Sandbox, rate limits & webhooks

After your use case is approved and the NDA is signed, you get a sandbox key (AU or GCC) and a dashboard login. Interactive reference lives at the OpenAPI Swagger UI.

Interactive docs

• Swagger UI packs: EvalExpert · DriveExpert · AU data · GCC data
• OpenAPI JSON: AU · GCC · EvalExpert · DriveExpert

Sandbox rate limits

Sandbox keys share production infrastructure but are capped at 50 calls/day and 500 calls/month, with a region-scoped endpoint allowlist (AU keys cannot call GCC endpoints and vice versa).

Test data

Australia

• VIN: WAUZZZ8T6GA014860
• VIN: 6G1EK52H35L123456

GCC

• VIN: JTMRFREV0D5123456
• Price guide: use your sandbox key against POST /v1/gccpriceguide

Webhook signature verification

Outbound webhooks include:

• X-AlgoDriven-Timestamp — unix seconds
• X-AlgoDriven-Signature — sha256=<hex>
• X-AlgoDriven-Event — trigger name

Compute HMAC-SHA256(signing_secret, "{timestamp}.{raw_body}") and compare to the signature hex. Reject requests whose timestamp is older than ~5 minutes.

const crypto = require('crypto');
function verify(rawBody, timestamp, signatureHeader, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

← Back to developers · Request API access