Concepts

Boundaries

What the API deliberately does not do, stated plainly.

The most trustworthy thing a reference can do is state what it will not do. These are deliberate, not gaps — and they shape how you build against the sandbox.

No cross-origin calls

The gateway sets no CORS headers, so a browser cannot call /v1 directly. Every call — including one with your own key — proxies through a server you control. The playground's own server does exactly this, passing the key through, never storing or logging it.

No enforced rate limit, no reset

The gateway declares rate scopes but enforces none today, so throttling is yours to own. And there is no sandbox reset: environment state accumulates. To start clean, retire the environment and provision a fresh one.

No public completion; lifecycle changes require a fresh read

An internal transfer parks at awaiting_finality; there is no public helper to finalise it. Endpoint lifecycle changes are public, but require the opaque lifecycleGuard returned by the latest endpoint read. If the endpoint changes first, the command is rejected as stale_lifecycle_guard; re-read and retry.

The rule

Where the sandbox refuses, it says so in a problem you can read. Nothing here is painted; a boundary is a fact you can build around.