Sandbox
A full copy of the RoofAngle API loaded with dummy data. Orders placed here are never dispatched, never delivered by a real technician, and never billed.
Base URL: https://sandboxclient-api.roofangle.com
Get credentials
Create a sandbox account and confirm the 6 digit code we email you, then your client ID and secret are issued on the spot. No sales call required.
Your client ID stays on your account page afterwards. The secret is shown only when it is issued.
Try it in the browser
The GET endpoints in the v4 and v1 reference carry a Send button. Paste your client ID and secret once and the page calls the sandbox for real, showing the status and response. Credentials stay in memory for that tab and are never stored, so a reload asks again.
What sandbox keys can do
Sandbox credentials are restricted to the public integration surface:
They cannot reach the RoofAngle dashboard API, other tenants' data, or production. Rate limits are lower than production.
Dummy data
The sandbox is seeded with example services, so you can list them and place an order straight after signup without waiting on a real measurement. Orders and their files are the ones you create yourself.
Payments
The sandbox uses Stripe test mode. Use Stripe's test cards (e.g. 4242 4242 4242 4242) when exercising the v1 checkout flow.
How sandbox orders progress
Nobody at RoofAngle touches a sandbox order. Every order you place walks itself through the lifecycle on a timer, so you can exercise the full flow and every webhook without waiting on a real measurement.
| After | What happens | Webhook |
|---|---|---|
| immediately | Order accepted | order.created |
| 1 minute | Moves into progress | none |
| 2 minutes | On every second order, RoofAngle amends it, for example switching the property type or adding a PDF and repricing | order.updated |
| 3 minutes | Moves into QA | none |
| 5 minutes | A sample report is attached and the order completes | order.delivered |
Status moves on its own do not raise order.updated. That event means the details of your order changed, so its payload carries the fields that changed and their old and new values. Poll GET /v4/orders/{orderId} if you want the intermediate states.
Not every order is amended, and not every order is delivered. Your first five orders cover every path:
| Your order | What happens |
|---|---|
| 1 | delivered untouched |
| 2 | amended at 2 minutes, then delivered |
| 3 | delivered untouched |
| 4 | amended at 2 minutes, then delivered |
| 5 | cancelled at 2 minutes |
That is deliberate. It means you can test a clean delivery, an amended one and a cancellation without having to ask anyone to set them up, and it keeps amendments as the exception they are in production. The pattern then repeats: order 6 is amended, order 10 is cancelled, and so on.
The delivered file is the same sample report every time. It downloads through the normal Files API, so presigned URLs, the ZIP download and the 24-hour token from the order.delivered payload all behave exactly as they do in production.
Email
The sandbox sends the same emails as production, from the same address, using the same templates: order confirmation, delivery, cancellation and the rest. Two things differ.
Every subject is prefixed [TEST], and every email goes to the address you signed up with, never to the customerEmail on the order. So you can see exactly what your customers will receive without a real person being contacted:
[TEST] Your RoofAngle order is confirmed (intended for jane@customer.com)Regenerate your secret
Lost your secret? Regenerate it from your account page, or request a new one with your account email and password:
bash
curl -X POST https://sandboxclient-api.roofangle.com/sandbox/regenerate \
-H "Content-Type: application/json" \
-d '{"email": "you@company.com", "password": "YOUR_PASSWORD"}'The previous secret stops working immediately.
Going to production
Production is https://client-api.roofangle.com and uses separate credentials issued by RoofAngle. When you're ready, email support@roofangle.com. Your integration code doesn't change, only the base URL and credentials.