specification: API Commons Sandbox
specificationVersion: '0.1'
provider: SoFi Technologies
providerId: sofi-technologies
generated: '2026-09-06'
method: searched
source: https://docs.tech.sofi.com/pro/docs/environments
docs:
  - https://docs.tech.sofi.com/pro/docs/environments
  - https://docs.tech.sofi.com/pro/docs/quickstart
  - https://docs.tech.sofi.com/pro/docs/build-a-sample-app
  - https://docs.tech.sofi.com/pro/docs/postman-setup
description: >-
  SoFi Tech Solutions runs a three-tier environment ladder rather than a test-key toggle. There is
  no test/live key prefix - the environment is selected by the hostname, and credentials are
  issued per environment. The shared Sandbox uses a fixed standard program and product so every
  client starts from the same configuration; Client Validation runs the client's own program with
  no real money; Production moves real funds.
key_model:
  test_live_prefixes: false
  note: >-
    Credentials are apiLogin / apiTransKey / providerId, issued by SoFi Tech Solutions and bound
    to the requesting IP address. They carry no environment marker - the environment is the host,
    so a production credential pointed at a cv host simply fails rather than silently going live.
  environment_selector: 'the {env} URI segment - cv = client validation, pd = production'
environments:
  - name: Sandbox
    real_funds: false
    real_customer_data: false
    configuration: shared standard program and product
    base_url: https://sandbox-api.gpsrv.com/intserv/4.0/
    dashboard: https://sandbox.gpsrv.com/
    access_request: https://www.galileo-ft.com/request-access/
    access_request_resolves_to: https://tech.sofi.com/lp/request-access/
    test_program_id: 6914
    test_product_id: 2769
    rate_limit: 1000 API requests every 10 minutes
    credential_rotation: >-
      New Sandbox API credentials are required after 30 days and must be generated by the
      company's Sandbox team admin. Using stale details fails the request and can lock the
      company account.
    transport_security: client certificate validation on Sandbox API calls
    note: >-
      Only a subset of Program API methods is available in Sandbox - see sandbox_operations.
  - name: Client Validation
    env_token: cv
    real_funds: false
    real_customer_data: false
    configuration: the client's own programs and products
    base_url_form: https://api-{corename}.cv.gpsrv.com/intserv/4.0/
    credentials: issued by SoFi Tech Solutions on setup, not available from the Sandbox dashboard
  - name: Production
    env_token: pd
    real_funds: true
    real_customer_data: true
    base_url_form: https://api-{corename}.pd.gpsrv.com/intserv/4.0/
    note: >-
      Only Production has access to real-world transactions - ATM withdrawals, refunds, ACH
      direct deposits.
sandbox_operations:
  accounts_and_cards:
    - post_addcustomernote
    - post_completeenrollment
    - post_createaccount
    - post_createaccounttransfer
    - post_createadjustment
    - post_getaccountbyid
    - post_getaccountcards
    - post_getaccountfeatures
    - post_getbalance
    - post_getcard
    - post_getcustomernotehistory
    - post_getenrollmentinfo
    - post_modifystatus
    - post_searchaccounts
    - post_setaccountfeature
    - post_startenrollment
  note: >-
    This list is the Accounts and Cards group as published on the Environments page. The page
    lists further groups; only the operations quoted verbatim above are recorded here, and every
    operationId was verified to exist in openapi/sofi-technologies-program-api-openapi.json.
simulation:
  supported: true
  mechanism: dedicated simulation endpoints in the Program API, not a per-request dry-run flag
  operations:
    - { operationId: post_createsimulatedcardauth, purpose: simulate a card authorization }
    - { operationId: post_createsimulatedcardsettle, purpose: simulate a card settlement }
    - { operationId: post_createsimulatedachtransaction, purpose: simulate an incoming ACH transaction }
    - { operationId: post_cancelsimulatedachtransaction, purpose: cancel a simulated incoming ACH transaction }
    - { operationId: post_getallsimulatedachtransactions, purpose: list simulated ACH transactions }
  docs: https://docs.tech.sofi.com/pro/docs/setup-for-card-transaction-simulation
test_values:
  cards: []
  bank_accounts: []
  note: >-
    SoFi Tech Solutions publishes NO test card numbers, test routing/account numbers or hosted
    test tokens. Test artifacts are generated inside the caller's own Sandbox program
    (prog_id 6914 / prod_id 2769) by calling Create Account and the simulation endpoints. The
    only fixed published test values are the program and product ids above. No test value has
    been invented for this record.
time_simulation:
  supported: false
  note: >-
    No test clock or time-travel facility is documented. Interest accrual, statement cycles and
    ACH settlement run on the platform's real clock, which is Arizona Standard Time (GMT-0700,
    no daylight saving).
tooling:
  postman:
    collection_name: Galileo Pro Collection
    public: true
    run_url: https://app.getpostman.com/run-collection/34743689-ba1d0d97-688c-43f9-9627-3edda0f24bcb
    workspace: https://www.postman.com/galileo-ft/workspace
    last_updated: '2026-07-22'
    variables: [apiLogin, apiTransKey, providerId, prodId, programId, url, responseContentType]
    docs: https://docs.tech.sofi.com/pro/docs/postman-setup
    note: >-
      The collection is still named for Galileo, the platform's pre-rebrand identity, and its
      credentials come from the Sandbox dashboard. Verified live 2026-09-06 (HTTP 200 from the
      Postman collection API).
  consoles:
    sso: >-
      Tools are reached by SSO after connecting an enterprise IdP - Okta, Microsoft Entra ID,
      Google or any OIDC provider.
    docs: https://docs.tech.sofi.com/pro/docs/sofi-tech-solutions-tools
    tools:
    - { name: Console, purpose: 'entry point to the other tools from the Dashboard' }
    - { name: Config, purpose: 'view product and program configuration; Parameters Library and Knowledge Center for signed clients' }
    - { name: Customer Service Tool (CST), purpose: 'view cardholder data and transactions; act on behalf of a cardholder - cancel, activate, provision, dispute' }
    - { name: gAnalytics, purpose: 'predefined reporting - KPIs, account and card status, applications and activations, settled transactions, loads, fees, authorizations' }
    - { name: Client Portal, purpose: 'Jira ticket management for client and bank support requests' }
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com