Sandbox & access

Build and test against synthetic members before you touch real data. A sandbox is a private copy of your market's setup: a medical practice, a gym, a hospital, a military unit (or a first-responder organisation), or for EMR vendors a vendor credential plus two practices that have already approved it, so you can try the multi-practice flow. Sandbox kinds today: practice, gym, vendor, hospital, unit, pharmacy, care_facility, travel, pediatric, employer, medspa.

What is in it

Each organisation holds 16 synthetic members. None is a real person: names come from a made-up pool, addresses use the reserved example.invalid domain, and record numbers start HTEST-SBX-. They follow 12 stories, among them a member on a GLP-1 who does no strength training, a GLP-1 member losing muscle, an overreaching lifter, type 2 diabetes while trying to conceive, uncontrolled blood pressure, high LDL with no statin, diabetic kidney disease with a falling eGFR, overdue diabetes and thyroid monitoring, and a member who stopped coming in. Two members do not share home readings with you, so you can see how consent filtering looks.

What returns data

Members, trainer guidance and the at-risk roster; for practices the worklist (one run is already done when you get the sandbox), care gaps, between-visit signals, the pre-visit brief, CDS Hooks cards and the brief document, patient match (we send you a few record number and birth date pairs), population summary, measures and QRDA III, both bulk exports, and a few hospital and ED notices with their Transitional Care Management clock.

A hospital sandbox also holds post-discharge episodes at different days across heart failure, COPD, heart attack, pneumonia, joint replacement and general discharges: red-flag check-ins, a medicine list still to reconcile, a readmission, an ED return and one episode opened by an ADT discharge message, so the worklist, episode detail, write-back calls, outcomes and the ADT endpoint all answer.

Practice and hospital sandboxes also carry the public-health family: an immunization registry connection, a few doses (one that the registry would refuse as uncoded), two case-report candidates (one the member keeps closed, so you see the clinician-only override) and two syndromic visits (one without a chief complaint, which is never sent). Every public-health transmission in a sandbox is simulated: the registry acknowledgement, the history query's synthetic doses, the Reportability Response (which says plainly that it is not a determination) and the syndromic message are produced by Norvya, nothing reaches a state system even if a real address is configured, and each answer carries simulated: true.

Practice sandboxes also carry the billing and scheduling family: appointments booked in Norvya (one completed, two upcoming, one cancelled) and one sent the way a practice system sends it (your own id SBX-PM-0001), care-management minutes for CCM (over its first mark), PCM (short of it) and RPM (with simulated device readings, flagged as such), and one Good Faith Estimate with synthetic identifiers. No appointment reminder ever reaches a synthetic member. Population counts below the small-cell minimum are withheld, and with a panel this small many of them will be: that is the real rule working, not missing data.

Specialty, life-stage, employer and med-spa data

Every practice sandbox also holds: a synthetic older adult (a raised falls tier, CPAP nights and a care dyad); a behavioral-health caseload with PHQ-9 and GAD-7 trends (one member on the caseload does not share, so is counted and never shown), homework, a Collaborative Care episode with documented consent and a signed progress note; an oncology treatment summary imported and committed, plus a second staged draft; a knee replacement PT episode, a dysphagia episode with IDDSI levels and a dietitian client with MNT hours; two tracked lesions (one recheck due, no image bytes), HS and acne assessments and a patch test with its 48-hour read; and one small staged roster whose commit simulates the invitations (no email is sent). Skin-classifier calls in a sandbox always answer 409 skin_classifier_not_enabled.

A pediatric sandbox adds a synthetic family: a guardian who shares a four-month-old with growth points, so the life-stage calls answer. An employer sandbox is an employer plus the practice that examines its workers: synthetic employees enrolled in a GLP-1 programme, a finished and a running challenge, occupational exams (one released, one pending, one coming due) and a work injury; its group figures clear the small-cell minimum. A medspa sandbox has clearances (one decided with a flag, one awaiting review), two treatments with aftercare check-ins, a confirmed adverse event and a retreatment coming due.

Unit sandbox

A military unit (or, on request, a first-responder organisation) holds 16 synthetic service members instead of the clinical stories: a month of simulated resting heart rate, heart-rate variability and sleep, five weeks of rated training sessions, and duty profiles recorded the way a unit's care team records them. Five members show an illness-like deviation from their own baseline, two a smaller one, five spike their training load in the last week, five are on limited duty and one in quarters, and two do not share biometrics with the unit at all. So GET /v1/population/readiness answers real counts with some cells withheld (the small-cell rule again), never an individual, and projection.available is always false. Its credentials hold programs.readiness.read plus the common scopes; the practice families answer not_a_medical_practice.

Credentials

Sandbox client ids start nvy_sbx_. Same base URL, same token endpoint, same scopes as production. A sandbox credential can only reach its sandbox, and a production credential can never reach a sandbox; both are checked on every call.

Exports and imports

Every exported FHIR resource carries the HL7 HTEST security label and a synthetic tag. Anyone you import into a sandbox becomes a synthetic member, whatever your file says. ADT messages that match none of the sandbox's synthetic members are counted as unmatched and discarded, never stored, so never point a real feed at sandbox credentials.

Webhooks and nudges

Webhooks are delivered to your HTTPS endpoint as in production (payloads carry no health information either way). Gym nudges are recorded, with the same 14-day limit, and answered with simulated: true; no notification is sent to anyone.

Limits, resets and expiry

Sandbox calls show in GET /v1/usage with environment: "sandbox" and are never billed. The rate limit is lower than production. Ask and we reset it: new synthetic members; webhooks, exports, staged imports, invitations, join codes and message threads cleared; credentials unchanged. A sandbox expires 60 days after it is created.

The data is plausible, not epidemiological: it is there to exercise the API, not to judge clinical performance.

Get access

Clinical content is decision support for a licensed clinician, not a diagnosis. A business associate agreement is required before protected health information is exchanged.