
 - **`message`** · `string` · required
 
   Error
diff --git a/reference/openapi/markdown/uploadFile.md b/reference/openapi/markdown/uploadFile.md
index b186adec..1854f9d6 100644
--- a/reference/openapi/markdown/uploadFile.md
+++ b/reference/openapi/markdown/uploadFile.md
@@ -25,6 +25,16 @@ value is used.
 
 ## Parameters
 
+- **`Agentbox-Sandbox-Id`** · `string` · header · required
+
+  Identifier of the sandbox that receives the request.
+
+- **`Agentbox-Sandbox-Port`** · `integer` · header · required
+
+  Internal envd HTTP port exposed through the sandbox proxy.
+
+  Default: `49983`
+
 - **`path`** · `string` · query · optional
 
   Path to the file, URL encoded. Can be relative to the user's home directory (e.g. "file.txt" resolves to ~/file.txt).
@@ -51,10 +61,16 @@ Schema: `object`
 
 - **`file`** · `string` · optional
 
+  Format: `binary`
+
 ### application/octet-stream
 
 Schema: `string`
 
+Raw file content. The 'path' query parameter is required when using this content type.
+
+Format: `binary`
+
 ## Responses
 
 ### 200
@@ -77,10 +93,14 @@ Schema: `array<EntryInfo>`
 
   Type of the file
 
+  Allowed values: `file`
+
 - **`metadata`** · `object` · optional
 
   User-defined metadata stored as extended attributes on the file.
 
+- **`metadata.*`** · `string` · additional property
+
 ### 400
 
 Invalid path
diff --git a/reference/sdk/javascript/code-interpreter/classes/Sandbox.md b/reference/sdk/javascript/code-interpreter/classes/Sandbox.md
index 473d1f87..275ee94e 100644
--- a/reference/sdk/javascript/code-interpreter/classes/Sandbox.md
+++ b/reference/sdk/javascript/code-interpreter/classes/Sandbox.md
@@ -41,36 +41,6 @@ Module for running commands in the sandbox
 
 ***
 
-### connectionConfig
-
-> `protected` `readonly` **connectionConfig**: `ConnectionConfig`
-
-#### Inherited from
-
-`BaseSandbox.connectionConfig`
-
-***
-
-### envdAccessToken?
-
-> `protected` `readonly` `optional` **envdAccessToken?**: `string`
-
-#### Inherited from
-
-`BaseSandbox.envdAccessToken`
-
-***
-
-### envdPort
-
-> `protected` `readonly` **envdPort**: `49983` = `49983`
-
-#### Inherited from
-
-`BaseSandbox.envdPort`
-
-***
-
 ### files
 
 > `readonly` **files**: `Filesystem`
@@ -83,16 +53,6 @@ Module for interacting with the sandbox filesystem
 
 ***
 
-### mcpPort
-
-> `protected` `readonly` **mcpPort**: `50005` = `50005`
-
-#### Inherited from
-
-`BaseSandbox.mcpPort`
-
-***
-
 ### pty
 
 > `readonly` **pty**: `Pty`
@@ -139,48 +99,6 @@ Traffic access token for accessing sandbox services with restricted public traff
 
 `BaseSandbox.trafficAccessToken`
 
-***
-
-### defaultMcpTemplate
-
-> `protected` `readonly` `static` **defaultMcpTemplate**: `string` = `'mcp-gateway'`
-
-#### Inherited from
-
-`BaseSandbox.defaultMcpTemplate`
-
-***
-
-### defaultSandboxTimeoutMs
-
-> `protected` `readonly` `static` **defaultSandboxTimeoutMs**: `300000` = `DEFAULT_SANDBOX_TIMEOUT_MS`
-
-#### Inherited from
-
-`BaseSandbox.defaultSandboxTimeoutMs`
-
-***
-
-### defaultTemplate
-
-> `protected` `readonly` `static` **defaultTemplate**: `string` = `'code-interpreter-v1'`
-
-#### Overrides
-
-`BaseSandbox.defaultTemplate`
-
-## Accessors
-
-### jupyterUrl
-
-#### Get Signature
-
-> **get** `protected` **jupyterUrl**(): `string`
-
-##### Returns
-
-`string`
-
 ## Methods
 
 ### connect()
@@ -898,30 +816,6 @@ const sameSandbox = await Sandbox.connect(sandboxId)
 
 ***
 
-### connectSandbox()
-
-> `protected` `static` **connectSandbox**(`sandboxId`, `opts?`): `Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Parameters
-
-##### sandboxId
-
-`string`
-
-##### opts?
-
-`SandboxConnectOpts`
-
-#### Returns
-
-`Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Inherited from
-
-`BaseSandbox.connectSandbox`
-
-***
-
 ### create()
 
 #### Call Signature
@@ -1020,34 +914,6 @@ Sandbox
 
 ***
 
-### createSandbox()
-
-> `protected` `static` **createSandbox**(`template`, `timeoutMs`, `opts?`): `Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Parameters
-
-##### template
-
-`string`
-
-##### timeoutMs
-
-`number`
-
-##### opts?
-
-`SandboxOpts`
-
-#### Returns
-
-`Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Inherited from
-
-`BaseSandbox.createSandbox`
-
-***
-
 ### createSnapshot()
 
 > `static` **createSnapshot**(`sandboxId`, `opts?`): `Promise`\<`SnapshotInfo`\>
@@ -1180,38 +1046,6 @@ if (fork1 instanceof Sandbox) {
 
 ***
 
-### forkSandbox()
-
-> `protected` `static` **forkSandbox**(`sandboxId`, `timeoutMs`, `count`, `opts?`): `Promise`\<`SandboxForkResponse`[]\>
-
-#### Parameters
-
-##### sandboxId
-
-`string`
-
-##### timeoutMs
-
-`number`
-
-##### count
-
-`number`
-
-##### opts?
-
-`SandboxApiOpts`
-
-#### Returns
-
-`Promise`\<`SandboxForkResponse`[]\>
-
-#### Inherited from
-
-`BaseSandbox.forkSandbox`
-
-***
-
 ### getInfo()
 
 > `static` **getInfo**(`sandboxId`, `opts?`): `Promise`\<`SandboxInfo`\>
diff --git a/reference/sdk/javascript/commands/interfaces/Commands.md b/reference/sdk/javascript/commands/interfaces/Commands.md
index 2a968c97..84802044 100644
--- a/reference/sdk/javascript/commands/interfaces/Commands.md
+++ b/reference/sdk/javascript/commands/interfaces/Commands.md
@@ -4,12 +4,6 @@
 
 Module for starting and interacting with commands in the sandbox.
 
-## Properties
-
-### rpc
-
-> `protected` `readonly` **rpc**: `Client`\<*typeof* `ProcessService`\>
-
 ## Methods
 
 ### closeStdin()
diff --git a/reference/sdk/javascript/sandbox/classes/Sandbox.md b/reference/sdk/javascript/sandbox/classes/Sandbox.md
index cb9c40fe..0d319a19 100644
--- a/reference/sdk/javascript/sandbox/classes/Sandbox.md
+++ b/reference/sdk/javascript/sandbox/classes/Sandbox.md
@@ -37,24 +37,6 @@ Module for running commands in the sandbox
 
 ***
 
-### connectionConfig
-
-> `protected` `readonly` **connectionConfig**: `ConnectionConfig`
-
-***
-
-### envdAccessToken?
-
-> `protected` `readonly` `optional` **envdAccessToken?**: `string`
-
-***
-
-### envdPort
-
-> `protected` `readonly` **envdPort**: `49983` = `49983`
-
-***
-
 ### files
 
 > `readonly` **files**: `Filesystem`
@@ -63,12 +45,6 @@ Module for interacting with the sandbox filesystem
 
 ***
 
-### mcpPort
-
-> `protected` `readonly` **mcpPort**: `50005` = `50005`
-
-***
-
 ### pty
 
 > `readonly` **pty**: `Pty`
@@ -99,24 +75,6 @@ Unique identifier of the sandbox.
 
 Traffic access token for accessing sandbox services with restricted public traffic.
 
