https://sandbox.haau3.com: the same paths
as production, https://api.haau3.com, on a host of its own, to build and test against. It is an
environment, not a service. Every service’s operations answer there, so a client moves between the
two by changing the host, or, with the SDKs, its key.
The FHIR base in the Sandbox is
https://sandbox.haau3.com/v1/fhir/r4, and Scheduling is at
https://sandbox.haau3.com/v1/scheduling.
Your first call
No account is needed. This is the quickstart’s search for open appointments, which makes the same call with each SDK:Calling with no key
The Sandbox answers a request with no key at all, so you, or your coding agent, can make a first call before signing up.- 30 requests an hour from each IP address, an IPv6 address counted by its
/64. The 31st is a429with aRetry-Afterheader, which runs to the end of that address’s hour. A batch counts one request for each of its entries, and one the hour cannot hold is a429before any entry runs. A free test key raises the limit to your plan’s requests a minute. - A request body is read up to 1 MiB. A larger one is a
413. - No key means no
Authorizationheader and nox-api-keyheader. A key that is not a working test key, or one sent any other way thanAuthorization: Bearer, is a401, never served as a call with no key. An IP address (an IPv6 address by its/48) that sends 30 keys within an hour that are not recognised gets a429for its keyed requests until that hour ends. - A call with no key is not recorded against any organization, so it shows on no Usage page.
With a test key
A test key looks likehaau3_sk_test_…. Make one free on the dashboard’s API keys page by choosing
Test (see test and live keys). In the Sandbox it raises the
limit to your plan’s requests a minute, counted apart from your production requests, and its
requests never count toward your plan’s month. The Usage page shows them as one line beside your
services.
A test key works only in the Sandbox, and a live key never does: a live key sent here is a 403
coded live-key-in-sandbox, and a key made before test keys is a 401 here.
With the SDKs
Each SDK sends every call to the environment its key’s mode names: a test key to the Sandbox, a live key to production, soHAAU3_API_KEY alone moves an app from one to the
other. To call the Sandbox with no key, leave HAAU3_API_KEY unset and name it: environment: "sandbox" in TypeScript and Python, haau3.WithEnvironmentSandbox() in Go, or
HAAU3_ENVIRONMENT=sandbox for any of them.
What it answers
Each operation answers its documented example request with a fixed answer: the answer production gave when the example was saved, with every link to production’s FHIR base naming the Sandbox’s instead, and a search’snext link left out, since the Sandbox has one page. Any other request returns 400
coded not-the-example, which names the example to send. The public-data
examples are fixed answers; the pharmacy benefit check and MedList answer with synthetic data. For
anything else, call production with a live key.
Scheduling
FHIR base
Terminology
Provider directory
Questionnaires
Medical Benefits
Pharmacy Benefits
MedList
Structured Sig
Test data only
Every answer fromsandbox.haau3.com carries
Link: <https://platform.haau3.com/terms>; rel="terms-of-service", its CapabilityStatement says so
in its description, and every refusal adds an issue of severity information, or a problem’s
terms member, that says it. Nothing you send is stored.
The first address
Before the Sandbox had a host of its own, it answered athttps://api.haau3.com/v1/sandbox/fhir/r4
with a test key: metadata and the pharmacy benefit check. That address is deprecated, and so are
the SDKs’ sandbox… methods. Call the same operations at https://sandbox.haau3.com/v1/fhir/r4
instead. The changelog will say when the first address is removed.