Sandbox plane · a separate database · nothing here is a real compliance record
PackAuth · sandbox API reference

Try it against a database that does not matter

Same Worker, same schema, same rules as production — a different D1 database. Every write you make here lands somewhere that can be thrown away, which is what makes the interesting operations safe to run: the ones that change state, and the one that refuses to.

Get a key

No sign-up and no email. The tenant is real in the sense that everything works against it, and disposable in the sense that the plane can be reset without notice.

The walkthrough worth doing

The last step is the product. Everything before it exists so that step has something to refuse.

  1. Create a product POST /v1/productsName it, classify it. Classification is what makes pack resolution possible at all.
  2. Add packaging POST /v1/packagingThe physical pack the artwork will go on.
  3. Open a manifest POST /v1/manifestsThe manifest is the unit of compliance — every run, finding, approval and release hangs off one.
  4. Declare the markets POST /v1/manifests/:manifest_id/marketsWhich jurisdictions this pack is going to. The resolved pack set follows from this and nothing else.
  5. Attach artwork POST /v1/manifests/:manifest_id/artworkCanonicalised extraction output, content-hashed. PackAuth checks artwork; it does not run OCR.
  6. Run the checks POST /v1/compliance-runsDeterministic rules over stored facts. Same inputs, byte-identical findings.
  7. Read the findings GET /v1/findingsA blocking finding stops the flow. It is not a warning the next stage may ignore.
  8. Try to release POST /v1/print-releasesThis is the one to watch: with a blocking finding open it returns 409, and the refusal names the rail that stopped it.

What is different from production

The database, and nothing else. Same code path, same rules, same decision engine, same tenant isolation — a query on this host carries the same tenant_id predicate it would carry anywhere. Every response from this host also carries x-packauth-plane: sandbox, so a client can tell which plane answered without inspecting the body.

It is not a staging environment. Staging would mirror production's data and its deployment lineage; this mirrors neither. It is a place to make mistakes.