How do I test a Salesforce integration without a real org?

You do not need one. Point your client at a read-only Salesforce replica that already holds the olympus-labs data set, and your code runs unchanged.

01 / The one change

Swap the base URL. Nothing else.

Your client talks to <instance>.my.salesforce.com. Point it at sf.sandboxapis.dev instead: same paths, same JSON, same headers, same status codes. No org to create, no seed script.

For CI, use a pinned host. This page uses sf-v67-g12.snap.sandboxapis.dev, the newest pin for Salesforce, which answers the same bytes on every run, so an assertion written today still holds next month.

The live host, sf.sandboxapis.dev, re-rolls daily and can carry a newer generation of the data set than sf-v67-g12.snap.sandboxapis.dev; every answer on this page is for sf-v67-g12.snap.sandboxapis.dev.

02 / Run it now

One request, no account.

request.sh

curl "https://sf-v67-g12.snap.sandboxapis.dev/services/data/v67.0/query?q=SELECT+Id,Name+FROM+Account+LIMIT+5"

It answers with five Account records from a SOQL query, each with its Id and Name, in Salesforce's own records envelope with totalSize and done.

03 / Writes

A write gets Salesforce's own error shape.

Every host is read-only. A write answers 405 with Salesforce's own error body, naming what you tried, so your client's existing error handling meets a shape it knows.

405 · application/json;charset=UTF-8

curl -s -X POST "https://sf-v67-g12.snap.sandboxapis.dev/services/data/v67.0/sobjects/Account" -H 'content-type: application/json' -d '{"Name":"test"}'

[{"errorCode":"METHOD_NOT_ALLOWED","message":"HTTP Method 'POST' not allowed. Allowed are HEAD,GET. This universe is read-only. See what's covered at https://sandboxapis.dev/coverage. (You tried to POST /services/data/v67.0/sobjects/Account.) Tell us what you needed to write: https://sandboxapis.dev/feedback"}]

04 / Where it stops

Coverage is counted, not claimed.

22 of 50 Salesforce read surfaces are served and checked against a spec written from Salesforce's own documentation and live captures, because Salesforce publishes no machine-readable one. A call to one that is not covered returns a 404 with an X-SandboxAPIs-Coverage header, never invented data. The row-by-row list is on the Salesforce reference and the coverage page.

Next: read the Salesforce quickstart, or run the four-hop walk to watch one incident cross four services.

What this is not

Read this before you rely on it.

SandboxAPIs is read-only: a write returns the provider's own error unless your key has opted in to scratch writes, and those never reach anybody else. Coverage is bounded, and the manifest that says exactly where it stops is public. The data is a simulated company, not yours and not a copy of anybody's. And it reproduces what each vendor documents and publishes, not the vendor's undocumented behaviour, so keep one test against the real service for that.