# Start a sandbox docs session
URL: https://musicapi.com/docs/reference/create-docs-sandbox-session.md

`POST https://api.musicapi.com/public/docs-sessions/sandbox`

Section: Get started.
Product: MusicAPI Core and MusicAPI Managed Transfers.
Auth: none.

For "Try it" without signing in. The token lives 1 hour and acts as the `demo` account, 30 calls per minute. 30 sessions per hour per IP.

Without a body the token reaches the operations marked `x-docs.sandbox: "catalog"`: the catalog reads and its own session routes, with the demo and sample users only.

With `authModelUUID` the token is bound to the account that the visitor connected through the hosted sign-in of the `demo` account (`authModel.uuid` of `data64`). It then also reaches every operation marked `x-docs.sandbox: "connectedUser"`, for that connected user only: another uuid answers 404. The sign-in must have succeeded, must be at most 15 minutes old, and opens one session only. Erasing the user, `refreshAuthToken`, transfers and transfer sessions stay refused.

## Request body

`application/json`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `authModelUUID` | uuid | no | The `authModel.uuid` of a hosted sign-in of the `demo` account, at most 15 minutes old. Used once. |

## Response 200

OK

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `token` | string | yes | Send it as `Authorization: DocsSession <token>`. |
| `expiresAt` | date-time | yes |  |
| `account` | DocsSessionAccount | yes |  |
| `account.name` | string | yes |  |
| `account.slug` | string | yes |  |
| `account.clientId` | uuid \| null | yes | Your oldest live Client ID. Never a Client Secret. |
| `account.returnUrls` | string[] | yes |  |
| `account.isEvaluationAccount` | boolean | yes | True while the account is capped at 5 connected users. |
| `account.isTransferServiceEnabled` | boolean | yes | True when MusicAPI Managed Transfers is on for the account. |
| `account.enabledIntegrations` | string[] | yes |  |
| `connectedUser` | DocsConnectedUser \| null | yes | The connected account of a bound session. `null` without `authModelUUID`. |
| `connectedUser.uuid` | uuid | yes | The `integrationUserUUID` of the account. |
| `connectedUser.integrationType` | string | yes | The service, for example `spotify`. |
| `connectedUser.name` | string \| null | yes |  |
| `connectedUser.imageUrl` | string \| null | yes |  |

```json
{
  "token": "string",
  "expiresAt": "2026-10-16T09:41:07.000Z",
  "account": {
    "name": "Acme Music",
    "slug": "acme",
    "clientId": "5b0c6f0e-2c8a-4d0e-9a51-7e3f1c2d9b44",
    "returnUrls": [
      "string"
    ],
    "isEvaluationAccount": true,
    "isTransferServiceEnabled": true,
    "enabledIntegrations": [
      "spotify"
    ]
  },
  "connectedUser": {
    "uuid": "5b0c6f0e-2c8a-4d0e-9a51-7e3f1c2d9b44",
    "integrationType": "string",
    "name": "string",
    "imageUrl": "string"
  }
}
```

## Errors

- 400: `invalidAuthModel`: the sign-in is unknown, failed, of another account, older than 15 minutes, has no connected user, or already opened a session. Connect the account again.
- 429: Too many sandbox sessions from this IP.

## Example

```bash
curl -X POST "https://api.musicapi.com/public/docs-sessions/sandbox" \
  -H "Content-Type: application/json" \
  -d '{"authModelUUID":"5b0c6f0e-2c8a-4d0e-9a51-7e3f1c2d9b44"}'
```