Exercise the integration without touching the outside world.

This console gives developers one mocked path through sandbox key setup, AOI creation, webhook preview, report download, and signature verification. Every state is backed by checked-in fixtures.

Explore API Open sandbox guide

Default target: sbox-mock
Endpoint: https://sbox.ucotron.com
Signature: verified_ed25519_offline

Appapp.ucotron.comPrimary Cortex console for portfolio workflows.Docsdocs.ucotron.comCanonical home for integration guides and API reference.APIdocs.ucotron.com#apiAPI entry point until production endpoints are separately approved.Sboxsbox.ucotron.comSandbox host for isolated review fixtures and scoped keys.Statusstatus.ucotron.comStatic public incident updates outside the primary Cortex stack.Trusttrust.ucotron.comSecurity posture, disclosure channel, and versioned subprocessors.

API

Mocked endpoints stay compatible with Cortex contracts.

Use the sandbox path to exercise request shape, response shape, and verification without production credentials.

Sbox mock: https://sbox.ucotron.com
Local mock: http://127.0.0.1:8787

Changelog

Public API changes are generated from the OpenAPI contract.

The local portal points at the generated changelog and GA lifecycle gate before SDK or insurer integrations consume a route.

Generated changelog: docs/api-changelog.local.md
Lifecycle gate: pnpm openapi:local:validate
GA policy: additive-only within /v1 unless deprecated or versioned

Sandbox

Integration flow is fixture-backed end to end.

The local guide mirrors the expected sandbox journey before any external provider is called.

Sandbox key: curl -sS https://sbox.ucotron.com/v1/sandbox/api-keys
AOI: curl -X POST https://sbox.ucotron.com/v1/aois
Webhook test: curl -sS https://sbox.ucotron.com/v1/sbox/webhooks/preview
Report fixture: packages/ingestion/src/fixtures/v1-reports-batch-local.fixture.json
Signature verify: ed25519:ucx-sec-002-local-fixture-001

Auth

Auth expectations are documented without provisioning.

Docs can explain the production posture while keeping this app free of secrets and runtime mutation.

WorkOS-compatible identity is the expected auth story for runtime docs, but this page does not provision an organization, connection, user, or token.
Sandbox examples use the checked-in fixture token placeholder only. It is not a credential and does not authorize real tenant data.
Production calls require tenant ownership, actor authorization, token ownership checks, revocation, and audit events before the endpoint is considered usable.

Trust

Trust sources are versioned before public publication.

The repo now owns the source for status, security disclosure, and subprocessors without changing DNS or runtime state.

Status: docs/runbooks/README.md#external-communications
Security: docs/trust/security.md
security.txt: apps/docs/public/.well-known/security.txt

Environment selector

Playground requests default to the sbox mocked API contract.

The default target is fixture-backed and uses placeholder auth only. Production API hosts are intentionally excluded from this selector.

Sbox mockhttps://sbox.ucotron.comDefault docs playground target. Synthetic fixtures only; no real claims, tenant data, or credentials.ucotron_fixture_token_non_secret

Local mockhttp://127.0.0.1:8787Optional local contract target for offline fixture review.ucotron_fixture_token_non_secret

Sandbox alias

sandbox.ucotron.com should resolve to sbox.ucotron.com.

Treat sbox.ucotron.com as the canonical sandbox surface. The longer sandbox.ucotron.com alias is expected to redirect or route to the same sandbox experience when DNS and edge routing are approved separately.

Fixture auth flow

Examples use placeholder auth against sbox/mock only.

curl

export UCOTRON_FIXTURE_TOKEN="ucotron_fixture_token_non_secret"
curl -sS https://sbox.ucotron.com/v1/sandbox/api-keys \
  -H "Authorization: Bearer $UCOTRON_FIXTURE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tenantId":"tenant_demo","mode":"sandbox_fixture_only"}'

Idempotency

curl -sS https://sbox.ucotron.com/v1/sbox/reset \
  -H "Authorization: Bearer ucotron_fixture_token_non_secret" \
  -H "Idempotency-Key: idem_sbox_reset_demo_001" \
  -H "Content-Type: application/json" \
  -d '{"reason":"developer_fixture_reset","datasetId":"sbox_dataset_demo"}'

Webhook

curl -sS https://sbox.ucotron.com/v1/sbox/webhooks/preview \
  -H "Authorization: Bearer ucotron_fixture_token_non_secret" \
  -H "Content-Type: application/json" \
  -d '{"eventType":"claim.created","targetUrl":"https://webhook.local.invalid/sbox"}'

JavaScript

import { createCortexApiClient, createSboxFixtureAuthHeaders } from "@ucotron-cortex/api-client";

const client = createCortexApiClient();
const dataset = await client.getSboxFixtureDataset();
const headers = createSboxFixtureAuthHeaders("ucotron_fixture_token_non_secret", "idem_sbox_demo_001");
console.log(dataset.metadata.datasetId, headers["idempotency-key"]);

Python

import os
import requests

token = os.getenv("UCOTRON_FIXTURE_TOKEN", "ucotron_fixture_token_non_secret")
response = requests.post(
    "https://sbox.ucotron.com/v1/sandbox/api-keys",
    headers={"Authorization": f"Bearer {token}"},
    json={"tenantId": "tenant_demo", "mode": "sandbox_fixture_only"},
    timeout=10,
)
print(response.json())

Verification gate

Signature fixture verifies locally.

`/v1/verify` recomputes the claims dossier evidence hash and checks an Ed25519 manifest signature with the published public key, without DB, network, or cloud runtime access.

No real credential is generated or stored.No webhook leaves the local fixture path.No database, queue, object storage, cloud runtime, or public sandbox deploy is used.Signature verification uses the checked-in public key and performs no DB, network, or cloud call.SBOX examples use placeholder bearer tokens and fixture idempotency keys only.