The pager went off, and somebody answered.

01 / Base URL + auth

One origin, any token.

Requests go to https://pd.sandboxapis.dev. Paths are PagerDuty's own and start at the root — /incidents, /services, /oncalls — with no version prefix, because PagerDuty versions in a header rather than the URL. Auth is Authorization: Token token=…; any value passes here, so there is no account to create and no API key to mint.

curl -H 'Authorization: Token token=anything' \
  -H 'Accept: application/vnd.pagerduty+json;version=2' \
  "https://pd.sandboxapis.dev/incidents?date_range=all"

Using a key? Keys & rate limits → — a SandboxAPIs key rides the same Token token= slot and lifts the anonymous limit.

02 / Read this before your first call

/incidents defaults to the last month.

PagerDuty's own since parameter defaults to a one-month window, and this universe's incident is older than that — so a bare GET /incidents returns an empty list, exactly as the real API would. That is the mirror working, not a broken host. Pass date_range=all (or an explicit since=) and it is there.

# the incident, and the alerts that opened it
curl -H 'Authorization: Token token=anything' \
  "https://pd.sandboxapis.dev/incidents?date_range=all"

# its timeline: alert fired, page sent, page acknowledged, incident resolved
curl -H 'Authorization: Token token=anything' \
  "https://pd.sandboxapis.dev/incidents/<id>/log_entries"

# who is on call right now, per policy and escalation level
curl -H 'Authorization: Token token=anything' "https://pd.sandboxapis.dev/oncalls"

03 / What this host serves

A page with a paper trail.

A PagerDuty service here is a component the simulated org actually deploys, owned by a team whose members are real people on the other hosts. Its escalation policy targets a real weekly rotation, and the person the incident paged is the person that rotation puts on call at that instant — the same person the tracker shows as the issue's assignee, and the same person who authored the pull request that fixed it. The incident's notes are the incident bridge's own messages, the ones the chat host serves.

Ask /oncalls?since=…&until=… for any window you like, including one years away: the rotation is computed, not stored, so it answers for every instant. See what's covered →

04 / Pagination

offset, limit, more.

List endpoints paginate by offset, and the envelope rides the body rather than a header: offset and limit echo what you asked for, more says whether another page exists, and total stays null unless you pass total=true — PagerDuty's own default, mirrored. @pagerduty/pdjs's .next() walks it for you.

{ "incidents": [ … ], "offset": 0, "limit": 25, "more": false, "total": null }

05 / Read-only + coverage

Every refusal is PagerDuty-shaped.

This universe never changes. A write returns PagerDuty's own error envelope — 403 {"error": {"message": …}} — naming what you tried and where the roadmap is. A path outside coverage returns the same envelope at 404 with {"message": "Not Found", "code": 2100} and an x-sandboxapis-coverage header, and a parameter we don't answer (include[], time_zone) returns an explicit 400 rather than a list quietly missing your filter.

06 / Pin for CI

A frozen universe, by hostname.

Point CI at https://pd-v2.snap.sandboxapis.dev and the bytes stop moving: same incident, same ids, same rotation, run after run. The live host tracks the newest universe; a pin never does.

export PAGERDUTY_API_HOST="https://pd-v2.snap.sandboxapis.dev"