-***
-
-### defaultMcpTemplate
-
-> `protected` `readonly` `static` **defaultMcpTemplate**: `string` = `'mcp-gateway'`
-
-***
-
-### defaultSandboxTimeoutMs
-
-> `protected` `readonly` `static` **defaultSandboxTimeoutMs**: `300000` = `DEFAULT_SANDBOX_TIMEOUT_MS`
-
-***
-
-### defaultTemplate
-
-> `protected` `readonly` `static` **defaultTemplate**: `string` = `'base'`
-
 ## Methods
 
 ### connect()
@@ -621,30 +579,6 @@ const sameSandbox = await Sandbox.connect(sandboxId)
 
 ***
 
-### connectSandbox()
-
-> `protected` `static` **connectSandbox**(`sandboxId`, `opts?`): `Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Parameters
-
-##### sandboxId
-
-`string`
-
-##### opts?
-
-[`SandboxConnectOpts`](../type-aliases/SandboxConnectOpts.md)
-
-#### Returns
-
-`Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Inherited from
-
-`SandboxApi.connectSandbox`
-
-***
-
 ### create()
 
 #### Call Signature
@@ -735,34 +669,6 @@ Sandbox
 
 ***
 
-### createSandbox()
-
-> `protected` `static` **createSandbox**(`template`, `timeoutMs`, `opts?`): `Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Parameters
-
-##### template
-
-`string`
-
-##### timeoutMs
-
-`number`
-
-##### opts?
-
-[`SandboxOpts`](../interfaces/SandboxOpts.md)
-
-#### Returns
-
-`Promise`\<\{ `envdAccessToken`: `string` \| `undefined`; `envdVersion`: `string`; `sandboxDomain`: `string` \| `undefined`; `sandboxId`: `string`; `trafficAccessToken`: `string` \| `undefined`; \}\>
-
-#### Inherited from
-
-`SandboxApi.createSandbox`
-
-***
-
 ### createSnapshot()
 
 > `static` **createSnapshot**(`sandboxId`, `opts?`): `Promise`\<[`SnapshotInfo`](../interfaces/SnapshotInfo.md)\>
@@ -891,38 +797,6 @@ if (fork1 instanceof Sandbox) {
 
 ***
 
-### forkSandbox()
-
-> `protected` `static` **forkSandbox**(`sandboxId`, `timeoutMs`, `count`, `opts?`): `Promise`\<`SandboxForkResponse`[]\>
-
-#### Parameters
-
-##### sandboxId
-
-`string`
-
-##### timeoutMs
-
-`number`
-
-##### count
-
-`number`
-
-##### opts?
-
-[`SandboxApiOpts`](../interfaces/SandboxApiOpts.md)
-
-#### Returns
-
-`Promise`\<`SandboxForkResponse`[]\>
-
-#### Inherited from
-
-`SandboxApi.forkSandbox`
-
-***
-
 ### getInfo()
 
 > `static` **getInfo**(`sandboxId`, `opts?`): `Promise`\<[`SandboxInfo`](../interfaces/SandboxInfo.md)\>
diff --git a/reference/sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md b/reference/sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md
index 83a01be6..e6304161 100644
--- a/reference/sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/CreateSnapshotOpts.md
@@ -40,24 +40,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxApiOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxApiOpts.md
index cf4e0f95..4888a6e1 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxApiOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxApiOpts.md
@@ -46,24 +46,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxForkOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxForkOpts.md
index 277433ce..475ebb4b 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxForkOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxForkOpts.md
@@ -40,24 +40,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### apiUrl?
-
-> `optional` **apiUrl?**: `string`
-
-**`Internal`**
-
-API Url to use for the API.
-
-#### Default
-
-AGENTBOX_API_URL // environment variable or `https://api.${domain}`
-
-#### Inherited from
-
-`ConnectionOpts.apiUrl`
-
-***
-
 ### count?
 
 > `optional` **count?**: `number`
@@ -76,24 +58,6 @@ outcome of each is reported in its entry of the returned array.
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-`ConnectionOpts.debug`
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
@@ -159,24 +123,6 @@ Timeout for requests to the API in **milliseconds**.
 
 ***
 
-### sandboxUrl?
-
-> `optional` **sandboxUrl?**: `string`
-
-**`Internal`**
-
-Sandbox Url to use for the API.
-
-#### Default
-
-AGENTBOX_SANDBOX_URL // environment variable, `https://sandbox.${domain}`
-
-#### Inherited from
-
-`ConnectionOpts.sandboxUrl`
-
-***
-
 ### signal?
 
 > `optional` **signal?**: `AbortSignal`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxListOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxListOpts.md
index b97f2ec1..efadc0e8 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxListOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxListOpts.md
@@ -38,24 +38,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md
index 96504b41..abe001e6 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxMetricsOpts.md
@@ -40,24 +40,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxOpts.md
index b16a25af..6566b864 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxOpts.md
@@ -54,42 +54,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### apiUrl?
-
-> `optional` **apiUrl?**: `string`
-
-**`Internal`**
-
-API Url to use for the API.
-
-#### Default
-
-AGENTBOX_API_URL // environment variable or `https://api.${domain}`
-
-#### Inherited from
-
-`ConnectionOpts.apiUrl`
-
-***
-
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-`ConnectionOpts.debug`
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxPaginator.md b/reference/sdk/javascript/sandbox/interfaces/SandboxPaginator.md
index dd8bb5df..58f7a673 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxPaginator.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxPaginator.md
@@ -18,26 +18,6 @@ while (paginator.hasNext) {
 
 - `Paginator`\<[`SandboxInfo`](SandboxInfo.md), [`SandboxApiOpts`](SandboxApiOpts.md)\>
 
-## Properties
-
-### limit?
-
-> `protected` `readonly` `optional` **limit?**: `number`
-
-#### Inherited from
-
-`Paginator.limit`
-
-***
-
-### opts?
-
-> `protected` `readonly` `optional` **opts?**: [`SandboxApiOpts`](SandboxApiOpts.md)
-
-#### Inherited from
-
-`Paginator.opts`
-
 ## Accessors
 
 ### hasNext
@@ -107,27 +87,3 @@ Error if there are no more items to fetch. Call this method only if `hasNext` is
 #### Overrides
 
 `Paginator.nextItems`
-
-***
-
-### updatePagination()
-
-> `protected` **updatePagination**(`response`): `void`
-
-Update the pagination state from a response, reading the `x-next-token`
-header. Concrete paginators call this from Paginator.nextItems
-after fetching a page.
-
-#### Parameters
-
-##### response
-
-`Response`
-
-#### Returns
-
-`void`
-
-#### Inherited from
-
-`Paginator.updatePagination`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md b/reference/sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md
index 4508c1a4..eddd045e 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SandboxPauseOpts.md
@@ -40,24 +40,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SnapshotListOpts.md b/reference/sdk/javascript/sandbox/interfaces/SnapshotListOpts.md
index a0eb4cbe..9e58cceb 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SnapshotListOpts.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SnapshotListOpts.md
@@ -40,24 +40,6 @@ AGENTBOX_API_KEY // environment variable
 
 ***
 
-### debug?
-
-> `optional` **debug?**: `boolean`
-
-**`Internal`**
-
-If true the SDK starts in the debug mode and connects to the local envd API server.
-
-#### Default
-
-AGENTBOX_DEBUG // environment variable or `false`
-
-#### Inherited from
-
-[`SandboxForkOpts`](SandboxForkOpts.md).[`debug`](SandboxForkOpts.md#debug)
-
-***
-
 ### domain?
 
