Environments

Provenance has two isolated environments: sandbox and live. Every device, attestation, key, and screening row carries an environment column, and every query filters on it — sandbox keys never see live data, and vice versa. Crossing environments returns environment_mismatch.

Sandbox

The sandbox is public and needs zero setup:

• Pre-provisioned keys — see Authentication.
• Seeded fixtures — four claims you can verify immediately:
  • CLM-SANDBOX-CLEAN — 2 attested assets, risk 0, verified.
  • CLM-SANDBOX-PARTIAL — mixed attested/un-attested, partial.
  • CLM-SANDBOX-FRAUD — tampered manifests, risk 100, failed, pre-escalated.
  • CLM-SANDBOX-VIDEO — one attested video asset and one tampered copy.
• A test device — 00000000-0000-0000-0000-000000000001, enrolled.

Reset schedule

The sandbox reseeds on a schedule so demos stay clean; fixed attestation IDs (…0001–…0005) are stable across resets, so your quickstart links keep working.

Screening budget

Synthetic-media screening calls a real external detector, so the sandbox budget is limited and tranched: a daily cap inside a monthly cap. When either is spent, /v1/media/screen returns usage_limit_reached (402) until the cap resets. A proxy-rotating drain therefore costs at most one day's tranche.

Going live

Live keys (prv_live_…) are issued per carrier and are not self-serve in the current release. The API contract is identical; only the base URL host and the key prefix differ.

Billing runs in Stripe test mode in both environments in the current release — no real charges anywhere. See Billing.

Private beta

While we're in private beta, pricing, signup and the account portal sit behind an invite page; product pages and these docs are open to read. That gate only controls who can see those pages. It isn't access control for the API or your data: the sandbox API and its published test keys answer without an invite. Dashboard sign-in may be limited to invited emails — others see beta_access_required and a link to the waitlist.

If the API is ever in maintenance mode, every call except /health returns service_unavailable_maintenance (503) with a Retry-After header.