Sandbox

What Sandbox is#

Sandbox is a separate Veriticity environment at https://sandbox.veriticity.com, with its own agents, policies, budgets, API keys, webhooks and purchase history. Use it to try policies, agents and purchasing workflows without making real purchases.

Purchases in Sandbox are decided exactly as they are in Production: the same rules produce the same outcome, approvals escalate to a person in the same way, and every decision is explained in the same terms. Nothing you do in Sandbox affects Production.

Getting in#

There is no separate Sandbox account and no Sandbox password.

1. Sign in at https://app.veriticity.com.
2. Open the environment switcher in the sidebar and choose Sandbox.
3. You arrive in the Sandbox dashboard, already signed in, with a banner that reads “Real purchases cannot be made here.”

Your email address must be confirmed first. To go back, choose Production in the same switcher; you stay signed in to both.

What comes with you#

Each time you switch to Sandbox, a few details are brought across from Production. Nothing else is, and nothing goes back.

So a name changed in Production appears in Sandbox the next time you switch. Anything you create or change in Sandbox stays in Sandbox.

API keys#

Sandbox keys are issued in the Sandbox dashboard, in the same way and with the same two kinds described in Authentication. They start with cmp_test_.

A key only works in the environment that issued it. A cmp_test_ key sent to Production, or a cmp_live_ key sent to Sandbox, is refused before it is looked up, and the message names the address it belongs to:

HTTP/1.1 401 Unauthorized

{
  "error": {
    "code": "wrong_environment",
    "message": "This is a Sandbox key. Send Sandbox requests to https://sandbox.veriticity.com."
  }
}

Fix the base URL rather than the key. Retrying the same request will get the same answer.

Calling the API#

Every endpoint in the API reference is served from the Sandbox address at the same path, and returns the same shapes and the same errors.

curl https://sandbox.veriticity.com/v1/agents \
  -H "Authorization: Bearer cmp_test_9f2a1c4b7e30.<secret>"

With the TypeScript SDK, pass the Sandbox address as baseUrl. It defaults to Production.

import { Veriticity } from "@veriticity/sdk";

// Keep the base URL and the key together, so one can never be switched
// without the other.
const veriticity = new Veriticity({
  apiKey: process.env.VERITICITY_API_KEY!, // cmp_test_ in Sandbox
  baseUrl: process.env.VERITICITY_BASE_URL, // https://sandbox.veriticity.com
});

Webhooks#

Webhook endpoints are registered separately in each environment. An endpoint registered in Sandbox receives Sandbox events only, signed with its own secret; Production endpoints never receive them.

Event payloads have the same shape in both environments, so point Sandbox at a different receiving URL from Production. Signature verification works exactly as described in Webhooks.

Resetting Sandbox#

An organisation owner can reset Sandbox from Settings in the Sandbox dashboard. It can’t be undone, and it takes effect immediately.

Reset and load examples does the same, then adds an agent called Example Shopping Agent and an active policy called Example spending rules: purchases over 100 need approval, purchases over 500 are blocked, and spending is capped at 1,000 a month, in the organisation’s currency. It adds no purchase history.