 > `optional` **domain?**: `string`
diff --git a/reference/sdk/javascript/sandbox/interfaces/SnapshotPaginator.md b/reference/sdk/javascript/sandbox/interfaces/SnapshotPaginator.md
index 93e299bd..d202fb7f 100644
--- a/reference/sdk/javascript/sandbox/interfaces/SnapshotPaginator.md
+++ b/reference/sdk/javascript/sandbox/interfaces/SnapshotPaginator.md
@@ -18,26 +18,6 @@ while (paginator.hasNext) {
 
 - `Paginator`\<[`SnapshotInfo`](SnapshotInfo.md), [`SandboxApiOpts`](SandboxApiOpts.md)\>
 
-## Properties
-
-### limit?
-
-> `protected` `readonly` `optional` **limit?**: `number`
-
-#### Inherited from
-
-`Paginator.limit`
-
-***
-
-### opts?
-
-> `protected` `readonly` `optional` **opts?**: [`SandboxApiOpts`](SandboxApiOpts.md)
-
-#### Inherited from
-
-`Paginator.opts`
-
 ## Accessors
 
 ### hasNext
@@ -107,27 +87,3 @@ Error if there are no more items to fetch. Call this method only if `hasNext` is
 #### Overrides
 
 `Paginator.nextItems`
-
-***
-
-### updatePagination()
-
-> `protected` **updatePagination**(`response`): `void`
-
-Update the pagination state from a response, reading the `x-next-token`
-header. Concrete paginators call this from Paginator.nextItems
-after fetching a page.
-
-#### Parameters
-
-##### response
-
-`Response`
-
-#### Returns
-
-`void`
-
-#### Inherited from
-
-`Paginator.updatePagination`
diff --git a/scripts/generate-reference.py b/scripts/generate-reference.py
index 0e5575f7..9a3bffd5 100644
--- a/scripts/generate-reference.py
+++ b/scripts/generate-reference.py
@@ -63,19 +63,84 @@ def markdown_text(value: object) -> str:
     return " ".join(str(value or "").split())
 
 
-def schema_type(document: dict, schema: dict) -> str:
+def merge_schema(target: dict, source: dict) -> None:
+    """Merge one allOf branch into a documentation view of the schema."""
+    for key, value in source.items():
+        if key == "properties" and isinstance(value, dict):
+            target.setdefault("properties", {}).update(value)
+        elif key == "required" and isinstance(value, list):
+            target["required"] = list(
+                dict.fromkeys([*target.get("required", []), *value])
+            )
+        elif key == "nullable":
+            target[key] = bool(target.get(key)) or bool(value)
+        elif key not in target:
+            target[key] = value
+
+
+def normalize_schema(
+    document: dict,
+    schema: dict,
+    ancestors: frozenset[tuple[str, object]] = frozenset(),
+) -> tuple[dict, str | None]:
+    """Resolve refs and flatten allOf while preserving wrapper metadata."""
     resolved, reference_name = resolve_ref(document, schema)
+    if not isinstance(resolved, dict):
+        return {}, reference_name
+    normalized = dict(resolved)
+    if schema is not resolved:
+        normalized.update(
+            {key: value for key, value in schema.items() if key != "$ref"}
+        )
+
+    all_of = normalized.pop("allOf", None)
+    if not isinstance(all_of, list):
+        return normalized, reference_name
+
+    marker = (
+        ("reference", reference_name) if reference_name else ("schema", id(resolved))
+    )
+    if marker in ancestors:
+        return normalized, reference_name
+    descendants = ancestors | {marker}
+    branch_names = []
+    for branch in all_of:
+        if not isinstance(branch, dict):
+            continue
+        branch_schema, branch_name = normalize_schema(document, branch, descendants)
+        merge_schema(normalized, branch_schema)
+        if branch_name:
+            branch_names.append(branch_name)
+    if reference_name is None and len(branch_names) == 1:
+        reference_name = branch_names[0]
+    return normalized, reference_name
+
+
+def schema_type(document: dict, schema: dict) -> str:
+    resolved, reference_name = normalize_schema(document, schema)
     if reference_name:
-        return reference_name
-    if "oneOf" in resolved:
-        return " | ".join(schema_type(document, item) for item in resolved["oneOf"])
-    if "anyOf" in resolved:
-        return " | ".join(schema_type(document, item) for item in resolved["anyOf"])
-    if resolved.get("type") == "array":
-        return f"array<{schema_type(document, resolved.get('items', {}))}>"
-    if resolved.get("enum"):
-        return " | ".join(str(item) for item in resolved["enum"])
-    return resolved.get("type", "object")
+        type_name = reference_name
+    elif not resolved:
+        type_name = "any"
+    elif "oneOf" in resolved:
+        type_name = " | ".join(
+            schema_type(document, item) for item in resolved["oneOf"]
+        )
+    elif "anyOf" in resolved:
+        type_name = " | ".join(
+            schema_type(document, item) for item in resolved["anyOf"]
+        )
+    elif resolved.get("type") == "array":
+        type_name = f"array<{schema_type(document, resolved.get('items', {}))}>"
+    elif resolved.get("enum"):
+        type_name = " | ".join(str(item) for item in resolved["enum"])
+    elif resolved.get("properties"):
+        type_name = "object"
+    else:
+        type_name = resolved.get("type", "object")
+    if resolved.get("nullable") and "null" not in type_name.split(" | "):
+        return f"{type_name} | null"
+    return type_name
 
 
 def render_named_item(
@@ -89,43 +154,185 @@ def render_named_item(
     return lines
 
 
-def schema_fields(document: dict, schema: dict) -> dict:
-    """Return the object schema whose fields describe a response value."""
-    resolved, _ = resolve_ref(document, schema)
+def schema_value(value: object) -> str:
+    if isinstance(value, (dict, list, bool)) or value is None:
+        return json.dumps(value, sort_keys=True)
+    return str(value)
+
+
+def render_schema_metadata(document: dict, schema: dict, indent: str = "") -> list[str]:
+    """Render validation and representation details without losing referenced enums."""
+    resolved, reference_name = normalize_schema(document, schema)
+    if not isinstance(resolved, dict):
+        return []
+
+    lines = []
+    if resolved.get("format"):
+        lines.extend([f"{indent}Format: `{resolved['format']}`", ""])
+    if resolved.get("enum"):
+        label = f" for `{reference_name}`" if reference_name else ""
+        values = " | ".join(f"`{schema_value(value)}`" for value in resolved["enum"])
+        lines.extend([f"{indent}Allowed values{label}: {values}", ""])
+    if "default" in resolved:
+        lines.extend([f"{indent}Default: `{schema_value(resolved['default'])}`", ""])
+    for key, label in (
+        ("minimum", "Minimum"),
+        ("maximum", "Maximum"),
+        ("exclusiveMinimum", "Exclusive minimum"),
+        ("exclusiveMaximum", "Exclusive maximum"),
+        ("minLength", "Minimum length"),
+        ("maxLength", "Maximum length"),
+        ("minItems", "Minimum items"),
+        ("maxItems", "Maximum items"),
+        ("pattern", "Pattern"),
+    ):
+        if key in resolved:
+            lines.extend([f"{indent}{label}: `{schema_value(resolved[key])}`", ""])
+    if "uniqueItems" in resolved:
+        unique = "yes" if resolved["uniqueItems"] else "no"
+        lines.extend([f"{indent}Unique items: `{unique}`", ""])
+    if resolved.get("type") == "array" and isinstance(resolved.get("items"), dict):
+        lines.extend(render_schema_metadata(document, resolved["items"], indent))
+    return lines
+
+
+def schema_fields(document: dict, schema: dict) -> tuple[dict, str | None]:
+    """Return the object schema whose fields describe a value."""
+    resolved, reference_name = normalize_schema(document, schema)
     visited = set()
     while isinstance(resolved, dict) and resolved.get("type") == "array":
         marker = id(resolved)
         if marker in visited:
-            return {}
+            return {}, reference_name
         visited.add(marker)
         items = resolved.get("items")
         if not isinstance(items, dict):
-            return {}
-        resolved, _ = resolve_ref(document, items)
-    return resolved if isinstance(resolved, dict) else {}
+            return {}, reference_name
+        resolved, item_reference = normalize_schema(document, items)
+        reference_name = item_reference or reference_name
+    return (resolved if isinstance(resolved, dict) else {}), reference_name
 
