Vertex AI Agent Engine sandbox `:execute` returning 404 NOT_FOUND in us-central1

[arryon]

Summary

Since 2026-04-28 ~18:51 UTC, calls to the Vertex AI Agent Engine sandbox :execute endpoint return 404 NOT_FOUND ("Requested entity was not found.") for newly created sandboxes in us-central1. The sandbox is verified to be in STATE_RUNNING immediately before the failing call. Affects both production and staging projects, consistent with a server-side rollout.

Versions

• google-cloud-aiplatform==1.133.0
• google-genai==1.73.1
• google-adk==1.29.0
• Python 3.11

Repro

client.agent_engines.sandboxes.execute_code(...) posts:

POST https://us-central1-aiplatform.googleapis.com/v1/<sandbox>/:execute
Content-Type: application/json

{ "inputs": [{ "mimeType": "application/json",
               "data": "<base64 of {\"code\":\"...\"}>" }] }

Manual probing confirms :execute is reachable and validates input:

Body	HTTP
{"inputs":[{"mimeType":"application/json","data":<...>}]} (current SDK shape)	404
{"inputs":[{"mimeType":"text/x-python","data":<...>}]}	400 INVALID_ARGUMENT
{"inputs":[{"mimeType":"text/plain","data":<...>}]}	400 INVALID_ARGUMENT
{"inputData": ...} (legacy)	400, "Unknown name 'inputData'"
{"code": "..."}	400, "Unknown name 'code'"
Legacy :executeCode	404 (empty body)

Additional findings

1. Race / propagation ruled out. Re-running with a 10s wait after STATE_RUNNING reproduces the same 404.
2. GET <sandbox> returns only name, displayName, createTime, updateTime, state, spec, expireTime. No connectionInfo field. Per commit 677b55e, SandboxEnvironmentConnectionInfo is where routing_token lives in the new schema. The server isn't returning that block, so no client (old or new) has anything to forward.
3. HEAD-of-main SDK reproduces the same 404. Built python-aiplatform from main at HEAD (commit 0bb2ecd, past 677b55e), called execute_code() against a fresh staging sandbox in STATE_RUNNING. Result was identical: ClientError 404 NOT_FOUND. {'error': {'code': 404, 'message': 'Requested entity was not found.', 'status': 'NOT_FOUND'}}. The HEAD SDK still emits the mimeType=application/json shape because the server never populates connectionInfo.
4. The reproducer ran as the same service account our live staging Cloud Run service runs as, ruling out an IAM artefact specific to a probing identity.

Hypothesis

A server-side rollout to :execute in us-central1 on or around 2026-04-28T18:00 UTC changed the contract to require routing information that the API does not currently expose on the sandbox GET payload. The fix may need to ship server-side.

Asks

1. Can you confirm whether a server-side change to Agent Engine sandbox :execute was rolled out in us-central1 on/around 2026-04-28T18:00 UTC.
2. Any interim server-side workaround / route still accepting the previous shape?

Tracked internally on Google IssueTracker 507490536.