> For the complete documentation index, see [llms.txt](https://docs.mymedtrics.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mymedtrics.com/get-started/sandbox.md). # Sandbox A shared Connect API tenant for trying calls and rehearsing an integration before it touches live data. The sandbox is a Medtrics tenant at `https://sandbox.mymedtrics.com`. It runs the same Connect API as a live tenant — same paths, headers, scopes, rate limits and error shapes — on seeded demo data instead of a program's real records. The one difference is how you authenticate: the sandbox API app's secret goes straight in a header, with no token exchange. ```mermaid flowchart LR A["Email help@medtrics.com"] --> B["Receive a sandbox API app\n(client ID + mct_sbx_ secret)"] B --> C["Call /connect/* with\nX-Medtrics-Sandbox-Key: "] C --> D["Go live: your tenant host +\nlive credentials via /oauth/token"] ``` ### Base URL and headers ``` https://sandbox.mymedtrics.com/connect/ X-Medtrics-Sandbox-Key: mct_sbx_… Medtrics-API-Date: 2026-10-27 ``` ### Get sandbox credentials Email with the subject **Connect API sandbox access**, your organization, a technical contact, and the [admin workflows](/get-started/admin-workflows.md) you plan to automate. A Medtrics impact engineer creates a sandbox API app on the sandbox tenant with the scopes those workflows need and sends you its client ID and secret. The secret carries the `mct_sbx_` prefix, is the value you send in `X-Medtrics-Sandbox-Key`, and is refused by `/connect/oauth/token` and by live tenants (`401 invalid_client`). Rotation and revocation go through the same address. ### First call ```bash curl "https://sandbox.mymedtrics.com/connect/programs" \ -H "X-Medtrics-Sandbox-Key: $MEDTRICS_SANDBOX_KEY" \ -H "Medtrics-API-Date: 2026-10-27" ``` Without the header the gateway answers `401` with `error.code` `missing_credentials`; with a revoked or unknown secret, `401` `invalid_credentials`. Every response carries a `Medtrics-Request-ID` to quote when you write to support. ### Sandbox vs live | | Sandbox | Live tenant | | ------------------ | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Host | `sandbox.mymedtrics.com` | `.mymedtrics.com` | | Auth | `X-Medtrics-Sandbox-Key: mct_sbx_…` | `Authorization: Bearer` token from [`/connect/oauth/token`](/get-started/quickstart.md) | | Data | Seeded demo programs, learners, rotations | Your program's records | | Tenant | Shared with other testers | Yours alone | | Writes | Full create, update and delete | As granted by your scopes | | Reset | Wiped and reseeded periodically — see below | Never | | Rate limit | 60 requests/min per API app | 60 requests/min per API app | | Webhooks | Delivered to any public HTTPS `target_url` | Same | | Classic SIS Bridge | Not served here | On the institution's host during a migration — see the [Classic SIS Bridge](/api-reference/medtrics-classic-sis-bridge.md) | ### Working in a shared tenant * **Demo data only.** Never load real learner, faculty or patient records into the sandbox. Use invented names and identifiers. * **Name what you create.** Prefix records you create with your organization (`acme-…`) so you can find them and so other testers know they are yours. * **Expect a reset.** The tenant is wiped and reseeded on a schedule; anything you created is gone afterwards. Your sandbox API app survives resets. Keep the requests that build your test fixtures in a script or Postman folder so you can replay them. * **Webhook targets must be reachable.** Deliveries follow the retry schedule in [Conventions](/get-started/conventions.md#retries); for a quick look at the payload, point a subscription at a request-capture service. {% hint style="info" %} Reset cadence: **\[RESET CADENCE — to be confirmed]**. A reset takes a few minutes; calls during that window may fail and should be retried. {% endhint %} ### Postman Import the [collection](/get-started/postman.md) and the *Medtrics Connect · sandbox* environment, paste your `mct_sbx_` secret into `sandboxApiKey`, and send a request. The collection already points at `https://sandbox.mymedtrics.com` and sends the `X-Medtrics-Sandbox-Key` header for you; leave `clientId` and `clientSecret` empty. ### Going live Switch `baseUrl` to `https://.mymedtrics.com`, remove the sandbox header, and fill in the live client ID and secret created in your tenant's portal under `/integrations/connect-api`; the collection's pre-request script then exchanges them for a bearer token. No request changes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.mymedtrics.com/get-started/sandbox.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.