SANDBOX_ENDPOINT_NOT_ALLOWED
The sandbox key does not answer this endpoint
The request carried the published sandbox key, which answers a handful of read-only lookups and nothing else.
- http status
- 403
- credits
- Nothing is billed for a failed request.
What it means
The sandbox key is printed in the documentation, so everybody has it. It answers POST /api/v1/email, POST /api/v1/phone, POST /api/v1/ip, GET /api/v1/ip/{ip}, POST /api/v1/address and refuses every other endpoint — anything that would spend credits, write something that lasts, read an account, or send a request somewhere on your behalf.
It is not attached to an account at all, so a sandbox call has no balance, no history and no key policy; meta.credits_remaining answers null and meta.sandbox is true.
What to do
Create an account and use your own sk_live_ key for this endpoint. The sandbox exists to make the first request runnable, not to be an anonymous tier.
Example response
{
"success": false,
"error": {
"code": "SANDBOX_ENDPOINT_NOT_ALLOWED",
"message": "The sandbox key answers POST /api/v1/email, POST /api/v1/phone, POST /api/v1/ip, GET /api/v1/ip/{ip}, POST /api/v1/address. Every other endpoint needs a key of your own.",
"request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
}
}Every error carries the request_id also sent in the X-Request-Id header; quote it when writing to support.
Related
- ORIGIN_NOT_ALLOWED · the page's origin is not on the key's allowed list
- KEY_IP_NOT_ALLOWED · the key is used from an address outside its allowlist
- KEY_ACCOUNT_MISMATCH · the key belongs to an account its holder has left
- KEY_SCOPE_DENIED · the key lacks the scope this endpoint needs
- SANDBOX_VALUE_NOT_ALLOWED · the sandbox key does not answer for that value
- TURNSTILE_FAILED · the publishable key requires a Cloudflare Turnstile token
- EMAIL_NOT_VERIFIED · the account behind the key has not confirmed its email address
- All error codes
- Verdicts and the risk score
- API reference
markdown version: /docs/errors/SANDBOX_ENDPOINT_NOT_ALLOWED.md