Invoke an immutable saved Function candidate in the Evaluation sandbox

POST/v1/evaluations/runs/{runId}/function-candidates/{candidateId}/invoke

Internal workload endpoint for the exact leased Evaluation run. The control plane verifies the run, case, target version, candidate and objective fingerprints, source-asset digests, invocation contract, and active lease before executing the saved Function snapshot. Candidate code runs non-root in an ephemeral resource-limited container with no network, platform bindings, runtime credentials, or writable root filesystem. It never invokes or changes the production deployment.

How to call this endpoint

Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.

Path, query, and header parameters

These parameters control which ACP object the endpoint acts on and how the request is processed.

Path parameters
NameLocationTypeRequiredDescription
runIdpathstringYes
candidateIdpathstringYes
Query parameters
None.

Body schema

Content type: application/json · Required

FieldTypeRequiredDescription
caseIdstringYes
methodGET | POST | PUT | PATCH | DELETEYes
pathstringYesWorkspace-relative file path.
bodyobjectYesExact immutable Evaluation case payload, including any digest-verified inline source assets.
executionLeaseobjectYes
executionLease.ownerstringYes
executionLease.tokenstringYes

What the API returns

Each response code below includes the documented payload shape for the ACP API.

200Isolated Function result and execution evidenceapplication/json
FieldTypeRequiredDescription
statusintegerYesCurrent lifecycle status.
okbooleanYes
headersobjectYes
bodyobjectYes
candidateIdstringYes
candidateVersionIdstringYes
candidateFingerprintstringYes
sandboxContractFingerprintstringYes
durationMsintegerYes
executionobjectYes
execution.schemaVersioncomputer_agents_function_candidate_sandbox_execution_v1Yes
execution.sandboxContractFingerprintstringYes
execution.candidateFingerprintstringYes
execution.imageBuildFingerprintstringYes
execution.runtimeProviderlocal_docker | runtime_daemonYes
execution.stdoutBytesintegerYes
execution.stderrBytesintegerYes
execution.stdoutSha256stringYes
execution.stderrSha256stringYes
400Invalid invocation request
None.
401Missing or invalid workload credential
None.
403Credential is not the exact Evaluation workload
None.
404Run
None.
409Lease
None.
413Invocation exceeds the sandbox input boundary
None.
502Candidate build or isolated execution failed
None.
503Isolated runtime host is unavailable
None.
Invoke an immutable saved Function candidate in the Evaluation sandbox
Loading...
Response 200
Loading...
See the ACP quickstart and SDK flow