A sandbox held by the abuse checks keeps its files readable

You can read and download a held sandbox's files with GET /v1/sandboxes/{id}/files/content or GET /v1/sandboxes/{id}/files/archive. A read wakes the sandbox if it is paused, and it can also be woken or started. Previously, every wake and start of a held sandbox returned sandbox_halted (403), so its files could not be read. While the hold is in place, the sandbox's network is off for outbound and inbound traffic (previews, custom domains, TCP ports and private networks), and commands, terminals, file writes, snapshots and forks return sandbox_halted (403). See Network access.