 
-def render_schema(document: dict, schema: dict) -> list[str]:
-    resolved, reference_name = resolve_ref(document, schema)
-    lines = [f"Schema: `{reference_name or schema_type(document, resolved)}`", ""]
-    fields = schema_fields(document, resolved)
-    properties = fields.get("properties", {})
-    if not properties:
+def render_schema_fields(
+    document: dict,
+    schema: dict,
+    prefix: str = "",
+    ancestors: frozenset[tuple[str, object]] = frozenset(),
+) -> list[str]:
+    """Render public fields recursively with cycle-safe dotted paths."""
+    fields, reference_name = schema_fields(document, schema)
+    marker = ("reference", reference_name) if reference_name else ("schema", id(fields))
+    if marker in ancestors:
+        return []
+    descendants = ancestors | {marker}
+    lines = []
+
+    variants = fields.get("oneOf") or fields.get("anyOf")
+    if isinstance(variants, list):
+        discriminator = fields.get("discriminator", {})
+        discriminator_name = discriminator.get("propertyName")
+        mapping = discriminator.get("mapping", {})
+        for variant in variants:
+            if not isinstance(variant, dict):
+                continue
+            _, variant_name = resolve_ref(document, variant)
+            variant_name = variant_name or schema_type(document, variant)
+            reference = variant.get("$ref")
+            discriminator_value = next(
+                (value for value, target in mapping.items() if target == reference),
+                None,
+            )
+            qualifier = ""
+            if discriminator_name and discriminator_value is not None:
+                qualifier = (
+                    f" · discriminator `{discriminator_name}` = `{discriminator_value}`"
+                )
+            lines.extend([f"- **Variant `{variant_name}`**{qualifier}", ""])
+            variant_prefix = (
+                f"{prefix}<{variant_name}>" if prefix else f"<{variant_name}>"
+            )
+            lines.extend(
+                render_schema_fields(document, variant, variant_prefix, descendants)
+            )
         return lines
+
     required = set(fields.get("required", []))
-    for name, property_schema in properties.items():
-        property_value, _ = resolve_ref(document, property_schema)
+    for name, property_schema in fields.get("properties", {}).items():
+        field_name = f"{prefix}.{name}" if prefix else name
+        property_value, _ = normalize_schema(document, property_schema)
         lines.extend(
             render_named_item(
-                name,
+                field_name,
                 schema_type(document, property_schema),
                 ["required" if name in required else "optional"],
                 property_value.get("description", ""),
             )
         )
+        lines.extend(render_schema_metadata(document, property_schema, "  "))
+        lines.extend(
+            render_schema_fields(document, property_schema, field_name, descendants)
+        )
+
+    additional = fields.get("additionalProperties")
+    if isinstance(additional, dict):
+        field_name = f"{prefix}.*" if prefix else "*"
+        additional_value, _ = normalize_schema(document, additional)
+        lines.extend(
+            render_named_item(
+                field_name,
+                schema_type(document, additional),
+                ["additional property"],
+                additional_value.get("description", ""),
+            )
+        )
+        lines.extend(render_schema_metadata(document, additional, "  "))
+        lines.extend(
+            render_schema_fields(document, additional, field_name, descendants)
+        )
+    return lines
+
+
+def render_schema(document: dict, schema: dict) -> list[str]:
+    resolved, reference_name = normalize_schema(document, schema)
+    lines = [f"Schema: `{reference_name or schema_type(document, resolved)}`", ""]
+    if isinstance(resolved, dict) and resolved.get("description"):
+        lines.extend([markdown_text(resolved["description"]), ""])
+    lines.extend(render_schema_metadata(document, schema))
+    lines.extend(render_schema_fields(document, resolved))
     return lines
 
 
+def render_parameter_serialization(document: dict, parameter: dict) -> list[str]:
+    if "style" not in parameter and "explode" not in parameter:
+        return []
+    location = parameter.get("in")
+    style = parameter.get(
+        "style",
+        {"query": "form", "cookie": "form", "path": "simple", "header": "simple"}.get(
+            location
+        ),
+    )
+    if not style:
+        raise SystemExit(
+            f"Cannot infer serialization style for parameter {parameter.get('name')}"
+        )
+    explode = parameter.get("explode", style == "form")
+    details = [f"style `{style}`", f"explode `{'true' if explode else 'false'}`"]
+    schema, _ = normalize_schema(document, parameter.get("schema", {}))
+    if location == "query" and schema.get("type") == "array":
+        name = parameter.get("name", "parameter")
+        if style == "form":
+            wire_format = (
+                f"{name}=value1&{name}=value2" if explode else f"{name}=value1,value2"
+            )
+            details.append(f"wire format `{wire_format}`")
+        elif style == "spaceDelimited":
+            details.append(f"wire format `{name}=value1%20value2`")
+        elif style == "pipeDelimited":
+            details.append(f"wire format `{name}=value1|value2`")
+    return [f"  Serialization: {'; '.join(details)}", ""]
+
+
 def render_operation_markdown(document: dict, record: dict) -> str:
     operation = document["paths"][record["path"]][record["method"].lower()]
     lines = [f"# {record['method']} {record['path']}", ""]
@@ -141,17 +348,28 @@ def render_operation_markdown(document: dict, record: dict) -> str:
     if parameters:
         lines.extend(["## Parameters", ""])
         for parameter in parameters:
+            parameter_schema = parameter.get("schema", {})
+            normalized_parameter_schema, _ = normalize_schema(
+                document, parameter_schema
+            )
+            parameter_description = parameter.get("description") or (
+                normalized_parameter_schema.get("description", "")
+                if isinstance(normalized_parameter_schema, dict)
+                else ""
+            )
             lines.extend(
                 render_named_item(
                     parameter.get("name", ""),
-                    schema_type(document, parameter.get("schema", {})),
+                    schema_type(document, parameter_schema),
                     [
                         parameter.get("in", ""),
                         "required" if parameter.get("required") else "optional",
                     ],
-                    parameter.get("description", ""),
+                    parameter_description,
                 )
             )
+            lines.extend(render_schema_metadata(document, parameter_schema, "  "))
+            lines.extend(render_parameter_serialization(document, parameter))
 
     if operation.get("requestBody"):
         request_body, _ = resolve_ref(document, operation["requestBody"])
@@ -176,6 +394,21 @@ def render_operation_markdown(document: dict, record: dict) -> str:
         lines.extend([f"### {status}", ""])
         if resolved.get("description"):
             lines.extend([resolved["description"].strip(), ""])
+        headers = resolved.get("headers", {})
+        if headers:
+            lines.extend(["#### Response headers", ""])
+            for name, header in headers.items():
+                resolved_header, _ = resolve_ref(document, header)
+                header_schema = resolved_header.get("schema", {})
+                lines.extend(
+                    render_named_item(
+                        name,
+                        schema_type(document, header_schema),
+                        ["response header"],
+                        resolved_header.get("description", ""),
+                    )
+                )
+                lines.extend(render_schema_metadata(document, header_schema, "  "))
         for content_type, media in resolved.get("content", {}).items():
             lines.extend([f"Content-Type: `{content_type}`", ""])
             if media.get("schema"):
@@ -273,6 +506,40 @@ def apply_public_operation_security(
         operation["security"] = [requirement] if auth["required"] else [{}, requirement]
 
 
+def apply_envd_routing(public: dict, records: list[dict]) -> None:
+    """Publish the stable sandbox proxy contract required by envd operations."""
+    public["servers"] = [
+        {
+            "url": "https://sandbox.agentbox-runtime.ru",
+            "description": "AgentBox sandbox proxy. Routing headers are required.",
+        }
+    ]
+    parameters = {
+        "AgentboxSandboxId": {
+            "name": "Agentbox-Sandbox-Id",
+            "in": "header",
+            "required": True,
+            "description": "Identifier of the sandbox that receives the request.",
+            "schema": {"type": "string"},
+        },
+        "AgentboxSandboxPort": {
+            "name": "Agentbox-Sandbox-Port",
+            "in": "header",
+            "required": True,
+            "description": "Internal envd HTTP port exposed through the sandbox proxy.",
+            "schema": {"type": "integer", "default": 49983},
+        },
+    }
+    public.setdefault("components", {}).setdefault("parameters", {}).update(parameters)
+    for record in records:
+        operation = public["paths"][record["path"]][record["method"].lower()]
+        operation["parameters"] = [
+            {"$ref": "#/components/parameters/AgentboxSandboxId"},
+            {"$ref": "#/components/parameters/AgentboxSandboxPort"},
+            *operation.get("parameters", []),
+        ]
+
+
 def build_openapi(name: str, config: dict) -> list[dict]:
     source = ROOT / config["source"]
     document = yaml.safe_load(source.read_text())
@@ -367,6 +634,8 @@ def build_openapi(name: str, config: dict) -> list[dict]:
         {"name": group} for group in sorted({record["group"] for record in records})
     ]
     filter_public_openapi(public, for_reference=True)
+    if name == "envd":
+        apply_envd_routing(public, records)
     apply_public_operation_security(document, public, records, public_auth_schemes)
     destination = (
         OUT
@@ -382,63 +651,398 @@ def build_openapi(name: str, config: dict) -> list[dict]:
     return sorted(records, key=lambda item: (item["group"], item["slug"]))
 
