API reference
Full cloud computers your agents can see, control, and operate. Create a machine, watch its screen, click and type on it, run commands inside it, and snapshot it.
Base URL https://app.mandala.computer/api/v1
Quick start
Pick an image, make a computer, inspect its screen, act, then delete it. These examples require curl and your API key.
# 1. Pick a template.
base_url="${MANDALA_BASE_URL:-}"
if [ -z "$base_url" ]; then base_url='https://app.mandala.computer/api/v1'; fi
curl --fail-with-body "${base_url%/}"'/templates' \
-H "Authorization: Bearer $MANDALA_API_KEY"
# 2. Create a computer. Read its id from the response.
base_url="${MANDALA_BASE_URL:-}"
if [ -z "$base_url" ]; then base_url='https://app.mandala.computer/api/v1'; fi
curl --fail-with-body -X POST "${base_url%/}"'/computers' \
-H "Authorization: Bearer $MANDALA_API_KEY" \
-H "Content-Type: application/json" \
--data-raw '{"name":"scratch","template":"base","resolution":"1920x1080x24","start":true}'
# 3. Replace the illustrative computer ID below with that new id.
base_url="${MANDALA_BASE_URL:-}"
if [ -z "$base_url" ]; then base_url='https://app.mandala.computer/api/v1'; fi
curl --fail-with-body "${base_url%/}"'/computers/vm-a1b2c3d4e5f6/screenshot' \
-H "Authorization: Bearer $MANDALA_API_KEY" \
-o screen.png
# 4. Click in its screen coordinates.
base_url="${MANDALA_BASE_URL:-}"
if [ -z "$base_url" ]; then base_url='https://app.mandala.computer/api/v1'; fi
curl --fail-with-body -X POST "${base_url%/}"'/computers/vm-a1b2c3d4e5f6/input' \
-H "Authorization: Bearer $MANDALA_API_KEY" \
-H "Content-Type: application/json" \
--data-raw '{"action":"left_click","x":640,"y":400}'
# 5. Delete the computer and its disk when no longer needed. This does not cancel or reduce a monthly subscription.
base_url="${MANDALA_BASE_URL:-}"
if [ -z "$base_url" ]; then base_url='https://app.mandala.computer/api/v1'; fi
curl --fail-with-body -X DELETE "${base_url%/}"'/computers/vm-a1b2c3d4e5f6' \
-H "Authorization: Bearer $MANDALA_API_KEY"Coordinates are absolute, in the screen space a computer’s resolution reports. That is the same space screenshots come back in, so a model can be handed the picture and its answer forwarded unchanged.
Using the API
- SDKsThe Python and TypeScript packages, and the CLI shell.
- MCP serverGive an agent the API as tools, hosted or run locally.
- AuthenticationAPI keys, the roles they carry, and the HTTP conventions.
- SecretsHow a stored secret reaches a computer, and when.
- ErrorsThe failure shape, and what each status means.
Endpoints
- AccountEffective plan ceilings and advisory remaining quota. One endpoint.
- TemplatesWhat a computer can be built from, and the sizes it can be built at. 7 endpoints.
- BuildsCompiling a template document into an image of your own. 5 endpoints.
- ComputersCreating machines, and their lifecycle. 13 endpoints.
- MovesWhen a resize needs a bigger host than the one the computer is on. 2 endpoints.
- ControlDriving the desktop: what is on screen, and acting on it. 14 endpoints.
- Retained resultsExplicit immutable output prefixes, independent of volatile execution handles. 8 endpoints.
- Platform signalsPassive, ephemeral daemon observations with bounded replay. One endpoint.
- ActivitiesSafe retained summaries of selected API actions. 3 endpoints.
- AgentsOne call that drives a computer until the task is done, the threads that continue it, and runs in the background. 9 endpoints.
- FilesMoving files in and out of the guest. 6 endpoints.
- SnapshotsCapturing a computer, and building from a capture. 6 endpoints.
- SchedulesAutomatic snapshots: when they are taken, and how long they are kept. 4 endpoints.
- UsageWhat the account has used, and how much of it has settled for billing. 2 endpoints.
- WebhooksBeing told when something happens, instead of asking. Deliveries are signed with the Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature); acknowledge with a 2xx within 10 seconds. 8 endpoints.
- SSHYour SSH keys, and which computers accept them. 5 endpoints.
- Public URLsA port inside a computer, served on its own HTTPS address. A deployment can switch the feature off, for every account or for all but some: making or changing one is then a 404 with code PUBLIC_URLS_DISABLED, while listing (enabled: false) and deleting still work. 4 endpoints.
- SecretsCredentials the account stores once and binds to computers. Values go in and never come out. 8 endpoints.
- API keysWho a key is, and minting and revoking keys from a key the dashboard allowed to. 4 endpoints.
- OperationsOne id to wait on for any lifecycle call, whether it finished before answering or runs on after. 2 endpoints.
- WorkspacesThe partitions of the account a key can be confined to, and the people who reach them. 6 endpoints.
- TypesThe shapes the responses are made of.
Guides
Connecting a model or an agent framework to a computer, running Hermes and OpenClaw, moving from Orgo or E2B, hosting an agent, and troubleshooting: all guides.