> ## Documentation Index > Fetch the complete documentation index at: https://docs.haau3.com/llms.txt > Use this file to discover all available pages before exploring further. # Sandbox > The platform API's test environment at sandbox.haau3.com: production's paths, callable with no key, each operation answering its documented example with a fixed answer. The Sandbox is the platform API's non-production twin, at `https://sandbox.haau3.com`: the same paths as production, `https://api.haau3.com`, on a host of its own, to build and test against. It is an environment, not a service. Every service's operations answer there, so a client moves between the two by changing the host, or, with the [SDKs](https://docs.haau3.com/sdks.md#the-sandbox), its key. | | Production | Sandbox | | - | - | - | | Base | `https://api.haau3.com` | `https://sandbox.haau3.com` | | Key | A live key, always | None, or a test key | | What it answers | Live data, for any request the API takes | Each operation's documented example, the same every time | | Limits | Your plan's requests a minute and a month | 30 requests an hour per IP address with no key; with a test key, your plan's requests a minute and never the month | The FHIR base in the Sandbox is `https://sandbox.haau3.com/v1/fhir/r4`, and Scheduling is at `https://sandbox.haau3.com/v1/scheduling`. ## Your first call No account is needed. This is the [quickstart](https://docs.haau3.com/quickstart.md)'s search for open appointments, which makes the same call with each SDK: ```bash theme={null} curl -s "https://sandbox.haau3.com/v1/scheduling/slots?city=Cambridge&state=MA&limit=1" ``` From a project's folder, `npx haau3 test` from the [haau3 CLI](https://docs.haau3.com/cli.md) makes one call to every service here with no key, nine of the hour's 30. ## Calling with no key The Sandbox answers a request with no key at all, so you, or your coding agent, can make a first call before signing up. * **30 requests an hour from each IP address**, an IPv6 address counted by its `/64`. The 31st is a `429` with a `Retry-After` header, which runs to the end of that address's hour. A batch counts one request for each of its entries, and one the hour cannot hold is a `429` before any entry runs. A free test key raises the limit to your plan's requests a minute. * **A request body is read up to 1 MiB.** A larger one is a `413`. * **No key means no `Authorization` header and no `x-api-key` header.** A key that is not a working test key, or one sent any other way than `Authorization: Bearer`, is a `401`, never served as a call with no key. An IP address (an IPv6 address by its `/48`) that sends 30 keys within an hour that are not recognised gets a `429` for its keyed requests until that hour ends. * A call with no key is not recorded against any organization, so it shows on no Usage page. ## With a test key A test key looks like `haau3_sk_test_…`. Make one free on the dashboard's API keys page by choosing Test, or with `npx haau3 keys create --test` from the [haau3 CLI](https://docs.haau3.com/cli.md) (see [test and live keys](https://docs.haau3.com/authentication.md#test-and-live-keys)). In the Sandbox it raises the limit to your plan's requests a minute, counted apart from your production requests, and its requests never count toward your plan's month. The Usage page shows them as one line beside your services. A test key works only in the Sandbox, and a live key never does: a live key sent here is a `403` coded `live-key-in-sandbox`, and a key made before test keys is a `401` here. ## With the SDKs Each [SDK](https://docs.haau3.com/sdks.md#the-sandbox) sends every call to the environment its key's mode names: a test key to the Sandbox, a live key to production, so `HAAU3_API_KEY` alone moves an app from one to the other. To call the Sandbox with no key, leave `HAAU3_API_KEY` unset and name it: `environment: "sandbox"` in TypeScript and Python, `haau3.WithEnvironmentSandbox()` in Go, or `HAAU3_ENVIRONMENT=sandbox` for any of them. ## What it answers Each operation answers its documented example request with a fixed answer: the answer production gave when the example was saved, with every link to production's FHIR base naming the Sandbox's instead, and a search's `next` link left out, since the Sandbox has one page. Any other request returns `400` coded [`not-the-example`](https://docs.haau3.com/errors#invalid-request), which names the example to send. The public-data examples are fixed answers; the pharmacy benefit check and MedList answer with synthetic data. For anything else, call production with a live key. ### Scheduling | Operation | The request the Sandbox answers | | - | - | | Search provider locations | `GET /v1/scheduling/provider-locations?publisher=haau3&limit=1` | | Search appointment slots | `GET /v1/scheduling/slots?city=Cambridge&state=MA&limit=1` | | List scheduling publishers | `GET /v1/scheduling/publishers` | | List service types | `GET /v1/scheduling/service-types` | | List specialties | `GET /v1/scheduling/specialties` | ### FHIR base | Operation | The request the Sandbox answers | | - | - | | Capability statement | `GET /v1/fhir/r4/metadata`: the Sandbox's own CapabilityStatement, listing what it answers | | Run several operations in one request (batch) | `POST /v1/fhir/r4` with a batch