Sandbox & environments
Every tenant is either sandbox or live. Sandbox is designed to be safe by construction so you can run the entire happy path without real-world side effects.
Sandbox guarantees
In a sandbox tenant, nothing you do:
- anchors on-chain (
anchorToBlockchainis effectivelyfalse), - sends production emails (they are simulated),
- submits to external registries or indexes publicly,
- bills — usage is metered with
is_billable = false.
Sandbox usage is metered with is_billable = false and guards fail closed. The webhook envelope is environment-neutral (id, type, timestamp, apiVersion, data) — the tenant, not a payload flag, is the sandbox/live boundary.
Isolation is intended, not yet fully proven. Systematic side-effect guards and sandbox watermarking are still being hardened (status Partial). Treat full isolation as the design contract; verify anything safety-critical yourself before relying on it.
Expiry
A sandbox tenant can expire. 403 SANDBOX_EXPIRED fires only when the tenant is both flagged sandbox and past its expiry date — extending the date restores access immediately. The date alone does nothing.
Going live
- Live requires MFA and completing the activation wizard gates.
- The identifier scheme locks at first live publish — changing it afterwards returns
409. Sandbox never locks, so experiment freely there. - Live webhooks require
httpsendpoints.