Free integration sandbox

Test your integration before using real funds

Make real HTTP requests against a separate, synthetic API. Explore order states, retries and signed webhook fixtures without a production key or account.

Sandbox base URL: https://ludovex.org/api/sandbox/v1. Use ludovex.org; the api.ludovex.org domain does not serve this sandbox.

Try an HTTP session

Start a temporary session with 100.00 TEST_USDT. This page calls the same HTTP routes as the downloadable examples.

Test environment only. No money, real orders, customer data, email or provider requests. Never enter production keys or player details.

HTTP response

Start a session to see synthetic API responses here.

Deterministic scenarios

Immediate completion

201 COMPLETED; deducts 3.25 TEST_USDT and creates order.completed.

success

Delayed completion

201 PROCESSING; becomes COMPLETED on the first status, list, balance or event read after five seconds.

delayed

Failure with refund

201 PROCESSING; after five seconds, a read produces order.failed then order.refunded. Status is REFUNDED and 3.25 TEST_USDT is returned once.

failed_refund

Insufficient test balance

The fixture costs 1000.00 TEST_USDT. Returns 402 INSUFFICIENT_BALANCE without creating an order or deducting funds.

low_balance

Duplicate / idempotency

Repeat the identical request with the same key: the same order is returned, with no second debit. Reuse the key for another scenario: 409 IDEMPOTENCY_CONFLICT.

idempotency_key

HTTP quick start

POST /sessions with {} and Content-Type: application/json. Keep api_key and webhook_secret in memory. Send X-Sandbox-Key on subsequent calls. Production Authorization and X-API-Key headers are rejected.

curl --fail-with-body https://ludovex.org/api/sandbox/v1/sessions \
  -H 'Content-Type: application/json' -d '{}'

curl --fail-with-body https://ludovex.org/api/sandbox/v1/order \
  -H 'Content-Type: application/json' \
  -H 'X-Sandbox-Key: REPLACE_WITH_TEST_SESSION_KEY' \
  -d '{"game_key":"sandbox_game","variation_id":"sandbox_pack","scenario":"delayed","idempotency_key":"example-order-001"}'

Orders accept only game_key, variation_id, scenario and idempotency_key. Use the two fixture identifiers below; no player_id or account fields. The body key takes precedence over an optional Idempotency-Key header.

Available routes
POST /sessions	Create an anonymous test session.
GET /catalog	Read the single synthetic product.
GET /balance	Read test balance and settle due fixtures.
POST /order	Create an order using a scenario and an 8–80 character idempotency key (letters, digits, _ or -).
GET /order/{id}	Read this session’s order status.
GET /orders	List this session’s orders (at most 20; no pagination).
GET /events	List this session’s event identifiers; settles due fixtures.
POST /events/{id}/replay	Return exact raw_body and signed headers; does not send a webhook.
DELETE /session	Delete the session immediately.

Verify and replay without sending

Replay returns a fresh timestamp and signature for the same raw body and stable X-Ludovex-Delivery-Id. Verify HMAC-SHA256 over timestamp + "." + raw_body, reject timestamps more than 300 seconds old or in the future, and compare signatures in constant time. Verify before parsing or acting on the body.

The samples use a temporary SQLite inbox to demonstrate durable, atomic deduplication of a verified delivery and its synthetic effect. Replaying the same delivery must not perform the effect twice. A real receiver needs its own persistent database and a transaction or outbox covering real business effects.

No URL is accepted and no webhook is sent. Replay fixtures let you test your verifier locally; they do not validate network delivery, retries from a worker or your production webhook endpoint.

Run the complete integration checks

No dependencies: Node.js 24+ or Python 3.10+. Each script creates its own test session, checks all scenarios and signature/deduplication, then closes the session. It prints results without keys. No real webhook is sent.

Download Node.js example Download Python example

Run the downloaded file with node ludovex-sandbox.mjs or python3 ludovex-sandbox.py. Both default to the main-domain sandbox. SANDBOX_BASE_URL may point only to this sandbox or a local HTTP sandbox for development.

Limits and differences from production

Sessions expire after 30 minutes and disappear on process restart. Each has 20 orders, up to 40 events and 60 requests per minute. Session creation allows 5 per IP hint in 10 minutes; global capacity is 250 sessions and 2000 requests per minute. JSON bodies are limited to 2048 bytes and five seconds. Limits return 429 with Retry-After where available.

This is a separate contract with deterministic fixtures and temporary single-process state. It is not a production API emulator or an availability guarantee. Settlement happens when you read, not in a background worker. No real catalogue, quota, provider validation, payments or production credentials are used.

Read the production API contract