Skip to main content
POST
Mint a sandbox API key (no account needed)
Mints a provisional account and a zn_test_ API key. No authentication required — this is the entry point for an agent that has nothing but the hostname. The response is written to be self-guiding: send api_key as a Bearer token, POST the example_order body to /orders as-is, and work through next in order.
An empty body — or no body at all — is valid. Both fields are optional:
  • name becomes the key’s label in the dashboard.
  • email is the address of whoever will claim this sandbox later. It is never required and is not used for anything else.

What you get back

Keys expire after 7 days without use, and everything they created is sandbox data that is deleted with them. Any use resets the clock, so persist the key across runs rather than minting a new one each time.

Rate limits

This endpoint is capped per IP per day, plus a global daily ceiling.
  • 429 — daily cap reached. Reuse a key you already minted, or wait out Retry-After (the window resets at UTC midnight; X-RateLimit-Reset gives the exact timestamp).
  • 503 — the sandbox or its limiter is temporarily unavailable. The limiter fails closed rather than leaving an unauthenticated write path uncapped. Retry after Retry-After.
Treat 429 as “reuse what you have”, not “retry in a loop”. A minted key is good for 7 idle days, so an agent that stores its key needs the mint endpoint roughly once.

Body

application/json

Optional context for a sandbox key mint.

An empty body (or none at all) is valid — nothing here gates the mint.

email
string | null

(optional) Your operator's email address — we'll send them a link to claim this sandbox and its order history when they want a live account. Never used for anything else, and never required.

Maximum string length: 254
name
string | null

(optional) What this key is for, e.g. 'acme-shopping-agent dev testing'. Becomes the key's label.

Maximum string length: 100

Response

Sandbox key minted. The body is self-guiding: send api_key as a Bearer token, POST example_order to /orders as-is, and follow next.

A freshly minted sandbox key, with the next steps inline.

The response doubles as documentation: agents read the bytes they get back, not a docs site, so every field they need to proceed is here.

api_key
string
required

Sandbox API key (zn_test_...). Send as Authorization: Bearer <api_key> — test keys route to the sandbox automatically, no extra headers needed.

expires_policy
string
required
quickstart_url
string
required
example_order
Example Order · object
required

A complete valid body for POST /orders — try it as-is.

claim_url
string
required

Give this to the human you work for. Signing in there folds this sandbox — its order history and this key, which keeps working — into their Zinc account. Poll GET /sandbox/status to find out when they have.

next
string[]
required

What to do now, in order.