Onboarding

The tokens

The sandbox publishes three credentials. They are not secrets: they are placeholders in a fixture-only environment with no real data, and none of them is loaded from Secrets Manager.

Token	What for
`ucotron_fixture_token_non_secret`	Full access, reset included
`ucotron_fixture_token_readonly`	Read only — exercises the 403s
`ucotron_fixture_token_other_tenant`	Another organization — exercises the cross-tenant 404

There are three on purpose, not one. If you could only exercise the happy path, you would write your error handling by looking at this page, and you would find out it was wrong the day a real customer loses a permission.

Fuente del diagrama (mermaid)

sequenceDiagram
    participant I as Integrador
    participant S as sbox.ucotron.com
    I->>S: GET /v1/sbox/fixtures (Bearer token)
    S-->>I: 200 · dataset sembrado completo
    I->>S: GET /v1/portfolios?limit=1
    S-->>I: 200 · { data, page }
    I->>S: GET /v1/portfolios (sin Authorization)
    S-->>I: 401 · missing_bearer_credential

First call

bash

export SBOX=https://sbox.ucotron.com
export TOKEN=ucotron_fixture_token_non_secret

curl -sS "$SBOX/v1/sbox/fixtures" -H "authorization: Bearer $TOKEN"

It returns the whole dataset: portfolios, plots, clients, policies, events, detections, claims, adjustments, reports, alerts and webhooks. It is the map of everything you can exercise.

Tenancy

The x-ucotron-tenant-id header is optional. If present, it must match the credential's organization: a header that could override it would be the bypass itself.

What breaks

bash

# Another organization: 404, NEVER 403.
curl -sS "$SBOX/v1/portfolios" -H "authorization: Bearer ucotron_fixture_token_other_tenant"

A 403 would confirm the resource exists somewhere, and that confirmation is enough to enumerate other people's portfolios without reading a single byte of them. If your client treats 404 and 403 differently, treat the cross-tenant 404 as "does not exist".

Reset

reset.sh

curl -sS "$SBOX/v1/sbox/reset" -X POST \
  -H "authorization: Bearer $TOKEN" \
  -H "idempotency-key: reset-$(date +%s)" \
  -H "content-type: application/json" \
  -d '{"reason":"volver el sandbox al estado sembrado"}'

reason requires a 12-character minimum: the reset lands in the audit log, and an empty motive explains nothing six months later.