Sandbox

The sandbox is a complete, separate copy of Clive that holds only synthetic data. It runs the same code and the same database migrations as production, and it is updated first: every change reaches the sandbox before it reaches production. Build and test your integration here.

GET /health on the sandbox API answers "env": "sandbox", and every page of the sandbox web app shows a "Sandbox — synthetic data" marker, so you can always tell which environment you are talking to.

Getting access

Ask your Clive partnerships contact for sandbox access. You receive:

• An API client for the sandbox clinic group: a client ID and a client secret (OAuth 2.0 client credentials) with the scopes you need (Getting started). Sandbox credentials never work in production; production credentials are issued separately when you go live.
• Your inbound URL and inbound signing secret, if your platform will send events to Clive (Partner contract v1).
• Optionally, a staff login to the sandbox web app (your contact sends its address), so your team can see the clinic side of what your integration does: the calendar, the member record, the voucher redemption.

Never put real personal data in the sandbox. Use made-up names, example.com email addresses and obviously fake identity numbers.

The sandbox clinic group

The sandbox holds one partner clinic group with:

• three branches (venues), each with a doctor, a nurse and a front desk working Monday to Saturday;
• about 50 synthetic members and about 330 appointments, from 30 days in the past to 14 days ahead.

Synthetic members are easy to recognise: names built on "Contoh", "Ujian" and "Sampel" (Malay for "example", "test" and "sample"), identity numbers with the unassigned place-of-birth code 00 (YYMMDD-00-NNNN), phone numbers +60 10-000 0NNN and member.NN@example.com email addresses.

You can create and change data freely. Clive can reset the sandbox clinic group to its seeded state on request, so don't rely on records you created staying there for ever.

What behaves differently

The sandbox runs the production code paths with sandbox configuration. Everything in the API behaves as in production, including rate limits, idempotency, webhook retries and the consent gate. The differences are only in the outside services:

• Payments use Stripe test mode. Use Stripe's test cards; nothing is charged.
• e-Invoices go to LHDN's MyInvois pre-production system and have no tax effect.
• WhatsApp messages go through a Meta test number, which delivers only to phone numbers on its allow list. Ask us to add your test phones.
• Webhooks are delivered to your registered HTTPS endpoints exactly as in production, so you can test your receiver end to end.

Status

The sandbox API reports its own health at GET /health and its status, components and incidents at GET /api/v1/status. The public status page shows production.

Going live

When your integration works in the sandbox:

1. Tell your partnerships contact which clinic groups you will connect to and which scopes you need.
2. Each clinic group's admin creates a production API client for you, and an inbound signing secret if you send events.
3. Register your production webhook endpoints with the production client. Endpoints and secrets are not copied from the sandbox.
4. Switch $API to https://api.clivehealth.app and deploy the production credentials.