Sandbox & testing

The sandbox is a full copy of the Partner API for building and testing. It uses the same base URL, https://api.physioaroundme.com/v1, and you reach it with a sk_test_ key. You get sandbox access once Rehabify approves your organisation. Create keys in the Partner Portal under Developers → API keys.

There are no shared or public sandbox keys. Use your own.

What sandbox never does

• It never contacts patients, and never sends emails or WhatsApp messages to them.
• It never earns commissions. GET /partners/commissions returns an empty list, and earnings in GET /partners/commercial are always zero.
• It never uses real providers. Matched providers are simulated as { "name": "Sandbox Physiotherapist", "license_number": "SANDBOX-0001" }.
• It never mixes with live. Sandbox referrals, links and webhooks are invisible to live keys, and sandbox events go only to your sandbox webhook endpoint.

The sandbox rate limit is 10 requests per second.

Magic phone numbers

Use these values for patient.phone on POST /partners/referrals with a test key, to simulate different journeys. Each status change fires the matching webhook, just like in live.

Advance a referral

POST /sandbox/referrals/{id}/advance

Moves a sandbox referral to a new status and fires the same webhooks a real transition fires. {id} is the sandbox referral's id or tracking_code. With a live key, this endpoint returns 403 sandbox_only.

Rules:

• Statuses only move forward: received → contacted → booked → in_treatment → completed. not_suitable, cancelled and closed end the journey.
• Moving backwards, or out of a terminal status (completed, not_suitable, cancelled, closed), returns 422 invalid_status_transition.
• Advancing to booked when no provider is matched yet fires referral.provider_matched first, then referral.booked. The provider is the simulated Sandbox Physiotherapist.

TRACKING_CODE="RHB-0123456789"   # a sandbox referral that is still "received"
curl "https://api.physioaroundme.com/v1/sandbox/referrals/$TRACKING_CODE/advance" \
  -X POST \
  -H "Authorization: Bearer $REHABIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "status": "booked" }'

Response: 200 OK with the updated referral object.

Errors: 403 sandbox_only (live key), 404 referral_not_found, and 422 invalid_status_transition or validation_error.

Trigger a test webhook

POST /sandbox/trigger-webhook

Sends a signed test event to your sandbox webhook endpoint. It's signed with your sandbox secret and has the same format as real events. With a live key, this endpoint returns 403 sandbox_only. You can also send test events from the portal.

curl https://api.physioaroundme.com/v1/sandbox/trigger-webhook \
  -X POST \
  -H "Authorization: Bearer $REHABIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "type": "referral.booked" }'

{
  "object": "webhook_test",
  "event_id": "evt_01JA4W6X8Y0Z2A4B6C8D0E2F4G",
  "type": "referral.booked",
  "status": "queued",
  "endpoint": "https://example.com/webhooks/rehabify"
}

The delivered event has data.previous_status: null, data.sequence: 0 and data.test: true. A ping carries data.message: "Test event from Rehabify" and a data.referral. See Test events. Test events don't change the referral.

Errors: 403 sandbox_only (live key), 404 referral_not_found (unknown referral_id), 409 webhook_endpoint_not_configured (no sandbox endpoint is set), and 422 validation_error (unknown type).

Other endpoints in sandbox