diff --git a/backend/request.hurl b/backend/request.hurl
new file mode 100644
index 0000000..fe8e6fa
--- /dev/null
+++ b/backend/request.hurl
@@ -0,0 +1,12 @@
+POST http://localhost:8080/v1/exec
+content-type: application/json
+origin: https://codapi.org
+```
+{
+    "sandbox": "hare",
+    "command": "run",
+    "files": {
+        "": "use fmt;\nexport fn main() void = {\nfmt::println(\"hello world\")!;\n};\n"
+    }
+}
+```
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 7666cf4..23fbf04 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -1,7 +1,6 @@
-mod sandbox;
-
-/*
 use std::collections::HashMap;
+use std::time::Instant;
+
 use axum::{
     extract::MatchedPath,
     http::{Request, StatusCode},
@@ -13,6 +12,8 @@ use tower_http::trace::TraceLayer;
 use tracing::info_span;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
+mod sandbox;
+
 #[derive(Default, Debug, Clone, PartialEq, Deserialize)]
 pub struct ExecRequest {
     pub sandbox: String,
@@ -24,18 +25,28 @@ pub struct ExecRequest {
 pub struct ExecResponse {
     pub id: String,
     pub ok: bool,
-    pub duration: i64,
+    pub duration: u64,
     pub stdout: String,
     pub stderr: String,
 }
 
 async fn exec(Json(req): Json<ExecRequest>) -> (StatusCode, Json<ExecResponse>) {
+    let code = req.files.get("").unwrap();
+
+    let now = Instant::now();
+    let output = sandbox::run_code(code);
+
+    let duration = now.elapsed().as_millis() as u64;
+    let ok = output.status.success();
+    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
+
     let resp = ExecResponse {
         id: "random".to_string(),
-        ok: true,
-        duration: 10,
-        stdout: "none".to_string(),
-        stderr: "".to_string(),
+        ok,
+        duration,
+        stdout,
+        stderr,
     };
 
     (StatusCode::OK, Json(resp))
@@ -74,23 +85,3 @@ async fn main() {
     tracing::debug!("listening on {}", listener.local_addr().unwrap());
     axum::serve(listener, app).await.unwrap();
 }
-*/
-
-fn main() {
-    sandbox::run_code(r#"
-use fmt;
-
-export fn main() void = {
-        const greetings = [
-                "Hello, world!",
-                "¡Hola Mundo!",
-                "Γειά σου Κόσμε!",
-                "Привіт, світ!",
-                "こんにちは世界！",
-        ];
-        for (let i = 0z; i < len(greetings); i+= 1) {
-                fmt::println(greetings[i])!;
-        };
-};
-        "#);
-}
diff --git a/backend/src/sandbox.rs b/backend/src/sandbox.rs
index e8c26e5..f4d444e 100644
--- a/backend/src/sandbox.rs
+++ b/backend/src/sandbox.rs
@@ -106,7 +106,7 @@ fn getids() -> (u32, u32) {
     unsafe { (libc::getuid(), libc::getgid()) }
 }
 
-pub fn run_code(code: &str) {
+pub fn run_code(code: &str) -> std::process::Output {
     let (uid, gid) = getids();
 
     let mut bwrap_cmd = Command::new("bwrap");
@@ -131,9 +131,5 @@ pub fn run_code(code: &str) {
     bwrap_cmd.args(cmd_args);
 
     let output = bwrap_cmd.output().expect("running bwrap failed");
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let stderr = String::from_utf8_lossy(&output.stderr);
-
-    println!("stdout:\n{stdout}");
-    println!("stderr:\n{stderr}");
+    output
 }