> ## Documentation Index
> Fetch the complete documentation index at: https://v2.docs.conduit.financial/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox overview

> How the Conduit sandbox cluster differs from production, what's mocked, and how to drive specific scenarios

## What the sandbox does

The Conduit sandbox cluster (`https://api.sandbox.conduit.financial`) mirrors production with three differences designed to make integration safe and deterministic:

**Sandbox is fully isolated: no real chain activity, no third-party calls. You get deterministic outcomes and synthetic artifacts that match the shape of real ones.**

1. **Compliance and Travel Rule are isolated.** Sandbox builds never reach upstream compliance services. Outcomes are determined locally by your request data — specifically, by the destination address suffix, fiat account-number suffix, magic `bankName` value, or registered-address magic value you submit.
2. **Chain broadcast is isolated.** Sandbox does not sign or broadcast to any chain. Withdrawals receive a deterministic synthetic `txHash` shaped like a real one, but nothing is wired to a public network and the hash is not visible on any explorer.
3. **Scenario forcing via magic values.** Specific address suffixes, account-number suffixes, and magic field values deterministically trigger compliance, Travel Rule, and chain outcomes. See the per-flow guides below.

Your sandbox API key is scoped to your sandbox organization and never reaches production.

## Sandbox vs. production at a glance

| Feature                                             | Sandbox                                                                                                                                          | Production                          |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------- |
| API key format                                      | `ck_sandbox_...`                                                                                                                                 | `ck_live_...`                       |
| Compliance screening                                | Isolated; outcome from address suffix, account-number suffix, magic `bankName`, or registered-address magic value                                | Real upstream call                  |
| Travel Rule                                         | Isolated; counterparty webhook auto-fires after 10s                                                                                              | Real VASP resolution                |
| Wallet signing                                      | Isolated; `payouts/:id/simulate/cosign` for non-custodial payouts, `orders/:id/simulate/cosign` for non-custodial conversion/offramp source legs | Customer passkey via verify page    |
| Chain broadcast                                     | Synthetic `txHash`; no real chain                                                                                                                | Mainnet/testnet per asset config    |
| Chain finality (custodial)                          | `POST /v2/sandbox/payouts/:id/simulate/confirm`                                                                                                  | Real chain confirmation (\~minutes) |
| Chain finality after non-custodial approved         | Auto-resolves within \~5s via background autopilot; no `simulate/confirm` needed                                                                 | Real chain confirmation (\~minutes) |
| Fiat settlement                                     | `POST payouts/:id/simulate/settled`                                                                                                              | Real rail settlement                |
| Idempotency-key TTL                                 | 300 seconds (5 minutes)                                                                                                                          | 300 seconds (5 minutes)             |
| Webhook signatures                                  | Same HMAC-SHA256 as production                                                                                                                   | HMAC-SHA256                         |
| Rate ingestion                                      | Isolated (stable quotes; use `orders/:id/simulate/rate-lock-expired` to test expiry)                                                             | Live FX market                      |
| Sender-info: payload `daysRemaining` / `deadlineAt` | Always 30 days (live-equivalent)                                                                                                                 | Always 30 days                      |
| Sender-info: auto-timeout                           | \~10 minutes (sandbox internal timer)                                                                                                            | 30 days                             |
| KYC/KYB decisions                                   | `POST /v2/sandbox/applications/:id/simulate/decision` with body `{ "outcome": "approved" }` or `{ "outcome": "rejected" }`                       | Real review pipeline                |

<Warning>
  Sandbox does not auto-resolve cosign. Call `POST /v2/sandbox/payouts/:id/simulate/cosign` with `{ "outcome": "approved" }` explicitly after creating a non-custodial payout, or the payout parks indefinitely at the cosign gate. A non-custodial EVM-sourced conversion or OFFRAMP order also parks at the signing gate on its source leg — resolve it with `POST /v2/sandbox/orders/:id/simulate/cosign` the same way. Production requires a real customer signature; sandbox mirrors that requirement.
</Warning>

<Note>
  **Sandbox-only conveniences (not behavior you get in production).**

  1. **Ops liquidity is on-demand.** The ops accounts behind every payout (the crypto ops wallet for crypto, the banking-provider account for fiat) are auto-provisioned on first use. Production requires the operator to pre-seed liquidity; sandbox does not. Your first payout never hits an ops 503.
  2. **Chain finality auto-advances.** Once a payout clears its gates (including the cosign gate — resolved explicitly via `simulate/cosign`, see the warning above), broadcast and chain confirmation run automatically. Wallet creation and deposits also settle without operator action, so you can drive flows end-to-end through HTTP alone.
  3. **`orders/:id/simulate/rate-lock-expired` cancels orders in about 3 seconds** via an immediate sweep tick (not the 30-second scheduled sweep).
  4. **Forced-failure reasons round-trip 1:1.** `transactions/:id/simulate/terminal { outcome: "failed", reason }`, `orders/:id/simulate/conversion-failed { reason }`, and address-suffix scenarios all flow the operator-supplied text to the polled `GET` and to the webhook payload identically.
  5. **Force-failing a payout at the cosign gate frees the wallet immediately;** the next payout on the same wallet is accepted within milliseconds, with no cooldown.
</Note>

## Where to start

New to the sandbox? Follow the [Quickstart](/sandbox/quickstart) to complete your first end-to-end transaction in about 10 minutes.

