Sandbox

What Sandbox is#

Sandbox is a separate Veriticity environment at https://sandbox.veriticity.com, with its own agents, policies, budgets, API keys, webhooks and purchase history. Use it to try policies, agents and purchasing workflows without making real purchases.

Everything else is Live, at https://app.veriticity.com. Purchases in Sandbox are decided exactly as they are in Live: the same rules produce the same outcome, approvals escalate to a person in the same way, and every decision is explained in the same terms. Nothing you do in Sandbox affects Live.

Getting in#

There is no separate Sandbox account and no Sandbox password.

1. Sign in at https://app.veriticity.com.
2. Open the environment switcher in the sidebar and choose Sandbox.
3. You arrive in the Sandbox dashboard, already signed in, with a banner that reads “Real purchases cannot be made here.”

Your email address must be confirmed first. To go back, choose Live in the same switcher; you stay signed in to both. If Sandbox has policies, agents or AI connections, you are asked whether to copy them to Live first — see Copying your setup to Live.

What comes with you#

Each time you switch to Sandbox, a few details are brought across from Live. Nothing else is, and nothing goes back on its own.

So a name changed in Live appears in Sandbox the next time you switch. Anything you create or change in Sandbox stays in Sandbox unless you choose to copy it.

API keys#

Sandbox keys are issued in the Sandbox dashboard, in the same way and with the same two kinds described in Authentication. They start with cmp_test_.

A key only works in the environment that issued it. A cmp_test_ key sent to Live, or a cmp_live_ key sent to Sandbox, is refused before it is looked up, and the message names the address it belongs to:

HTTP/1.1 401 Unauthorized

{
  "error": {
    "code": "wrong_environment",
    "message": "This is a Sandbox key. Send Sandbox requests to https://sandbox.veriticity.com."
  }
}

Fix the base URL rather than the key. Retrying the same request will get the same answer.

Calling the API#

Every endpoint in the API reference is served from the Sandbox address at the same path, and returns the same shapes and the same errors.

curl https://sandbox.veriticity.com/v1/agents \
  -H "Authorization: Bearer cmp_test_9f2a1c4b7e30.<secret>"

With the TypeScript SDK, pass the Sandbox address as baseUrl. It defaults to Live, and a cmp_test_ key with Live’s address is refused when the client is created.

import { Veriticity } from "@veriticity/sdk";

// Keep the base URL and the key together, so one can never be switched
// without the other.
const veriticity = new Veriticity({
  apiKey: process.env.VERITICITY_API_KEY!, // cmp_test_ in Sandbox
  baseUrl: process.env.VERITICITY_BASE_URL, // https://sandbox.veriticity.com
});

Connecting an AI assistant#

Sandbox has its own MCP endpoint, https://sandbox.veriticity.com/mcp, and its own connections. An assistant added with that address signs in through Sandbox and acts as a Sandbox agent, under Sandbox policies and budgets.

• If you are not already in Sandbox when the assistant asks you to sign in, you sign in to Veriticity and are brought back to finish connecting.
• Every tool works as it does in Live: checks, requests, approvals, cancelling and reading purchases back. get_agent returns "environment": "sandbox".
• A Sandbox connection’s token is not accepted by Live, and a Live token is not accepted by Sandbox.
• Nothing decided in Sandbox authorises a real purchase. To use an assistant for real purchases, add the Live endpoint to it as a separate connection.

See MCP for the tools.

Webhooks#

Webhook endpoints are registered separately in each environment. An endpoint registered in Sandbox receives Sandbox events only, signed with its own secret; Live endpoints never receive them.

Event payloads have the same shape in both environments, so point Sandbox at a different receiving URL from Live. Signature verification works exactly as described in Webhooks.

Copying your setup to Live#

When you switch back to Live from a Sandbox that has policies, agents or AI connections, Veriticity asks whether to bring them with you. Choose what to copy and select Review in Live, or continue without copying anything.

Nothing is copied until you review the list in Live and select Copy to Live. Sandbox stays as it is.

• Nothing in Live is overwritten. If a name is already taken, the copy is named with (Sandbox) after it, and the review shows the name first.
• Copying the same item again does nothing; it is reported as already in Live.
• A policy that applies to particular agents is copied only if those agents are in Live too.
• Each item is copied only if your role in Live allows you to create it.
• Copied agents count toward your Live plan’s agent limit. If they would pass it, nothing is copied.
• Budgets, purchase history, approvals and policy history are never copied.
• A review you don’t finish expires after an hour.

Resetting Sandbox#

An organisation owner can reset Sandbox from Settings in the Sandbox dashboard. It can’t be undone, and it takes effect immediately.

Reset and load examples does the same, then adds an agent called Example Shopping Agent and an active policy called Example spending rules: purchases over 100 need approval, purchases over 500 are blocked, and spending is capped at 1,000 a month, in the organisation’s currency. It adds no purchase history.