# Decision Log API sandbox

Stable origin: https://sandbox.decisionlog.ai

The sandbox runs the production Decision Log API contract against an isolated Neon database branch. Sandbox Organizations, Workspaces, Users, Agents, credentials, Decisions, sources, ingestion runs, and audit events cannot access production records.

## Start

1. Create an account at https://sandbox.decisionlog.ai/sign-up.
2. Complete Organization and Workspace onboarding with synthetic names and data.
3. Create a scoped API key at https://sandbox.decisionlog.ai/app.
4. Send the key as `Authorization: Bearer <api_key>`.

Email verification is intentionally disabled only in the sandbox. Authentication, custom RBAC and ABAC permissions, immutable Decision semantics, supersession, candidate-first extraction, idempotency, payload validation, and audit attribution remain enabled.

## Contracts and endpoints

- OpenAPI 3.1 REST contract: https://sandbox.decisionlog.ai/openapi.json
- REST base: https://sandbox.decisionlog.ai/api/v1/graphql/{operationType}/{field}
- Canonical GraphQL endpoint: https://sandbox.decisionlog.ai/api/graphql
- MCP endpoint: https://sandbox.decisionlog.ai/api/mcp
- MCP server card: https://sandbox.decisionlog.ai/.well-known/mcp/server-card.json
- Agent instructions: https://sandbox.decisionlog.ai/llms.txt

The REST surface is a typed facade over the canonical GraphQL operation registry. It does not define a second business API.

## Limits and lifecycle

- Anonymous reads: 120 requests per 60 seconds per network identity.
- Anonymous writes: 20 requests per 60 seconds per network identity.
- Credentialed reads: 600 requests per 60 seconds per credential.
- Credentialed writes: 120 requests per 60 seconds per credential.
- Rate-limit responses use HTTP 429 with `RateLimit-*`, `X-RateLimit-*`, and `Retry-After` headers.
- Async source ingestion returns HTTP 202 and a pollable IngestionRun while Vercel Queues performs durable processing.
- Sandbox data is disposable and may be cleared during maintenance without notice.

Do not submit personal information, production credentials, confidential source material, or any data that must be retained. The sandbox has no uptime or retention guarantee.