 
-def proto_reference(source: Path, destination: Path, title: str) -> None:
-    text = source.read_text()
-    service_match = re.search(r"service\s+(\w+)\s*\{(.*?)\n\}", text, re.S)
-    if not service_match:
-        raise SystemExit(f"No service found in {source}")
-    service, body = service_match.groups()
-    rpcs = re.findall(
-        r"(?:\s*//\s*(.*?)\n)?\s*rpc\s+(\w+)\s*\(([^)]+)\)\s*returns\s*\(([^)]+)\)",
-        body,
-    )
-    lines = [f"# {title}", "", f"Service: `{service}`", ""]
-    for comment, name, request, response in rpcs:
+PROTO_TOKEN = re.compile(
+    r"""
+    (?P<whitespace>\s+)
+    |(?P<line_comment>//[^\n]*)
+    |(?P<block_comment>/\*.*?\*/)
+    |(?P<string>"(?:\\.|[^"\\])*")
+    |(?P<identifier>[A-Za-z_][A-Za-z0-9_]*)
+    |(?P<number>-?(?:0[xX][0-9A-Fa-f]+|\d+))
+    |(?P<symbol>[{}()\[\]<>=;,.])
+    |(?P<unknown>.)
+    """,
+    re.S | re.X,
+)
+
+
+def proto_tokens(text: str) -> list[tuple[str, str]]:
+    tokens = []
+    for match in PROTO_TOKEN.finditer(text):
+        kind = match.lastgroup
+        value = match.group()
+        if kind == "whitespace":
+            continue
+        if kind == "unknown":
+            raise ValueError(f"Unsupported protobuf token: {value!r}")
+        if kind == "line_comment":
+            tokens.append(("comment", value.removeprefix("//").strip()))
+        elif kind == "block_comment":
+            body = value.removeprefix("/*").removesuffix("*/")
+            tokens.append(
+                (
+                    "comment",
+                    " ".join(
+                        line.strip().removeprefix("*").strip()
+                        for line in body.splitlines()
+                    ),
+                )
+            )
+        else:
+            tokens.append((kind, value))
+    return tokens
+
+
+class ProtoParser:
+    def __init__(self, text: str):
+        self.tokens = proto_tokens(text)
+        self.position = 0
+        self.package = None
+        self.services = []
+        self.messages = []
+        self.enums = []
+
+    def current(self, value: str | None = None) -> tuple[str, str] | bool | None:
+        if self.position >= len(self.tokens):
+            return None
+        token = self.tokens[self.position]
+        return token if value is None else token[1] == value
+
+    def take(self, value: str | None = None) -> tuple[str, str]:
+        token = self.current()
+        if token is None or (value is not None and token[1] != value):
+            found = token[1] if token else "end of file"
+            raise ValueError(f"Expected {value or 'token'}, found {found}")
+        self.position += 1
+        return token
+
+    def accept(self, value: str) -> bool:
+        if self.current(value):
+            self.position += 1
+            return True
+        return False
+
+    def comments(self) -> str:
+        comments = []
+        while self.current() and self.current()[0] == "comment":
+            comments.append(self.take()[1])
+        return " ".join(filter(None, comments))
+
+    def qualified_name(self) -> str:
+        parts = []
+        if self.accept("."):
+            parts.append("")
+        if not self.current() or self.current()[0] != "identifier":
+            raise ValueError("Expected protobuf type name")
+        parts.append(self.take()[1])
+        while self.accept("."):
+            if not self.current() or self.current()[0] != "identifier":
+                raise ValueError("Expected protobuf type name after '.'")
+            parts.append(self.take()[1])
+        return ".".join(parts)
+
+    def field_type(self) -> str:
+        if self.accept("map"):
+            self.take("<")
+            key = self.qualified_name()
+            self.take(",")
+            value = self.qualified_name()
+            self.take(">")
+            return f"map<{key}, {value}>"
+        return self.qualified_name()
+
+    def skip_balanced(self, opening: str, closing: str) -> None:
+        self.take(opening)
+        depth = 1
+        while depth:
+            token = self.take()[1]
+            if token == opening:
+                depth += 1
+            elif token == closing:
+                depth -= 1
+
+    def skip_statement(self) -> None:
+        while self.current() is not None:
+            value = self.current()[1]
+            if value == "}":
+                return
+            if value == ";":
+                self.take()
+                return
+            if value == "{":
+                self.skip_balanced("{", "}")
+                self.accept(";")
+                return
+            self.take()
+
+    def field(self, comment: str, oneof: str | None = None) -> dict | None:
+        start = self.position
+        modifier = None
+        if self.current() and self.current()[1] in {"optional", "repeated"}:
+            modifier = self.take()[1]
+        try:
+            field_type = self.field_type()
+            if not self.current() or self.current()[0] != "identifier":
+                raise ValueError("missing field name")
+            name = self.take()[1]
+            self.take("=")
+            if not self.current() or self.current()[0] != "number":
+                raise ValueError("missing field number")
+            number = self.take()[1]
+        except ValueError:
+            self.position = start
+            return None
+        if self.current("["):
+            self.skip_balanced("[", "]")
+        self.take(";")
+        return {
+            "name": name,
+            "type": f"{modifier} {field_type}" if modifier else field_type,
+            "number": number,
+            "comment": comment,
+            "oneof": oneof,
+        }
+
+    def oneof(self, message: dict) -> None:
+        name = self.take()[1]
+        self.take("{")
+        while True:
+            comment = self.comments()
+            if self.accept("}"):
+                break
+            field = self.field(comment, name)
+            if field:
+                message["fields"].append(field)
+            else:
+                self.skip_statement()
+
+    def message(self, comment: str, parents: tuple[str, ...] = ()) -> None:
+        name = self.take()[1]
+        qualified = ".".join((*parents, name))
+        message = {"name": qualified, "comment": comment, "fields": []}
+        self.messages.append(message)
+        self.take("{")
+        while True:
+            child_comment = self.comments()
+            if self.accept("}"):
+                break
+            if self.accept("message"):
+                self.message(child_comment, (*parents, name))
+            elif self.accept("enum"):
+                self.enum(child_comment, (*parents, name))
+            elif self.accept("oneof"):
+                self.oneof(message)
+            else:
+                field = self.field(child_comment)
+                if field:
+                    message["fields"].append(field)
+                else:
+                    self.skip_statement()
+
+    def enum(self, comment: str, parents: tuple[str, ...] = ()) -> None:
+        name = self.take()[1]
+        enum = {
+            "name": ".".join((*parents, name)),
+            "comment": comment,
+            "values": [],
+        }
+        self.enums.append(enum)
+        self.take("{")
+        while True:
+            value_comment = self.comments()
+            if self.accept("}"):
+                break
+            if self.current() and self.current()[0] == "identifier":
+                value = self.take()[1]
+                self.take("=")
+                number = self.take()[1]
+                if self.current("["):
+                    self.skip_balanced("[", "]")
+                self.take(";")
+                enum["values"].append(
+                    {"name": value, "number": number, "comment": value_comment}
+                )
+            else:
+                self.skip_statement()
+
+    def rpc(self, comment: str) -> dict:
+        name = self.take()[1]
+        self.take("(")
+        request_stream = self.accept("stream")
+        request = self.qualified_name()
+        self.take(")")
