> ## Documentation Index
> Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Local API sandbox

> Exercise real API contracts against a disposable isolated database.

Use the local API sandbox to create, read and delete disposable resources without
production credentials or data. It runs the application from your checkout and
the canonical migrations against its own PostgreSQL database.

Requirements: Node.js 24, an EvalGate checkout, enough disk space for the image,
and local Docker Compose running Linux containers. The container kernel must
support nftables and the sandbox initialization capabilities. Startup fails
closed if its output policy cannot be installed.

```sh theme={null}
node scripts/sandbox.mjs start
```

The API is available at `http://localhost:3030`. Read the private local credential
from `.evalgate-runtime/sandbox/credentials.json` and configure your SDK with that
base URL and API key. The file is ignored by Git; do not upload it or use the key
with the production API. Use [OpenAPI](https://evalgate.com/docs/api-reference/openapi.json) for request
bodies and the same typed operations available in production.

Docker publishes the application port only on host loopback. PostgreSQL has no
host port and belongs only to the private data network. Before bootstrap, the
application container installs an IPv4 and IPv6 output policy allowing its
fixture database, local bootstrap traffic and API replies. Other outbound
connections and external DNS fallback are blocked. Provider calls, email,
billing and external integrations are unavailable. The serving application runs
as an unprivileged user with all capabilities dropped after private credential
publication. Fixture data is synthetic; this is a local test mode, with no public
hosted sandbox advertised.

```sh theme={null}
node scripts/sandbox.mjs status
node scripts/sandbox.mjs stop
node scripts/sandbox.mjs reset
```

Reset deletes only this checkout's sandbox database volume and fixture credentials.
The next start creates a fresh database and API keys. Run the executable acceptance
check to test the installed kernel policy, internal database access, blocked egress,
host API create/read/delete, rejected anonymous access, authenticated NLWeb streaming,
and credential and data isolation across reset:

```sh theme={null}
node scripts/verify-sandbox.mjs
```

This check builds and resets its disposable sandbox. It requires a local Docker
context; a remote Docker host is not supported by this acceptance check.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.