which parts of the above code/api allow access outside of the sandbox?