# Sandbox & production

> Integrate against the sandbox with fixed test names; go live by changing the host and the key.

- **HTML:** https://offendersearch.app/docs/platform/environments
- **Base URL (live):** https://api.offendersearch.app — live keys (`os_live_…`)
- **Base URL (sandbox):** https://sandbox.offendersearch.app — test keys (`os_test_…`), never billed
- **Authentication:** `X-API-Key` request header
- **OpenAPI:** https://offendersearch.app/openapi.json · https://offendersearch.app/openapi.yaml
- **Docs index for agents:** https://offendersearch.app/llms.txt

## The two environments

|  | Sandbox | Production |
| --- | --- | --- |
| Host | `https://sandbox.offendersearch.app` | `https://api.offendersearch.app` |
| Keys accepted | `os_test_…` only | `os_live_…` only |
| Data | Fixed test scenarios per product (fixed names, fixed outcomes) | Real records |
| Billing | Never | Per call, per live source, per document, per monitor — extras itemised in `meterEvents[]`, totals in the dashboard |
| Response shape | Identical to production, plus `"sandbox": true` | Production |
| Rate limits | Lower; enough to integrate | Account limits; `429` with `Retry-After` when exceeded |

> **Note.** A test key sent to the live host, or a live key sent to the sandbox, answers `401`. The prefix tells you which host a key belongs to.

## Fixed test names

Each product publishes the test names the sandbox answers and what each one returns — a clear result, a possible match, a confirmed match, an incomplete source, an error. Use them to exercise every branch of your code before you spend a live call.

- [Sex Offender sandbox scenarios](https://offendersearch.app/docs/sandbox)
- [Criminal Records sandbox scenarios](https://offendersearch.app/docs/criminal/sandbox)
- [Monitoring sandbox scenarios](https://offendersearch.app/docs/monitoring/sandbox)
- [Map API sandbox](https://offendersearch.app/docs/map/sandbox)
- [FCRA sandbox](https://offendersearch.app/docs/fcra/sandbox)

## Switching to production

```bash
# development
export OFFENDERSEARCH_BASE=https://sandbox.offendersearch.app
export OFFENDERSEARCH_API_KEY=os_test_…

# production
export OFFENDERSEARCH_BASE=https://api.offendersearch.app
export OFFENDERSEARCH_API_KEY=os_live_…
```

Nothing in the request or the response parsing changes. Before the switch, run the [production checklist](/docs/platform/operations#production-checklist).