Introducing SandboxAPIs

Every integration test written against a real developer API begins with the same tax. Make an account. Seed it with something worth asserting on. Mint a token, scope it, and get it into CI without leaking it. Then write the test, which now depends on data that changes under you and a quota that runs out.

SandboxAPIs removes that step. It serves read-only, API-compatible replicas of 21 services you build with, all preloaded with one realistic data set, on hostnames you point an existing client at instead of the vendor's. Nothing to install, and no account needed to start.

curl -s https://gh-2026-03-g6.snap.sandboxapis.dev/repos/olympus-labs/parthenon \
  | jq '{full_name, default_branch, language, open_issues_count, topics}'

{
  "full_name": "olympus-labs/parthenon",
  "default_branch": "main",
  "language": "TypeScript",
  "open_issues_count": 43,
  "topics": [
    "developer-tools",
    "platform",
    "typescript",
    "monorepo"
  ]
}

How it is built

A deterministic generator simulates one engineering company, olympus-labs, across ninety days of modelled time. Personas act, and what comes out is a canonical event log. No wall clock, no unseeded random number generator, no network call, no dependence on map iteration order: for a given template version, seed and anchor time it emits byte-identical output on any machine. CI proves that on every run by generating, deleting the artifacts, and regenerating them.

A compiler renders that one canon into per-service read-only SQLite artifacts, one per service per API version per snapshot, and those live in object storage. There is no live database in the data plane. A renderer opens an artifact and answers out of it, which is why a frozen snapshot host is cheap and why it cannot drift.

The renderers serve each vendor's own paths exactly: the same routes, the same JSON, the same pagination and rate-limit headers, the same status codes, the same error bodies. Every covered response is validated against that vendor's published OpenAPI description or GraphQL schema on every CI run, from a copy pinned to a sha we record.

Coverage is a published manifest rather than a claim. 3,255 of the 3,353 read endpoints and GraphQL entities these 21 APIs publish now have a final answer, 2,395 of them with data and the rest a reviewed empty response or a documented refusal. Anything still uncovered returns the vendor's own 404 with a coverage header pointing at the manifest. That manifest's status column is generated from the conformance results, so it cannot be edited to green.

One story, told in every dialect

Compiling from a single canon is what makes the data set worth more than the sum of its endpoints. A pull request's author is a user you can fetch. Its commits exist at the SHAs it claims. The incident in a Slack thread is the same incident as the ticket, the issue and the merge request, and both git hosts agree on the head SHA. Here is one postmortem follow-up, asked for twice, on two vendors' APIs.

curl -s https://jira-v3-g6.snap.sandboxapis.dev/rest/api/3/issue/FATE-46 \
  | jq '{key, summary: .fields.summary, status: .fields.status.name}'

{
  "key": "FATE-46",
  "summary": "Postmortem follow-up: schema marks a nullable field as required",
  "status": "Done"
}

curl -s https://gh-2026-03-g6.snap.sandboxapis.dev/repos/olympus-labs/parthenon/issues/46 \
  | jq '{number, title, state, user: .user.login}'

{
  "number": 46,
  "title": "Postmortem follow-up: schema marks a nullable field as required",
  "state": "closed",
  "user": "cassandra"
}

Nobody wrote two response bodies. There is one simulated backlog underneath, and each host renders it the way that vendor really would. The four-hop walk on the try page follows this incident across four vendors in about ten seconds and exits non-zero if any of them disagree.

Why this matters most for agents

An agent under test is the hardest client to satisfy, because it asks for things you did not anticipate. A stubbed path it wanders off returns nothing useful, and a real account it wanders into is one it can damage. A whole read surface that answers, over a data set that never moves, is what an agent evaluation has been missing: score the same task on the same world next month and you know the score moved because the agent changed. Three tutorials walk through it, pointing a Python agent at a frozen GitHub, Jira or Slack host and asserting its answer in five lines of pytest. Every script on those pages is run by CI, so none can claim output nobody produced.

What is deliberately not here

Writes. Every mutation is refused with the vendor's own status code and error body, naming what was attempted. Your client's error path gets exercised and the boundary is itself testable, but you cannot POST an issue and then GET it back.

curl -s -i -X POST \
  https://gh-2026-03-g6.snap.sandboxapis.dev/repos/olympus-labs/parthenon/issues \
  -H 'content-type: application/json' -d '{"title":"test"}'

HTTP/2 403
x-github-api-version: 2026-03-10
x-sandboxapis-read-only: true

{"message":"This universe is read-only. See what's covered at
https://sandboxapis.dev/roadmap. (You tried to POST
/repos/olympus-labs/parthenon/issues.) Tell us what you needed to write:
https://sandboxapis.dev/feedback","documentation_url":"https://sandboxapis.dev/roadmap","status":"403"}

That trade buys the two things we were not willing to give up. A pinned host returns identical bytes in a year because nothing can mutate it, which is the only reason it is safe in CI. And an agent can be pointed at a company's worth of repositories, tickets and dashboards knowing the worst case is a 403, which is not true of any real account.

Also not here: real vendor data. Nothing behind these hosts came out of anybody's account, so there is nothing to redact. And not every API, 21 of them. What we do not serve yet is on the coverage manifest rather than in a promise, and that manifest is the roadmap.

Start with one line

Anonymous access is 60 requests an hour with no account. A free key raises that to 600 and rides each vendor's own credential header, so the client you already use needs no second code path. 148 frozen snapshot hosts are registered for CI, each byte-reproducible rather than stored, and an MCP server puts the same data set in front of an agent with no HTTP plumbing at all.

If a response does not match the vendor's, that is a bug and we want to hear about it. So is an endpoint you needed and did not get.