---
title: "live.agent_sandbox.register · OpenVibe.Services"
canonical: "https://openvibe.services/docs/capabilities/live.agent_sandbox.register"
updated: null
---

# live.agent\_sandbox.register · OpenVibe.Services

HTML: [live.agent\_sandbox.register · OpenVibe.Services](https://openvibe.services/docs/capabilities/live.agent_sandbox.register)

# `live.agent_sandbox.register`

Generated at 2026-11-13 06:25:48 UTC from [`openvibe-contracts v0.419.0`](https://github.com/OpenVibers/OpenVibe.Contracts/tree/v0.419.0) and [`openvibe-sdk v0.161.0`](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.161.0).

Not grantable to apps (active, internal).

The chat plays sandbox worker checks in for the person it works for on OpenVibe.Live (Agent Streams S6): POST /api/streams/agent/:id/plays/worker. Only a first-party service token whose principal holds this capability may register one, and it names the person in X-OV-Subject, who must own the stream. The owner's own session, a desk ticket (wpt\_) and a person token are refused: an owner who could register a worker would declare their own unisolated machine a sandbox, and the gate would mean nothing. The body is live.agent-sandbox-worker-request@1, the worker's own report; Live requires isolation to say exactly host\_network false, credentials false, profile false, egress\_proxy true and workspace 'ephemeral', and refuses a worker that does not. Health comes only from a check-in within the last minute; Live stores no endpoint, never calls the worker and never accepts an isolation code it cannot read. The capability is internal because no person or app calls it: OpenVibe.Codes' sandbox worker holds it through its own Network service client for the audience openvibe.live.

- Owner: live (token audience `openvibe.live`)
- Version: 1.0
- Status: active
- Visibility: internal
- Resource constraints: owner
- Quota class: standard
- Permissions: live:write
- Input: [live.agent-sandbox-worker-request@1](/docs/contracts/live.agent-sandbox-worker-request)
- Output: live.agent-sandbox-worker-result@1
- Events: —
- Implemented by: - `POST /api/streams/agent/:id/plays/worker`

[These routes in the API explorer](/docs/api/live#cap-live.agent_sandbox.register)