For detailed guides on each transaction type:

* [Deposits](/sandbox/deposits) — fiat and crypto deposit simulation, suffix catalog, sender-information gate
* [Withdrawals](/sandbox/withdrawals) — crypto and fiat withdrawal simulation, chain and cosign scenarios
* [Conversions](/sandbox/conversions) — the FX conversion leg inside orders, rate-stale and provider-unavailable paths
* [Onramps](/sandbox/onramps) — fiat-in to crypto-out orders, full lifecycle
* [Offramps](/sandbox/offramps) — crypto-in to fiat-out orders, full lifecycle

Each per-flow page above covers happy paths plus the failure scenarios specific to that flow (deposit compliance, withdrawal cosign, conversion failures, etc.). Copy-paste recipes live inline in those pages.

## Driving scenarios

Five mechanisms cover every meaningful failure mode:

* **Crypto destination address suffix** (last 8 hex chars on EVM; last 8 Base58 chars on Tron/Solana) — drives compliance and Travel Rule outcomes for crypto withdrawals. See [Withdrawal failure paths](/sandbox/withdrawals#failure-paths) and [Travel Rule scenarios](/sandbox/travel-rule-scenarios).
* **Registered-address magic values** — drive the sanctions-screening verdict when registering a wallet address: an address starting with `0x999` parks the registration as `pending_screening` (202), resolved self-service via `POST /v2/sandbox/wallets/registered-addresses/:id/simulate/compliance-decision`; dedicated magic addresses force an immediate rejection (409). See [Registered Addresses — Testing in sandbox](/concepts/registered-addresses#testing-in-sandbox).
* **Fiat account-number suffix** (last 8 digits of `recipient.accountNumber` for payouts, or `senderInfo.accountNumber` for source deposits) — drives settlement outcomes for fiat payouts and source-funding compliance outcomes for fiat source deposits. See [Withdrawals](/sandbox/withdrawals), [Deposits](/sandbox/deposits), and [ONRAMP orders](/sandbox/onramps).
* **`autoPayout.recipient.bankName` magic value** (`SANDBOX_AML_REJECTED`, `SANDBOX_AML_SANCTIONED`) — drives compliance outcomes on the fiat payout leg of OFFRAMP orders. See [Offramps](/sandbox/offramps).
* **`POST /v2/sandbox/.../simulate/*` endpoints** — advance asynchronous state without waiting for automatic timers: chain finality (`payouts/:id/simulate/confirm`), fiat settlement (`payouts/:id/simulate/settled`), order-level failure (`orders/:id/simulate/conversion-failed`), rate-lock expiry (`orders/:id/simulate/rate-lock-expired`), counterparty webhook overrides (`payouts/:id/simulate/counterparty-webhook`), and transaction-level terminal simulation (`transactions/:id/simulate/terminal`) for withdrawals, deposits, onramps, and offramps. Internal-transfer rows are not simulatable. Conduit-internal movements (conversion legs, ops-to-ops sweeps) settle automatically; their failure paths are still testable via the suffix protocol or armed failure knobs at create-time. See [Withdrawal failure paths + chain reference](/sandbox/withdrawals#simulate-broadcast-failure-pre-broadcast-arm).

Address/account-number suffixes set the desired terminal state at creation time; simulate-\* endpoints let you inject failures or pre-empt any automatic timer for fine control.

## Notes

* Suffixes are matched against the **last 8 characters** of the rail-canonical destination address (lowercased hex for EVM; Base58 verbatim for Tron and Solana).
* Magic suffixes are **sandbox-only**. Sending the same address against the live API screens through real compliance and Travel Rule services — the suffix has no meaning there.
* Real-customer collision probability for an 8-char hex suffix is \~1 in 4.3 billion. Don't use magic suffixes in production address books.
* The **Sandbox** group at the end of the API Reference enumerates every sandbox-only endpoint. These routes exist only on the sandbox host; calling them against the live API returns 404.

## See also

* [Sandbox quickstart](/sandbox/quickstart)
* [Webhooks reference](/webhooks)
* [Error codes](/errors)
* [Deposits](/sandbox/deposits)
* [Withdrawals](/sandbox/withdrawals)