> ## Documentation Index > Fetch the complete documentation index at: https://docs.haau3.com/llms.txt > Use this file to discover all available pages before exploring further. # The Sandbox's capability statement > FHIR `[base]/metadata` at the Sandbox's FHIR base, `/v1/sandbox/fhir/r4`. Returns the Sandbox's own `CapabilityStatement`, which says what the Sandbox serves: today the pharmacy benefit check, `$process-message`, as CARIN's responder (STU2 ballot, `2.0.0-ballot`), receiving a member's request. It takes no parameters. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/sandbox/fhir/r4/metadata openapi: 3.1.0 info: title: haau3 Platform API version: 1.0.0-preview.23 description: >- The haau3 platform API is in preview: it may change as we build, usually to add features or improve performance. Endpoints require an API key, sent as `Authorization: Bearer `. Requests without a valid key return 401. Create a key in the dashboard at https://platform.haau3.com; a new organization starts on the free Developer plan. From 2026-11-02 a request past one of its plan's limits (requests a minute on every plan, requests a month on Developer) returns 429 with `Retry-After`. Every error under `/v1/fhir` is a FHIR `OperationOutcome` and every other error an RFC 9457 problem; https://docs.haau3.com/errors lists every status, whether to retry it, and what a method a path does not take answers. servers: - url: https://api.haau3.com description: Production security: - bearerAuth: [] tags: - name: Scheduling description: 'Provider availability (SMART Scheduling Links): slots and publishers.' - name: FHIR base description: >- What the FHIR R4 base at `/v1/fhir/r4` answers for every service on it: the `CapabilityStatement` that lists them all, and batch Bundles that carry several requests to any of them in one round trip. - name: Terminology description: >- FHIR terminology operations over the code systems listed in TerminologyCapabilities. Some are resolved from their own source when you ask; others are held here at a named release, which that resource also names. - name: Provider directory description: >- CMS's National Provider Directory as FHIR R4: practitioners and their roles, organizations, payers and insurance networks, network membership, healthcare services, locations and endpoints. Every parameter the service serves is declared here, and any other is refused by name rather than ignored. - name: Questionnaires description: >- FHIR Questionnaire, served as its source publishes it. This service holds copies of a curated set and reaches any other questionnaire its source publishes by canonical URL, as well as forms published at their own address under places this service is set up to reach. Read one by id, and build the QuestionnaireResponse in your own application. - name: Medical Benefits description: >- FHIR InsurancePlan: what a Medicare Advantage or ACA Marketplace plan covers and what a member pays, read from the files CMS publishes. Every plan names the CMS release it was read from. Read a plan by its id, or search by identifier, name, state or county, and check whether the CMS National Provider Directory lists providers in a plan's network. - name: Pharmacy Benefits description: >- The CARIN Consumer Real-Time Pharmacy Benefit Check as FHIR messaging: what a medication would cost a member under their coverage, or its price at pharmacies near a ZIP code, in real time, from the sources this service connects to. A member's request receives patient data, so send it only under an executed agreement. - name: MedList description: >- One reconciled medication list from one patient's FHIR medication records, as US Core MedicationRequests with a Provenance for each. This operation receives patient data, so send it only under an executed agreement. - name: Structured Sig description: >- A prescription's free-text directions as a FHIR Dosage: the dose, unit, route, method and timing coded in SNOMED CT, NCIt and UCUM where the words support them, the directions kept verbatim, and a review flag on anything a person should check. It takes the directions and the medication's codings, never a patient. - name: Sandbox description: >- The FHIR base without production behind it, to build and test against: the same paths at `/v1/sandbox/fhir/r4`, answered with synthetic data that always gives the same answer. Its first service is the CARIN Consumer Real-Time Pharmacy Benefit Check, answered by Example Health Plan, a test insurer. It takes a test key (`haau3_sk_test_…`), made on the API keys page, and each request counts like any other. Send test members only, never a real person. paths: /v1/sandbox/fhir/r4/metadata: get: tags: - Sandbox summary: The Sandbox's