Skip to main content

​
Sandbox rules

​
What this is for

The sandbox is the practice environment that your test keys talk to. It behaves like the real API but is completely separate from production, free to use and safe to break. This page lists the rules of that environment: what data is allowed, who can see it, when it is deleted and how much you can do per minute or per hour, so nothing surprises you while you build.

​
Before you start

You do not need to do anything to get a sandbox. Every project has one, and any key that starts with clk_test_ uses it. If you have no key yet, see Access: API keys.

​
The rules

1

Use synthetic data only

Put only invented data in the sandbox: made-up names, dates and values. Do not enter real patient information and do not copy production records into it. Every response to a test key carries the header X-Sandbox-Notice: synthetic-data-only as a reminder. Synthetic data simply means data that looks real but describes no real person.
2

Know who can see your data

A test key reads and writes only its own project’s sandbox data. Other organizations’ and other projects’ sandbox data cannot be reached with it. Data created with test keys is never visible to live keys, and the reverse.
3

Expect the 90-day clean-up

Sandbox records that have not been updated for 90 days are deleted automatically by a nightly job. Update a record, or create it again, if you need it to last. Production data is not affected.
4

Stay inside the limits

See the table below.

​
Limits

​
In the dashboard

The Data browser and Exports work only with test keys, and live data is never written from the console. When the sandbox cannot be reached, those pages say Sandbox coming soon and the project’s status shows Sandbox unavailable.

​
Common questions

The sandbox holds practice data for building and testing; production holds your real data and needs a paid plan and live keys. They are separate: data created with a test key is never visible to a live key.
They were not updated for 90 days and the nightly clean-up removed them. Keep important sample data in a script you can run again.
No. It is for synthetic data only, which is exactly why real patient information must stay out. The Free plan is test-only and carries no BAA.
All test-key traffic of the whole organization shares 60 requests a minute. Slow down loops, or run test suites in smaller batches.
The dashboard checks the sandbox before it shows data. When it does not answer, pages say so honestly instead of showing an empty table.

​
Troubleshooting