Sandbox

The sandbox is a separate organization on the staging instance, pre-loaded with synthetic study, site, participant, and ePRO data. It behaves exactly like a real organization from the API's point of view: same endpoints, same authentication, same scopes, same rate limits — but everything in it is fake. Nothing you do in the sandbox can touch production studies, participants, or exports, and production data never appears in the sandbox.

• Self-serve: you request sandbox credentials yourself, with no approval cycle.
• Synthetic data only: every participant, consent, and response in the sandbox is fabricated test data.
• Isolated: org scoping applies to the sandbox like anywhere else — sandbox tokens cannot reach other organizations, and production tokens cannot reach the sandbox.
• Resettable: synthetic data can be re-seeded, so automated test suites can run repeatedly against a known state.

Sandbox API clients are issued the same way as production clients: an administrator creates an API client for the sandbox organization from the admin interface (see getting started) and the credentials are shown once at creation. To get a sandbox client:

• Contact the platform team and ask for a sandbox API client — include the company name and the scopes you plan to test.
• You will receive a client ID and a one-time client secret for the sandbox organization.
• Exchange them for tokens exactly as documented in authentication — the base URL for the sandbox is the staging host, not the production host.

Keep sandbox and production clients separate: a client issued for the sandbox works only in the sandbox, and vice versa. Never point a production integration at the sandbox or a sandbox integration at production.

The sandbox mirrors the API contract, including error formats, pagination, rate-limit headers, and webhook signatures. What it does not simulate is scale or real-world data distributions: synthetic participants follow fabricated patterns, and performance under production data volumes will differ. Validate latency-sensitive behavior against realistic volumes with the platform team before go-live.

Webhook deliveries in the sandbox work end-to-end: register an endpoint, trigger events through the API, and receive signed deliveries exactly as production would send them.