Developers

Sandbox

The sandbox is a real company account, Acme Logistics, running on the exact same API code, database, and lesson viewer as every paying tenant. Nothing is mocked: the launch URLs you mint open the real viewer, the quiz records a real completion, and the report endpoints change accordingly.

The public sandbox key

tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA

This key is public by design and printed here on purpose. It can only ever resolve to the sandbox tenant, so there is nothing to leak and it is safe to commit in a prototype. Because the key is shared, its 60 requests per minute rate limit is counted per caller IP, not per key. The sandbox is also shared with other developers, so you may occasionally see employees or completions you did not create.

What the sandbox contains

Eight employees across two locations, and one week of curriculum: the Powered Equipment topic with a five lesson Forklift Safety subtopic scheduled Monday to Friday of the current week. Each lesson is a short video plus a one question quiz.

External id	Name	Location
`E-1001`	Dana Worker	Dallas DC
`E-1002`	Miguel Herrera	Dallas DC
`E-1003`	Tasha Green	Dallas DC
`E-1004`	Piotr Kowalski	Dallas DC
`E-1005`	Priya Natarajan	Fort Worth Hub
`E-1006`	Marcus O'Neal	Fort Worth Hub
`E-1007`	Elena Vasquez	Fort Worth Hub
`E-1008`	Sam Whitfield	Fort Worth Hub

E-1001 is the hero of every example in these docs. A few employees are pre-marked complete for the weekdays already past this week, so the report endpoints return data before you have completed anything yourself.

This week's lessons

Mon	Pre-Shift Inspection
Tue	Load Limits & Stability
Wed	Pedestrian Awareness
Thu	Safe Travel & Speed
Fri	Parking & Shutdown

The full rehearsal loop

This is the production integration end to end, rehearsed against the sandbox: ask, redirect, let the worker finish, ask again.

1 Ask for today, with a return URL

# returnUrl must be URL-encoded and on the sandbox allowlist
curl "https://toolboxminute.com/api/v1/employees/E-1001/today?returnUrl=https%3A%2F%2Fexample.com%2Freturn" \
  -H "X-Api-Key: tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA"

# 200 OK
{
  "externalId": "E-1001",
  "lessonDate": "2026-07-15",
  "status": "not_started",
  "lesson": {
    "lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
    "title": "Pedestrian Awareness",
    "videoDurationSeconds": 90
  },
  "subTopic": "Forklift Safety",
  "topic": "Powered Equipment",
  "launchUrl": "https://toolboxminute.com/viewer/start?token=kX3vQ9..."
}

2 Open the launch URL

Paste the launchUrl into a browser. The token signs the worker in anonymously and opens the real lesson viewer: the video plays, then a short quiz. Tokens are single use and expire after about 30 minutes; call /today again for a fresh one.

3 Finish and get sent back

After the quiz, the browser is redirected to your returnUrl (https://example.com/return in this example). That redirect is the worker handoff back into your system.

4 Ask again

# Same call as step 1
{
  "externalId": "E-1001",
  "lessonDate": "2026-07-15",
  "status": "completed",
  "lesson": {
    "lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
    "title": "Pedestrian Awareness",
    "videoDurationSeconds": 90
  },
  "subTopic": "Forklift Safety",
  "topic": "Powered Equipment",
  "launchUrl": null
}

Return URL allowlist

Return URLs are allowlisted per tenant and matched exactly: scheme, host, port, and path, with no wildcards and no prefix matching. Anything else fails with 400 invalid_return_url. The sandbox allowlist is seeded with:

https://example.com/return
http://localhost:3000/return
http://localhost:5173/return

The two localhost entries let a local dev server receive the redirect. If you omit returnUrl entirely, the worker lands on a neutral completion page in the viewer.

Nightly reset at 04:00 UTC

Every night the sandbox is restored to a clean state:

Completions are wiped, so every employee starts the day not_started
The five lesson schedule is re-windowed onto the current week
Employees created through the API are pruned; the roster returns to E-1001 through E-1008

The key never changes. Anything you create during the day survives until the reset, so a demo built in the morning still works that afternoon.

What you cannot test in sandbox

Billing

The sandbox tenant is billing exempt, so plan changes, seat purchases, and the 402 api_access_required path cannot be exercised here. Those behaviors only exist on a real tenant.

Your own tenant settings

The sandbox's settings are fixed and shared: you cannot edit its return URL allowlist, manage its API keys, or configure webhook subscriptions. To rehearse those, start a trial and use your own tenant with your own keys.