Sandbox

The sandbox is a full CBMS deployment with its own database, Redis, keys, and webhook secrets. Same routes and rules as production. It is not a mock.

Use it for all integration work until you are certified.

Host

https://stage.cbms.venuesetu.com

API prefix: https://stage.cbms.venuesetu.com/api/v1

Confirm you are on sandbox with an unauthenticated request:

GET /health

{ "status": "ok", "sandbox": true, "timestamp": "…" }

Production reports "sandbox": false. Never mix keys across the two hosts.

Credentials

We issue you a sandbox API key bound to partner identity sandbox_partner (or another sandbox identity we assign). Put it in x-api-key on every API call.

We also grant that identity the sandbox venues. Until the grant lands, GET /partner/venues is an empty list.

Seeded inventory

The sandbox dataset is deterministic. You can discover these through the API; they are listed here so your tests can assert them.

	Value
Venue A	a0000000-0000-4000-8000-000000000001 — Sandbox Venue A, badminton
Courts at A	badminton-court-1, badminton-court-2
Venue B	a0000000-0000-4000-8000-000000000002 — Sandbox Venue B, box cricket
Court at B	box-cricket-court-1
Package at A	a0000000-0000-4000-8000-000000000003 — 5-session pack

Prefer discovery over hard-coding, the same way you will in production. The ids above are stable across re-seeds.

Slots are a rolling ~3-week AVAILABLE grid. Pick a future date from GET /slots/availability.

Exercise the booking flow

Follow Booking flow against this host. A minimal loop:

1. List venues and resources.
2. Query availability for Venue A, badminton-court-1, a date 1–14 days ahead.
3. Hold an is_available: true slot with a fresh idempotency_key.
4. Confirm with a fake payment_reference (sandbox does not charge a card).
5. Cancel or refund with another fresh key.
6. Retry step 3 or 5 with the same key you used the first time — you should see the original result.

Webhooks

Subscribe with POST /api/v1/partner/webhooks to a URL you control (your laptop via a tunnel, or a sandbox receiver). Signing is identical to production. See Webhooks.

Deliveries are produced by real sandbox actions you take. There is no “inject event” endpoint.

Limits and housekeeping

• Same rate limit as production: 60 requests / 60 seconds per key.
• The environment is shared among partners using the sandbox identity. Do not depend on a slot remaining free after you looked at it — hold is the reservation.
• If the slot grid is exhausted or the dataset is messy, ask the platform team to reset it. Reset is an operator action, not a partner API.

Do not point production traffic, production keys, or a live customer checkout at this host.