Sandbox and Live (Account Mode)

“Sandbox” has two different meanings in MorisBox:

Concept	Meaning
Deployment hosts	Shared environment (`api.morisbox.com`, Partner Hub, and Client Application)
Account sandbox	Per partner: outbound messages limited to one test phone

This page covers the account Sandbox / Live mode.

Default: Sandbox

Every new partner starts in Sandbox:

You can send only to one allowed E.164 phone (sandbox_allowed_phone)
Broadcasts are blocked
Flow invitations and agent chat use the same phone restriction
The seed360 platform partner is always Live (OTP / system)

Configure your test phone

Partner Hub → Settings → Sandbox / Live, or:

PUT /api/v1/settings/sandbox
Authorization: Bearer sk_…
Content-Type: application/json

{
  "sandbox_allowed_phone": "+228XXXXXXXX"
}

Then:

POST /api/v1/messages
Authorization: Bearer sk_…
Content-Type: application/json

{
  "phone": "+228XXXXXXXX",
  "body": "Hello sandbox"
}

Sending to any other number returns 403 with error.code = sandbox_restricted.

Request Live

When you are ready for production traffic:

POST /api/v1/settings/sandbox/request-live
Authorization: Bearer sk_…
Content-Type: application/json

{
  "note": "Production launch for SEED notifications"
}

A MorisBox platform administrator must approve the request. You remain in sandbox until then.

Hub: Sandbox / Live → Request Live.

Administration (platform partner)

Platform operators can:

Action	Effect
Approve Live	`sandbox_mode=false`
Reject exit	Remain in sandbox with exit status `rejected`
Reset Sandbox	Force sandbox again (for example, after KYC issues) while retaining the test phone

API (seed360 admin key):

GET  /api/v1/admin/sandbox
POST /api/v1/admin/sandbox/partners/{id}/approve-live
POST /api/v1/admin/sandbox/partners/{id}/reject-live
POST /api/v1/admin/sandbox/partners/{id}/reset

Hub: Sandbox administration (platform only).

Hosts (deployment)

Service	URL
Partner API	`https://api.morisbox.com/api/v1`
Partner Hub	`https://partner.morisbox.com`
Partner docs	`https://docs.morisbox.com/partners`
Developer docs	`https://developers.morisbox.com/developers`
Client Application	`https://morisbox.com`

There is no shared public API key. Each partner uses its own credentials.

Partner smoke-test checklist

New partner → sandbox by default
POST /messages without an allowed phone → 403 sandbox_restricted
Set the allowed phone → send to it → 201
Send to another number → 403
POST /broadcasts in sandbox → 403
Request Live → administrator approval → send to any phone

Partner curl (sandbox)

export SEED360_API_BASE="https://api.morisbox.com/api/v1"
export SEED360_API_KEY="sk_…"

curl -sS -X PUT "$SEED360_API_BASE/settings/sandbox" \
  -H "Authorization: Bearer $SEED360_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sandbox_allowed_phone":"+228XXXXXXXX"}'

curl -sS -X POST "$SEED360_API_BASE/messages" \
  -H "Authorization: Bearer $SEED360_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+228XXXXXXXX","body":"Hello MorisBox"}'