+        self.take("returns")
+        self.take("(")
+        response_stream = self.accept("stream")
+        response = self.qualified_name()
+        self.take(")")
+        self.skip_statement()
+        return {
+            "name": name,
+            "comment": comment,
+            "request": f"stream {request}" if request_stream else request,
+            "response": f"stream {response}" if response_stream else response,
+        }
+
+    def service(self, comment: str) -> None:
+        name = self.take()[1]
+        service = {"name": name, "comment": comment, "rpcs": []}
+        self.services.append(service)
+        self.take("{")
+        while True:
+            rpc_comment = self.comments()
+            if self.accept("}"):
+                break
+            if self.accept("rpc"):
+                service["rpcs"].append(self.rpc(rpc_comment))
+            else:
+                self.skip_statement()
+
+    def parse(self) -> dict:
+        while self.current() is not None:
+            comment = self.comments()
+            if self.accept("package"):
+                self.package = self.qualified_name()
+                self.take(";")
+            elif self.accept("service"):
+                self.service(comment)
+            elif self.accept("message"):
+                self.message(comment)
+            elif self.accept("enum"):
+                self.enum(comment)
+            else:
+                self.skip_statement()
+        return {
+            "package": self.package,
+            "services": self.services,
+            "messages": self.messages,
+            "enums": self.enums,
+        }
+
+
+def markdown_cell(value: str) -> str:
+    return " ".join(value.split()).replace("|", r"\|")
+
+
+def connect_transport_lines(config: dict, service_name: str) -> list[str]:
+    if set(config) != {"productionBaseUrl", "method", "headers"}:
+        raise SystemExit("Connect reference config has unsupported fields")
+    base_url = config["productionBaseUrl"].rstrip("/")
+    method = config["method"].upper()
+    headers = config["headers"]
+    if not base_url.startswith("https://") or method != "POST":
+        raise SystemExit("Connect reference requires an HTTPS base URL and POST")
+    if not isinstance(headers, list) or not headers:
+        raise SystemExit("Connect reference must define request headers")
+
+    lines = [
+        "## Transport",
+        "",
+        "AgentBox exposes this service through the Connect protocol over HTTP.",
+        "The AgentBox SDK supplies the routing and authorization headers automatically.",
+        "",
+        f"- Production base URL: `{base_url}`",
+        f"- Fully qualified service: `{service_name}`",
+        f"- RPC URL pattern: `{method} {base_url}/{service_name}/{{RPC}}`",
+        "",
+        "### Request headers",
+        "",
+    ]
+    for header in headers:
+        if set(header) not in (
+            {"name", "required", "description"},
+            {"name", "required", "description", "default"},
+        ):
+            raise SystemExit("Connect request header has unsupported fields")
+        requirement = "required" if header["required"] else "conditional"
+        description = header["description"]
+        if "default" in header:
+            description += f" Default: `{header['default']}`."
         lines.extend(
             [
-                f"## {name}",
+                f"- **`{header['name']}`** · {requirement} — {description}",
+            ]
+        )
+    lines.append("")
+    return lines
+
+
+def proto_reference(
+    source: Path, destination: Path, title: str, transport_config: dict
+) -> None:
+    document = ProtoParser(source.read_text()).parse()
+    if not document["package"]:
+        raise SystemExit(f"Expected a package declaration in {source}")
+    if len(document["services"]) != 1:
+        raise SystemExit(f"Expected exactly one service in {source}")
+    service = document["services"][0]
+    service_name = f"{document['package']}.{service['name']}"
+    base_url = transport_config["productionBaseUrl"].rstrip("/")
+    method = transport_config["method"].upper()
+    lines = [f"# {title}", ""]
+    lines.extend(connect_transport_lines(transport_config, service_name))
+    for rpc in service["rpcs"]:
+        lines.extend(
+            [
+                f"## {rpc['name']}",
                 "",
-                comment.strip() if comment else "Public RPC exposed by envd.",
+                rpc["comment"] or "Public RPC exposed by envd.",
                 "",
-                f"- Request: `{request.strip()}`",
-                f"- Response: `{response.strip()}`",
+                f"- Endpoint: `{method} {base_url}/{service_name}/{rpc['name']}`",
+                f"- Request: `{rpc['request']}`",
+                f"- Response: `{rpc['response']}`",
                 "",
             ]
         )
     lines.extend(["## Message types", ""])
-    for match in re.finditer(
-        r"(?:^|\n)(?:\s*//\s*(.*?)\n)?\s*message\s+(\w+)\s*\{", text
-    ):
-        comment, name = match.groups()
-        depth = 1
-        cursor = match.end()
-        while depth and cursor < len(text):
-            if text[cursor] == "{":
-                depth += 1
-            elif text[cursor] == "}":
-                depth -= 1
-            cursor += 1
-        body = text[match.end() : cursor - 1]
-        fields = re.findall(
-            r"(?:\s*//\s*(.*?)\n)?\s*(repeated\s+|optional\s+)?([.\w]+)\s+(\w+)\s*=\s*(\d+)",
-            body,
-        )
-        lines.extend([f"### {name}", ""])
-        if comment:
-            lines.extend([comment.strip(), ""])
-        if fields:
-            lines.extend(
-                [
-                    "| Field | Type | Number | Description |",
-                    "| --- | --- | ---: | --- |",
-                ]
-            )
-            for field_comment, modifier, field_type, field_name, number in fields:
-                type_name = f"{modifier.strip()} {field_type}".strip()
-                lines.append(
-                    f"| `{field_name}` | `{type_name}` | {number} | {field_comment.strip() if field_comment else ''} |"
+    for message in document["messages"]:
+        lines.extend([f"### {message['name']}", ""])
+        if message["comment"]:
+            lines.extend([message["comment"], ""])
+        if message["fields"]:
+            has_oneof = any(field["oneof"] for field in message["fields"])
+            if has_oneof:
+                lines.extend(
+                    [
+                        "| Field | Type | Number | Oneof | Description |",
+                        "| --- | --- | ---: | --- | --- |",
+                    ]
                 )
+            else:
+                lines.extend(
+                    [
+                        "| Field | Type | Number | Description |",
+                        "| --- | --- | ---: | --- |",
+                    ]
+                )
+            for field in message["fields"]:
+                cells = [
+                    f"`{field['name']}`",
+                    f"`{field['type']}`",
+                    field["number"],
+                ]
+                if has_oneof:
+                    cells.append(f"`{field['oneof']}`" if field["oneof"] else "")
+                cells.append(markdown_cell(field["comment"]))
+                lines.append(f"| {' | '.join(cells)} |")
             lines.append("")
+    if document["enums"]:
+        lines.extend(["## Enum types", ""])
+    for enum in document["enums"]:
+        lines.extend([f"### {enum['name']}", ""])
+        if enum["comment"]:
+            lines.extend([enum["comment"], ""])
+        lines.extend(
+            [
+                "| Value | Number | Description |",
+                "| --- | ---: | --- |",
+            ]
+        )
+        for value in enum["values"]:
+            lines.append(
+                f"| `{value['name']}` | {value['number']} | {markdown_cell(value['comment'])} |"
+            )
+        lines.append("")
     destination.parent.mkdir(parents=True, exist_ok=True)
     destination.write_text("\n".join(lines))
 
