Environments
Sandbox and production: one base URL each, and what behaves differently between them.
Two hosts serve the same code. Which one you call decides the environment, and the credential has to match it.
| Hosts | What it means |
|---|---|
| Sandbox | https://sandbox.capvant.com/v1 for the Lender API, https://sandbox.capvant.com/partner/v1 for the Partner API. Nothing live can happen here: the Lender API shows and changes test deals only, and the Partner API accepts sandbox keys only (cv_pk_test_). A live credential gets 403 environment_mismatch, and a live deal simply does not exist on this host. |
| Production | https://api.capvant.com/v1 and https://api.capvant.com/partner/v1. Live keys and live deals, and, for integrators who prefer one host, sandbox keys and test deals too: sandbox data is isolated by the key and by the row, not only by the host. |
Every response carries X-Capvant-Environment: sandbox or live, and GET /ping reports the environment it answered in, so a wrong host is visible on the first call.
Lender API test deals. Testing does not need a staging clone: the same code path runs in both environments, so nothing changes at go-live. Create your own test deals self-serve with POST /test/deals. Each call creates one test deal for your account: a real record that behaves exactly like a live referral on every endpoint (status, offers, messages), but is unmistakably marked as a test and reaches no real client.
- Business name is prefixed
TEST -everywhere it appears, including in the Hub. - The contact email is on a non-resolving domain (
internal.invalid), so message notifications never leave our systems. - Financials and contact details are realistic placeholders, so scoring, formatting and display all behave normally.
Delete a test deal with DELETE /test/deals/{ref} once you are done with it. You can have at most 10 live test deals at a time; delete old ones to make room for new ones.
Partner API sandbox keys. A sandbox key exercises every Partner API endpoint end to end: leads are never routed, never emailed and never seen by a funding provider. Request one from your partner portal; it works on both hosts. See Partner API sandbox.
Webhooks are registered per account, not per host: an endpoint receives events for the deals its environment can see, and can be pointed at a staging receiver at any time; see Webhooks.