Skip to main content
The Sandbox runs the staging version of the SOXAI API at https://web-api.dev.soxai.site. Use it to evaluate an integration before requesting Production access.
Sandbox endpoints are under development. They may change or be removed without notice, and they may never be released to Production. Sandbox changes are not included in the Production changelog.

Create a Sandbox credential

Register an email address on Get a Sandbox API key. A link is emailed to you, and opening it issues your key and shows it once. Send the key in the soxai-api-key request header; see Authentication for credential-handling guidance. Registering the same address again replaces a key you have lost. Sandbox and Production credentials are separate. A Sandbox API key or ID token cannot authenticate against Production, and a Production credential cannot authenticate against Sandbox.

Data and behavior

Sandbox data is fixed test data. It is not customer data and must not be used to evaluate the freshness, completeness, or real-world distribution of Production data. The Sandbox and Production API schemas are documented separately because staging can contain endpoints that are not yet released. Even when their schemas match, some externally visible behavior is intentionally different:
  • Deep links can redirect to different destinations.
  • Email sender details and URLs in email messages can differ.
  • Sandbox rate limits are lower than Production limits.
Sandbox is also used for internal validation. Its behavior is not guaranteed to match Production beyond the contract shown in the Sandbox API reference.

What a Sandbox key can call

The Sandbox reference lists every operation the Sandbox build serves, but a Sandbox key reaches only these 15. They are all reads. Every other operation in the Sandbox reference is titled either Not callable with a Sandbox key or Not part of the Sandbox, and says which of the two it is and why:
  • Not callable with a Sandbox key. The endpoint accepts the soxai-api-key header, but a Sandbox key is refused with 403 This endpoint is not available in the sandbox. Anything that writes, sends email, or issues a credential is in this group, as are reads outside the 15 above - such as listing organizations or groups and /app/me.
  • Not part of the Sandbox. The endpoint takes no API key at all - sign-in, the OAuth2 flow, the health checks, the partner-company routes. A Sandbox key plays no part in it, and its behavior here is not part of the Sandbox contract.
Both groups are documented in the Sandbox reference because the Sandbox runs the same build as Production. Use them in Production.

Rate limits

Sandbox credentials allow up to 10 requests per minute and 300 requests per day. When the API returns 429 Too Many Requests, wait for the period indicated by Retry-After before retrying. See Rate limits for retry guidance.

Move to Production

When your integration is ready, request Production access. Production access is reviewed separately and requires a Production credential.