capability statement description: >- FHIR `[base]/metadata` at the Sandbox's FHIR base, `/v1/sandbox/fhir/r4`. Returns the Sandbox's own `CapabilityStatement`, which says what the Sandbox serves: today the pharmacy benefit check, `$process-message`, as CARIN's responder (STU2 ballot, `2.0.0-ballot`), receiving a member's request. It takes no parameters. operationId: sandboxMetadata parameters: - $ref: '#/components/parameters/XRequestId' responses: '200': description: The Sandbox's FHIR `CapabilityStatement`. content: application/fhir+json: schema: $ref: '#/components/schemas/CapabilityStatement' examples: The Sandbox's CapabilityStatement: summary: The Sandbox's CapabilityStatement value: resourceType: CapabilityStatement status: active date: '2026-10-27' publisher: haau3 kind: instance instantiates: - >- http://hl7.org/fhir/us/carin-rtpbc/CapabilityStatement/rtpbc-responder|2.0.0-ballot software: name: haau3 Sandbox implementation: description: >- haau3's Sandbox: the platform FHIR base's non-production twin, the same paths answered with synthetic data. It serves the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot), answered by Example Health Plan, haau3's test insurer, for its test members only, each outcome fixed by the medication. Send test members only, never a real person. url: https://api.haau3.com/v1/sandbox/fhir/r4 fhirVersion: 4.0.1 format: - application/fhir+json - json rest: - mode: server documentation: >- haau3's Sandbox: the platform FHIR base's non-production twin, the same paths answered with synthetic data. It serves the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot), answered by Example Health Plan, haau3's test insurer, for its test members only, each outcome fixed by the medication. Send test members only, never a real person. operation: - name: process-message definition: >- http://hl7.org/fhir/OperationDefinition/MessageHeader-process-message documentation: >- A member's pharmacy benefit check, answered by a test insurer: a CARIN request message in, a CARIN response message out. Test members only; any other member gets the error no-test-member. messaging: - documentation: >- haau3's Sandbox: the platform FHIR base's non-production twin, the same paths answered with synthetic data. It serves the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot), answered by Example Health Plan, haau3's test insurer, for its test members only, each outcome fixed by the medication. Send test members only, never a real person. supportedMessage: - mode: receiver definition: >- http://hl7.org/fhir/us/carin-rtpbc/MessageDefinition/rtpbc-request headers: Cache-Control: description: '`private, max-age=300`: keep this answer up to five minutes.' schema: type: string ETag: description: >- Send it back in `If-None-Match` to get a `304` when nothing has changed. schema: type: string X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' '304': description: >- Not modified: the `ETag` sent in `If-None-Match` still matches, so the copy you hold is current. No body. headers: Cache-Control: description: '`private, max-age=300`: keep this answer up to five minutes.' schema: type: string ETag: description: >- Send it back in `If-None-Match` to get a `304` when nothing has changed. schema: type: string X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' '400': description: >- Two different FHIR versions were named in one request, or a query parameter was sent: `metadata` takes none on this base. content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' '401': $ref: '#/components/responses/FhirUnauthorized' '403': $ref: '#/components/responses/FhirForbiddenLiveKey' '406': $ref: '#/components/responses/FhirNotAcceptable' '429': $ref: '#/components/responses/FhirTooManyRequests' '500': $ref: '#/components/responses/FhirServerError' '503': $ref: '#/components/responses/FhirUnavailable' x-codeSamples: - lang: bash label: cURL source: | curl "https://api.haau3.com/v1/sandbox/fhir/r4/metadata" \ -H "Authorization: Bearer $HAAU3_API_KEY" - lang: typescript label: TypeScript source: | import { Haau3 } from "@haau3/sdk"; const haau3 = new Haau3(); // reads HAAU3_API_KEY const capabilityStatement = await haau3.sandboxMetadata(); console.log(capabilityStatement.resourceType); - lang: python label: Python source: | from haau3 import Haau3 client = Haau3() # reads HAAU3_API_KEY capability_statement = client.sandbox_metadata() print(capability_statement["resourceType"]) - lang: go label: Go source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\n\t\"github.com/haau3/haau3-go\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclient, err := haau3.NewClient() // reads HAAU3_API_KEY\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tcapabilityStatement, err := client.SandboxMetadata(ctx)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tfmt.Println(capabilityStatement.ResourceType())\n}\n" components: parameters: XRequestId: name: X-Request-Id in: header required: false schema: type: string format: uuid description: >- An id of your own for this request, as a UUID. It comes back in the `X-Correlation-Id` header and is kept with haau3's record of the request. Any value that is not a UUID is ignored. See https://docs.haau3.com/errors#request-ids. schemas: CapabilityStatement: type: object description: >- A FHIR R4 [CapabilityStatement](https://hl7.org/fhir/R4/capabilitystatement.html). properties: resourceType: type: string const: CapabilityStatement required: - resourceType additionalProperties: true OperationOutcome: type: object description: >- A FHIR R4 [OperationOutcome](https://hl7.org/fhir/R4/operationoutcome.html). properties: resourceType: type: string const: OperationOutcome issue: type: array items: type: object properties: severity: type: string enum: - fatal - error - warning - information code: type: string details: type: object properties: text: type: string additionalProperties: true diagnostics: type: string expression: type: array items: type: string required: - severity - code additionalProperties: true required: - resourceType - issue headers: XRequestId: description: >- The id haau3 gave this request, a UUID, on every response. Quote it in a question about the response. A problem carries the same id as its `instance`. schema: type: string format: uuid XCorrelationId: description: The `X-Request-Id` you sent, when it was a UUID. schema: type: string format: uuid responses: FhirUnauthorized: description: Missing or invalid API key. content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: WWW-Authenticate: description: >- The scheme to authenticate with: `Bearer realm="api.haau3.com"`, with `error="invalid_token"` when a key was sent and not recognised. schema: type: string X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' FhirForbiddenLiveKey: description: >- A live key (`haau3_sk_live_…`) does not work in the Sandbox, so one sent here is refused before the request runs: coded `forbidden`, with `live-key-in-sandbox` from `https://haau3.com/fhir/CodeSystem/api-error` in `issue.details.coding`. Send a test key. headers: WWW-Authenticate: description: >- Sent when the API key works only in the other mode: `Bearer realm="api.haau3.com", error="insufficient_scope"`. schema: type: string X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' examples: A live key in the Sandbox: summary: A live key in the Sandbox value: resourceType: OperationOutcome issue: - severity: error code: forbidden details: coding: - system: https://haau3.com/fhir/CodeSystem/api-error code: live-key-in-sandbox display: Live key in the Sandbox text: >- This is a live key, which does not work in the Sandbox. Send this request with a test key; create one in the dashboard. See https://docs.haau3.com/authentication#test-and-live-keys FhirNotAcceptable: description: >- The request asked for a format other than JSON (`Accept` or `_format`), or for a FHIR release this endpoint does not serve (the `fhirVersion` media-type parameter). content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' FhirTooManyRequests: description: >- A limit of the organization's plan was reached: its requests a minute, or the Developer plan's requests a month. Send the request again after `Retry-After`, which for the monthly limit runs to the 1st of the next month (UTC). content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: Retry-After: description: How many seconds to wait before sending the request again. schema: type: integer minimum: 0 X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' FhirServerError: description: The server failed to process this request. content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' FhirUnavailable: description: >- The API key could not be checked just now. Send the request again after `Retry-After`. content: application/fhir+json: schema: $ref: '#/components/schemas/OperationOutcome' headers: Retry-After: description: How many seconds to wait before sending the request again. schema: type: integer minimum: 0 X-Request-Id: $ref: '#/components/headers/XRequestId' X-Correlation-Id: $ref: '#/components/headers/XCorrelationId' securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your platform API key, sent as `Authorization: Bearer `: a live key (`haau3_sk_live_…`) for every service, or a test key (`haau3_sk_test_…`) for the Sandbox, the one place a test key works and a live key does not. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.