> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tera.health/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox

> What the sandbox checks, and what it leaves to the real API.

The sandbox at `https://sandbox.rx.tera.health` is a mock server built from the contract. It lets you build your integration before the API is live.

## What it does

* Answers every `/v1` operation with the examples in the [API reference](https://docs.tera.health/api-reference/auth/get-an-access-token.md).
* Validates requests against the contract. A request that breaks it (a missing field, a wrong type, a value outside its range) gets `422` or `400`. The body is the contract's example problem, not a description of your mistake; the real API names the field.
* Requires a token where the real API does: a call with no `Authorization: Bearer` header gets `401`.

## What it doesn't do

> [!WARNING]
>
> The sandbox accepts **any** well-formed bearer token. It doesn't check signatures, scopes, assertion claims or webhook secrets. The real API checks all of them, so test your signing code with the [samples](https://docs.tera.health/samples.md).

* It stores nothing. Each call answers like the first: a retried `Idempotency-Key` isn't replayed, and a created enrollment can't be read back.
* It sends no webhooks. Test your receiver with the worked example in the [Webhooks](https://docs.tera.health/guides/webhooks.md) guide.
* It isn't rate limited per client, though the sandbox as a whole is protected against abuse.

## The playground

Every page in the API reference has a **Try it** button on the request bar under the operation's description. Its panel opens filled in with the page's example and a sandbox token, and calls the sandbox, so **Send** works as it opens. To use a mock on your own machine, pick `http://localhost:4010` in the server list. Change any field to see how the mock validates it.

## Data

Use synthetic data only: example.com emails, 555-01xx phone numbers, made-up names. Never send real patient data to the sandbox.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.