---
title: "Sandbox — Apparel Monster"
description: "How to exercise every Apparel Monster API, including checkout and payment, without touching real money or real fulfilment. The whole store is the sandbox."
canonical: https://apparel.monster/sandbox
last-updated: 2026-09-16
---

# Sandbox

**There is no separate sandbox host, because there is no production to protect
from you.** `https://apparel.monster` *is* the test environment: the same URLs,
the same data, the same behaviour, with a payment gateway that settles nothing
and a warehouse that ships nothing.

That is a deliberate design choice rather than a missing feature. A sandbox that
is a different host with different data is a sandbox whose green run tells you
very little about the real one.

## What is safe to do here

| Operation | Safe? | What actually happens |
|---|---|---|
| Search, browse, read products | yes | Live catalog, 116 real products |
| Create a cart, add and remove items | yes | Real Spree order in `cart` state |
| Set an address, pick a shipping method | yes | Real rates from real shipping methods |
| Attach a payment and place an order | yes | Order is created through a **Bogus** test gateway; **no card is charged** |
| Mint an Apple Pay / Google Pay link | yes | Real wallet sheet, test merchant, no settlement |
| ACP / UCP checkout sessions | yes | Real sessions, same test gateway |
| Price watches and callbacks | yes | Fires within 1–10 minutes against your `callback_url` |
| Fulfilment, shipping, returns | n/a | **Nothing is ever fulfilled or shipped** |

## Test credentials

None. `search`, `product`, `cart`, `checkout`, `wallet`, `price-watch`, `/ask`,
the MCP servers, ACP and UCP are **anonymous** — no key, no account, no
allowlist. Only `POST /api/v1/track` needs OAuth, and you can register a client
and walk the authorization-code + PKCE flow in a browser:

- Start here: <https://apparel.monster/api/v1/oauth/start>
- Full flow: <https://apparel.monster/auth.md>

## Test payment values

| Field | Use |
|---|---|
| Card number | Any syntactically valid number, e.g. `4111 1111 1111 1111` |
| Expiry | Any future date |
| CVV | Any 3 digits |
| Payment token (API) | Any non-empty string — the gateway accepts it |
| Wallet | Apple Pay / Google Pay sheet with a test merchant identifier |

The gateway is Spree's `Bogus` credit-card gateway. It approves anything
well-formed, so a successful checkout here proves your *integration* works, not
that a card would clear.

## Forcing failure paths

A happy path you cannot break is a poor test. These produce real, documented
errors:

| To see | Do |
|---|---|
| `422 validation_failed` | Check out with no email set |
| `404 not_found` | Use a product id as a `variant_id` |
| `409` / cart error | Add a quantity greater than the variant's stock |
| `429 rate_limited` | Exceed 120 requests in 60 seconds on `/api/v1` |
| `401 unauthorized` | Call `POST /api/v1/track` with no bearer token |
| Async job flow | `POST /api/v1/price-watch` → `202` + `Location` → poll it |

## Resetting

Nothing you do needs cleaning up. Carts are anonymous and expire; orders are
never fulfilled; the catalog is not mutated by any public endpoint. To start
clean, drop your `session.id` and call `POST /api/v1/search` again — it mints a
new one.

## Rate limits in the sandbox

The same as everywhere else: 120 requests per 60 seconds per IP on `/api/v1`,
with `RateLimit-*` and `X-RateLimit-*` headers on every response and
`Retry-After` on a `429`. They are enforced, not advertised-only, precisely so
that a client which handles them correctly here handles them correctly against
a real merchant.

## Where to go next

- [`/AGENTS.md`](https://apparel.monster/AGENTS.md) — the shopping flow end to end
- [`/docs/quickstart.md`](https://apparel.monster/docs/quickstart.md) — first call in five minutes
- [`/api/v1/openapi.yaml`](https://apparel.monster/api/v1/openapi.yaml) — every endpoint
- [`/pricing`](https://apparel.monster/pricing) — what each access tier allows
- [`/docs/deprecation-policy.md`](https://apparel.monster/docs/deprecation-policy.md) — how this surface changes