@@ -468,6 +1072,9 @@ def run_sdk_generators() -> None:
             "--readme",
             "none",
             "--disableSources",
+            "--excludeInternal",
+            "--excludePrivate",
+            "--excludeProtected",
             "--hidePageHeader",
             "--out",
             str(destination),
@@ -549,11 +1156,13 @@ def main() -> None:
         ROOT / "spec/envd/process/process.proto",
         OUT / "connect/process.md",
         "Process API",
+        config["connect"],
     )
     proto_reference(
         ROOT / "spec/envd/filesystem/filesystem.proto",
         OUT / "connect/filesystem.md",
         "Filesystem API",
+        config["connect"],
     )
     run_sdk_generators()
 
diff --git a/scripts/public_openapi.py b/scripts/public_openapi.py
index c2f42b85..872a65cb 100644
--- a/scripts/public_openapi.py
+++ b/scripts/public_openapi.py
@@ -91,6 +91,71 @@ def assert_no_removed_refs(value: Any) -> None:
             assert_no_removed_refs(child)
 
 
+def component_reference(reference: str) -> tuple[str, str] | None:
+    prefix = "#/components/"
+    if not reference.startswith(prefix):
+        return None
+    parts = reference[len(prefix) :].split("/")
+    if len(parts) < 2:
+        return None
+
+    def decode(value: str) -> str:
+        return value.replace("~1", "/").replace("~0", "~")
+
+    return decode(parts[0]), decode(parts[1])
+
+
+def collect_component_references(value: Any) -> set[tuple[str, str]]:
+    references = set()
+    if isinstance(value, dict):
+        reference = value.get("$ref")
+        if isinstance(reference, str):
+            component = component_reference(reference)
+            if component is not None:
+                references.add(component)
+        for child in value.values():
+            references.update(collect_component_references(child))
+    elif isinstance(value, list):
+        for child in value:
+            references.update(collect_component_references(child))
+    return references
+
+
+def prune_unreferenced_components(document: dict) -> None:
+    """Keep only components reachable from the published OpenAPI surface."""
+    components = document.get("components")
+    if not isinstance(components, dict):
+        return
+
+    roots = {key: value for key, value in document.items() if key != "components"}
+    pending = list(collect_component_references(roots))
+    reachable = set()
+    while pending:
+        component = pending.pop()
+        if component in reachable:
+            continue
+        section, name = component
+        definition = components.get(section, {}).get(name)
+        if definition is None:
+            raise RuntimeError(
+                f"public OpenAPI references missing component: {section}/{name}"
+            )
+        reachable.add(component)
+        pending.extend(collect_component_references(definition) - reachable)
+
+    for section in list(components):
+        definitions = components[section]
+        if not isinstance(definitions, dict):
+            continue
+        components[section] = {
+            name: definition
+            for name, definition in definitions.items()
+            if (section, name) in reachable
+        }
+        if not components[section]:
+            del components[section]
+
+
 def filter_public_openapi(document: dict, *, for_reference: bool = False) -> dict:
     """Mutate and return a client-safe or stricter documentation-safe contract."""
     remove_properties(
@@ -106,4 +171,6 @@ def filter_public_openapi(document: dict, *, for_reference: bool = False) -> dic
         schemas.pop(name, None)
 
     assert_no_removed_refs(document)
+    if for_reference:
+        prune_unreferenced_components(document)
     return document
diff --git a/scripts/test-reference-contract.py b/scripts/test-reference-contract.py
index e675b60d..8caf9215 100644
--- a/scripts/test-reference-contract.py
+++ b/scripts/test-reference-contract.py
@@ -3,6 +3,7 @@
 
 import hashlib
 import json
+import re
 from pathlib import Path
 
 import yaml
@@ -30,6 +31,34 @@
     "AuthProviderBearerAuth",
     "AuthProviderTeamAuth",
 }
+FORBIDDEN_COMPONENTS = {
+    "AdminSandboxKillResult",
+    "AdminBuildCancelResult",
+    "TeamAPIKey",
+    "CreatedTeamAPIKey",
+    "NewTeamAPIKey",
+    "UpdateTeamAPIKey",
+    "apiKeyID",
+    "accessTokenID",
+    "volumeID",
+    "VolumeMount",
+}
+
+
+def markdown_section(document: str, heading: str) -> str:
+    marker = f"### {heading}\n"
+    start = document.index(marker) + len(marker)
+    boundaries = [
+        position
+        for prefix in ("\n### ", "\n## ")
+        if (position := document.find(prefix, start)) >= 0
+    ]
+    end = min(boundaries) if boundaries else len(document)
+    return document[start:end]
+
+
+def markdown_table_names(section: str) -> list[str]:
+    return re.findall(r"^\| `([^`]+)` \|", section, re.M)
 
 
 def resolve_local_ref(document: dict, value: dict) -> dict:
@@ -97,6 +126,42 @@ def assert_public_schema(value) -> None:
             assert_public_schema(child)
 
 
+def component_references(value) -> set[tuple[str, str]]:
+    references = set()
+    if isinstance(value, dict):
+        reference = value.get("$ref")
+        if isinstance(reference, str) and reference.startswith("#/components/"):
+            section, name, *_ = reference.removeprefix("#/components/").split("/")
+            references.add((section, name))
+        for child in value.values():
+            references.update(component_references(child))
+    elif isinstance(value, list):
+        for child in value:
+            references.update(component_references(child))
+    return references
+
+
+def assert_only_reachable_components(document: dict) -> None:
+    components = document.get("components", {})
+    roots = {key: value for key, value in document.items() if key != "components"}
+    pending = list(component_references(roots))
+    reachable = set()
+    while pending:
+        component = pending.pop()
+        if component in reachable:
+            continue
+        reachable.add(component)
+        section, name = component
+        pending.extend(component_references(components[section][name]) - reachable)
+    published = {
+        (section, name)
+        for section, definitions in components.items()
+        if section != "securitySchemes"
+        for name in definitions
+    }
+    assert published == reachable
+
+
 def main() -> None:
     manifest = json.loads((REFERENCE / "manifest.json").read_text())
     assert manifest["schemaVersion"] == 1
@@ -143,6 +208,42 @@ def main() -> None:
     assert not any(operation["path"] in BANNED_ENVD_PATHS for operation in operations)
 
     config = yaml.safe_load((ROOT / "reference-config/operations.yaml").read_text())
+    connect = config["connect"]
+    connect_headers = {header["name"]: header for header in connect["headers"]}
+    assert connect["productionBaseUrl"] == "https://sandbox.agentbox-runtime.ru"
+    assert connect["method"] == "POST"
+    assert set(connect_headers) == {
+        "Agentbox-Sandbox-Id",
+        "Agentbox-Sandbox-Port",
+        "X-Access-Token",
+    }
+    assert connect_headers["Agentbox-Sandbox-Id"]["required"] is True
+    assert connect_headers["Agentbox-Sandbox-Port"] == {
+        "name": "Agentbox-Sandbox-Port",
+        "required": True,
+        "description": "Envd port routed by the sandbox proxy.",
+        "default": 49983,
+    }
+    assert connect_headers["X-Access-Token"]["required"] is False
+
+    javascript_config = (ROOT / "packages/js-sdk/src/connectionConfig.ts").read_text()
+    javascript_sandbox = (ROOT / "packages/js-sdk/src/sandbox/index.ts").read_text()
+    python_config = (
+        ROOT / "packages/python-sdk/agentbox/connection_config.py"
+    ).read_text()
+    python_sandboxes = "\n".join(
+        (ROOT / f"packages/python-sdk/agentbox/{variant}/main.py").read_text()
+        for variant in ("sandbox_sync", "sandbox_async")
+    )
+    assert "supportedDomains = ['agentbox-runtime.ru']" in javascript_config
+    assert "return `https://sandbox.${sandboxDomain}`" in javascript_config
+    assert "public static envdPort = 49983" in javascript_config
+    assert 'return f"https://sandbox.{sandbox_domain}"' in python_config
+    assert "envd_port = 49983" in python_config
+    for header in connect_headers:
+        assert header in javascript_sandbox
+        assert header in python_sandboxes
+
     control = yaml.safe_load((ROOT / config["controlPlane"]["source"]).read_text())
     public_tags = set(config["controlPlane"]["publicTags"])
     expected = set()
@@ -190,8 +291,42 @@ def main() -> None:
             "in": "header",
             "name": expected_header,
         }
+        if spec_name == "envd":
+            assert document["servers"] == [
+                {
+                    "url": connect["productionBaseUrl"],
+                    "description": (
+                        "AgentBox sandbox proxy. Routing headers are required."
+                    ),
+                }
+            ]
+            for path_item in document["paths"].values():
+                for method, operation in path_item.items():
+                    if method not in {"get", "post", "put", "patch", "delete"}:
+                        continue
+                    headers = {
+                        parameter["name"]: parameter
+                        for parameter in (
+                            resolve_local_ref(document, value)
+                            for value in operation.get("parameters", [])
+                        )
+                        if parameter.get("in") == "header"
+                    }
+                    for name in ("Agentbox-Sandbox-Id", "Agentbox-Sandbox-Port"):
+                        assert headers[name]["required"] is connect_headers[name][
+                            "required"
+                        ]
+                    assert headers["Agentbox-Sandbox-Port"]["schema"][
+                        "default"
+                    ] == connect_headers["Agentbox-Sandbox-Port"]["default"]
         assert_public_schema(document)
         assert_local_refs_resolve(document)
+        assert_only_reachable_components(document)
+        assert not any(
+            name in FORBIDDEN_COMPONENTS
+            for definitions in document.get("components", {}).values()
+            for name in definitions
+        )
 
     for operation in operations:
         document = public_documents[operation["spec"]]
@@ -237,6 +372,72 @@ def main() -> None:
     )
     assert "[object Object]" not in cli_markdown
 
