Sandbox & environments

Every tenant is either sandbox or live. Sandbox is designed to be safe by construction so you can run the entire happy path without real-world side effects.

Sandbox guarantees

In a sandbox tenant, nothing you do:

anchors on-chain (anchorToBlockchain is effectively false),
sends production emails (they are simulated),
submits to external registries or indexes publicly,
bills, usage is metered with is_billable = false.

Sandbox usage is metered with is_billable = false and guards fail closed. The webhook envelope is environment-neutral (id, type, timestamp, apiVersion, data), the tenant, not a payload flag, is the sandbox/live boundary.

Isolation is intended, not yet fully proven. Systematic side-effect guards and sandbox watermarking are still being hardened (status Partial). Treat full isolation as the design contract; verify anything safety-critical yourself before relying on it.

Expiry

A sandbox tenant can expire. 403 SANDBOX_EXPIRED fires only when the tenant is both flagged sandbox and past its expiry date, extending the date restores access immediately. The date alone does nothing.

Going live

Live requires MFA and completing the activation wizard gates.
The identifier scheme locks at first live publish, changing it afterwards returns 409. Sandbox never locks, so experiment freely there.
Live webhooks require https endpoints.

← PreviousErrors & conventions Next →Entity model