Invoke an immutable saved Function candidate in the Evaluation sandbox

POST/v1/evaluations/runs/{runId}/function-candidates/{candidateId}/invoke

Internal workload endpoint for the exact leased Evaluation run. The control plane verifies the run, case, target version, candidate and objective fingerprints, source-asset digests, invocation contract, and active lease before executing the saved Function snapshot. Candidate code runs non-root in an ephemeral resource-limited container with no network, platform bindings, runtime credentials, or writable root filesystem. It never invokes or changes the production deployment.

How to call this endpoint

Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.

Path, query, and header parameters

These parameters control which ACP object the endpoint acts on and how the request is processed.

Path parameters
NameLocationTypeRequiredDescription
runIdpathstringYes—
candidateIdpathstringYes—
Query parameters
None.

Body schema

Content type: application/json · Required

FieldTypeRequiredDescription
caseIdstringYes—
methodGET | POST | PUT | PATCH | DELETEYes—
pathstringYesWorkspace-relative file path.
bodyobjectYesExact immutable Evaluation case payload, including any digest-verified inline source assets.
executionLeaseobjectYes—
executionLease.ownerstringYes—
executionLease.tokenstringYes—

What the API returns

Each response code below includes the documented payload shape for the ACP API.

200Isolated Function result and execution evidenceapplication/json
FieldTypeRequiredDescription
statusintegerYesCurrent lifecycle status.
okbooleanYes—
headersobjectYes—
bodyobjectYes—
candidateIdstringYes—
candidateVersionIdstringYes—
candidateFingerprintstringYes—
sandboxContractFingerprintstringYes—
durationMsintegerYes—
executionobjectYes—
execution.schemaVersioncomputer_agents_function_candidate_sandbox_execution_v1Yes—
execution.sandboxContractFingerprintstringYes—
execution.candidateFingerprintstringYes—
execution.imageBuildFingerprintstringYes—
execution.runtimeProviderlocal_docker | runtime_daemonYes—
execution.stdoutBytesintegerYes—
execution.stderrBytesintegerYes—
execution.stdoutSha256stringYes—
execution.stderrSha256stringYes—
400Invalid invocation request
None.
401Missing or invalid workload credential
None.
403Credential is not the exact Evaluation workload
None.
404Run
None.
409Lease
None.
413Invocation exceeds the sandbox input boundary
None.
502Candidate build or isolated execution failed
None.
503Isolated runtime host is unavailable
None.
Invoke an immutable saved Function candidate in the Evaluation sandbox
Loading...
Response 200
Loading...
See the ACP quickstart and SDK flow