+    process_reference = (REFERENCE / "connect/process.md").read_text()
+    for value in (
+        "Production base URL: `https://sandbox.agentbox-runtime.ru`",
+        "Fully qualified service: `process.Process`",
+        "RPC URL pattern: `POST https://sandbox.agentbox-runtime.ru/process.Process/{RPC}`",
+        "Endpoint: `POST https://sandbox.agentbox-runtime.ru/process.Process/List`",
+        "**`Agentbox-Sandbox-Id`** · required",
+        "**`Agentbox-Sandbox-Port`** · required",
+        "**`X-Access-Token`** · conditional",
+        "Default: `49983`",
+    ):
+        assert value in process_reference
+    assert markdown_table_names(markdown_section(process_reference, "PTY")) == ["size"]
+    assert markdown_table_names(
+        markdown_section(process_reference, "ProcessEvent")
+    ) == ["start", "data", "end", "keepalive"]
+    assert markdown_table_names(
+        markdown_section(process_reference, "StreamInputRequest")
+    ) == ["start", "data", "keepalive"]
+    assert "| `envs` | `map<string, string>` | 3 |" in markdown_section(
+        process_reference, "ProcessConfig"
+    )
+    assert "### PTY.Size" in process_reference
+    assert "### ProcessEvent.StartEvent" in process_reference
+    for value in (
+        "SIGNAL_UNSPECIFIED",
+        "SIGNAL_SIGTERM",
+        "SIGNAL_SIGKILL",
+    ):
+        assert value in markdown_section(process_reference, "Signal")
+
+    filesystem_reference = (REFERENCE / "connect/filesystem.md").read_text()
+    for value in (
+        "Production base URL: `https://sandbox.agentbox-runtime.ru`",
+        "Fully qualified service: `filesystem.Filesystem`",
+        "RPC URL pattern: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/{RPC}`",
+        "Endpoint: `POST https://sandbox.agentbox-runtime.ru/filesystem.Filesystem/Stat`",
+        "**`Agentbox-Sandbox-Id`** · required",
+        "**`Agentbox-Sandbox-Port`** · required",
+        "**`X-Access-Token`** · conditional",
+        "Default: `49983`",
+    ):
+        assert value in filesystem_reference
+    assert "| `metadata` | `map<string, string>` | 11 |" in markdown_section(
+        filesystem_reference, "EntryInfo"
+    )
+    for enum, values in {
+        "FileType": (
+            "FILE_TYPE_UNSPECIFIED",
+            "FILE_TYPE_FILE",
+            "FILE_TYPE_DIRECTORY",
+            "FILE_TYPE_SYMLINK",
+        ),
+        "EventType": (
+            "EVENT_TYPE_UNSPECIFIED",
+            "EVENT_TYPE_CREATE",
+            "EVENT_TYPE_WRITE",
+            "EVENT_TYPE_REMOVE",
+            "EVENT_TYPE_RENAME",
+            "EVENT_TYPE_CHMOD",
+        ),
+    }.items():
+        section = markdown_section(filesystem_reference, enum)
+        for value in values:
+            assert value in section
+
     javascript_files = {
         str(path.relative_to(REFERENCE))
         for path in (REFERENCE / "sdk/javascript").rglob("*.md")
@@ -246,6 +447,12 @@ def main() -> None:
     assert not any("deserializeChart" in path for path in javascript_files)
     assert not any("parseOutput" in path for path in javascript_files)
     assert not any("extractError" in path for path in javascript_files)
+    javascript_markdown = "\n".join(
+        path.read_text() for path in (REFERENCE / "sdk/javascript").rglob("*.md")
+    )
+    assert "**`Internal`**" not in javascript_markdown
+    assert "envdAccessToken" not in javascript_markdown
+    assert "protected static createSandbox" not in javascript_markdown
 
     list_sandboxes = (REFERENCE / "openapi/markdown/listSandboxes.md").read_text()
     assert "Metadata query used to filter the sandboxes" in list_sandboxes
@@ -253,8 +460,85 @@ def main() -> None:
     assert "Schema: `array<ListedSandbox>`" in list_sandboxes
     assert "- **`sandboxID`** · `string` · required" in list_sandboxes
     assert "- **`metadata`** · `string` · query · optional" in list_sandboxes
+    for expected in (
+        "Allowed values for `SandboxState`: `running` | `paused`",
+        "#### Response headers",
+        "- **`X-Next-Token`** · `string` · response header",
+        "- **`X-Total-Running`** · `integer` · response header",
+        "Format: `int32`",
+        "Default: `100`",
+        "Minimum: `1`",
+        "Maximum: `100`",
+        "Serialization: style `form`; explode `false`; wire format `state=value1,value2`",
+    ):
+        assert expected in list_sandboxes
+
+    sandbox_logs = (REFERENCE / "openapi/markdown/getSandboxLogs.md").read_text()
+    assert "Allowed values for `LogsDirection`: `forward` | `backward`" in sandbox_logs
+
+    upload_file = (REFERENCE / "openapi/markdown/uploadFile.md").read_text()
+    assert "### application/octet-stream" in upload_file
+    assert "Raw file content. The 'path' query parameter is required" in upload_file
+    assert "Format: `binary`" in upload_file
+
+    start_build = (REFERENCE / "openapi/markdown/startTemplateBuild.md").read_text()
+    for expected in (
+        "Variant `AWSRegistry`",
+        "discriminator `type` = `aws`",
+        "fromImageRegistry<AWSRegistry>.awsAccessKeyId",
+        "fromImageRegistry<AWSRegistry>.awsSecretAccessKey",
+        "fromImageRegistry<AWSRegistry>.awsRegion",
+        "Variant `GCPRegistry`",
+        "discriminator `type` = `gcp`",
+        "fromImageRegistry<GCPRegistry>.serviceAccountJson",
+        "Variant `GeneralRegistry`",
+        "discriminator `type` = `registry`",
+        "fromImageRegistry<GeneralRegistry>.username",
+        "fromImageRegistry<GeneralRegistry>.password",
+    ):
+        assert expected in start_build
+
+    list_metrics = (REFERENCE / "openapi/markdown/listSandboxMetrics.md").read_text()
+    assert "- **`sandbox_ids`** · `array<string>` · query · required" in list_metrics
+    assert "Maximum items: `100`" in list_metrics
+    assert "Unique items: `yes`" in list_metrics
+    assert (
+        "Serialization: style `form`; explode `false`; wire format `sandbox_ids=value1,value2`"
+        in list_metrics
+    )
+
+    list_templates = (REFERENCE / "openapi/markdown/listTemplates.md").read_text()
+    assert "- **`createdBy`** · `TeamUser | null` · required" in list_templates
+    assert "- **`createdBy.id`** · `string` · required" in list_templates
+    assert "Format: `uuid`" in list_templates
+    assert "- **`lastSpawnedAt`** · `string | null` · required" in list_templates
+
+    for operation, parameter, description in (
+        ("listSnapshots", "sandboxID", "Filter snapshots by source sandbox ID"),
+        (
+            "getSandboxMetrics",
+            "end",
+            "Unix timestamp for the end of the interval, in seconds, for which the metrics",
+        ),
+        ("getTemplateByAlias", "alias", "Template alias"),
+        ("getTemplateUploadUrl", "hash", "Hash of the files"),
+    ):
+        markdown = (REFERENCE / f"openapi/markdown/{operation}.md").read_text()
+        assert f"- **`{parameter}`**" in markdown
+        assert description in markdown
+
     create_sandbox = (REFERENCE / "openapi/markdown/createSandbox.md").read_text()
     assert "Schema: `NewSandbox`" in create_sandbox
+    assert "- **`mcp.*`** · `any` · additional property" in create_sandbox
+    assert "- **`mcp.*`** · `object` · additional property" not in create_sandbox
+    for field in (
+        "autoResume.enabled",
+        "network.allowPublicTraffic",
+        "network.maskRequestHost",
+        "iam.tokens",
+        "iam.tokens.*.audience",
+    ):
+        assert f"- **`{field}`** ·" in create_sandbox
 
 
 if __name__ == "__main__":