whose every entry is one of the requests on this page | ### Terminology | Operation | The request the Sandbox answers | | - | - | | Look up a code | `GET /v1/fhir/r4/CodeSystem/$lookup?system=http://loinc.org&code=2345-7&property=SHORTNAME` | | Look up a code | `POST /v1/fhir/r4/CodeSystem/$lookup` with the example body in the [API reference](https://docs.haau3.com/api-reference) | | Validate a code in a code system | `GET /v1/fhir/r4/CodeSystem/$validate-code?url=http://loinc.org&code=2345-7` | | Validate a code in a code system | `POST /v1/fhir/r4/CodeSystem/$validate-code` with the example body in the [API reference](https://docs.haau3.com/api-reference) | | Expand a value set | `GET /v1/fhir/r4/ValueSet/$expand?url=http://loinc.org/vs/LL360-9` | | Expand a value set | `POST /v1/fhir/r4/ValueSet/$expand` with the example body in the [API reference](https://docs.haau3.com/api-reference) | | Validate a code against a value set | `GET /v1/fhir/r4/ValueSet/$validate-code?url=http://hl7.org/fhir/ValueSet/observation-vitalsignresult&system=http://loinc.org&code=8867-4` | | Validate a code against a value set | `POST /v1/fhir/r4/ValueSet/$validate-code` with the example body in the [API reference](https://docs.haau3.com/api-reference) | ### Provider directory | Operation | The request the Sandbox answers | | - | - | | Find a practitioner by NPI or name | `GET /v1/fhir/r4/Practitioner?identifier=1093209884` | | Read a Practitioner | `GET /v1/fhir/r4/Practitioner/Practitioner-1093209884` | | Find practitioner roles | `GET /v1/fhir/r4/PractitionerRole?practitioner=Practitioner-1093209884&_count=2` | | Read a PractitionerRole | `GET /v1/fhir/r4/PractitionerRole/PractitionerRole-179421b5-5919-4f54-84c9-a4473b68f74c` | | Find organizations, payers and networks | `GET /v1/fhir/r4/Organization?type=ntwk&_count=2` | | Read an Organization | `GET /v1/fhir/r4/Organization/Organization-ea579d05-454e-4359-8751-900c940a599a` | | Find the organizations in a network | `GET /v1/fhir/r4/OrganizationAffiliation?network=Organization-ea579d05-454e-4359-8751-900c940a599a&_count=2` | | Read an OrganizationAffiliation | `GET /v1/fhir/r4/OrganizationAffiliation/OrganizationAffiliation-000cc9b9-738c-43cd-b923-03ac9ab4714d` | | Find healthcare services and pharmacies | `GET /v1/fhir/r4/HealthcareService?service-category=pharm&location.address-state=FL&location.address-postalcode=33131&_count=2` | | Read a HealthcareService | `GET /v1/fhir/r4/HealthcareService/HealthcareService-0009bcae-631e-45c0-9d3c-5691acb4a05d` | | Find practice locations | `GET /v1/fhir/r4/Location?organization=Organization-1093090342&_count=2` | | Read a Location | `GET /v1/fhir/r4/Location/Location-5e79e878-cef0-4a63-a41c-b77cfd3f8062` | | Find endpoints | `GET /v1/fhir/r4/Endpoint?organization=Organization-1326655846&_count=2` | | Read an Endpoint | `GET /v1/fhir/r4/Endpoint/Endpoint-000508b0-e3f0-4108-8d1d-a610f0675358` | ### Questionnaires | Operation | The request the Sandbox answers | | - | - | | List or find a questionnaire | `GET /v1/fhir/r4/Questionnaire?url=http://loinc.org/q/44249-1` | | Read a questionnaire | `GET /v1/fhir/r4/Questionnaire/44249-1` | ### Medical Benefits | Operation | The request the Sandbox answers | | - | - | | Find a plan | `GET /v1/fhir/r4/InsurancePlan?identifier=H2406-013-000` | | List a state's counties | `GET /v1/fhir/r4/InsurancePlan/$counties?state=FL` | | Read a plan | `GET /v1/fhir/r4/InsurancePlan/H2406-013-000` | | Check providers against a plan's network | `GET /v1/fhir/r4/InsurancePlan/H3359-038-000/$in-network?npi=1518929058&npi=1992700001` | ### Pharmacy Benefits | Operation | The request the Sandbox answers | | - | - | | Check what a medication costs (pharmacy benefit check) | `POST /v1/fhir/r4/$process-message` for a [test member](https://docs.haau3.com/benefits/example-health-plan.md) of Example Health Plan, a test insurer, with synthetic data | ### MedList | Operation | The request the Sandbox answers | | - | - | | Reconcile one patient's medication records | `POST /v1/fhir/r4/$reconcile-medications` with the example body in the [API reference](https://docs.haau3.com/api-reference) | ### Structured Sig | Operation | The request the Sandbox answers | | - | - | | Structure a prescription's directions as a FHIR Dosage | `POST /v1/fhir/r4/$structure-dosage` with the example body in the [API reference](https://docs.haau3.com/api-reference) | ## Test data only > [!WARNING] > > **Calling the Sandbox accepts haau3's [terms](https://platform.haau3.com/terms).** Send test data > only, never a real person's. Every answer from `sandbox.haau3.com` carries `Link: ; rel="terms-of-service"`, its `CapabilityStatement` says so in its `description`, and every refusal adds an issue of severity `information`, or a problem's `terms` member, that says it. Nothing you send is stored. ## The first address Before the Sandbox had a host of its own, it answered at `https://api.haau3.com/v1/sandbox/fhir/r4` with a test key: `metadata` and the pharmacy benefit check. That address is deprecated, and so are the SDKs' `sandbox…` methods. Call the same operations at `https://sandbox.haau3.com/v1/fhir/r4` instead. The [changelog](https://docs.haau3.com/changelog.md) will say when the first address is removed. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.