🔌 API Sandbox

A live REST API with tokens, pagination, validation and a few deliberately wrong status codes. Point Postman, curl, or your test framework at it and verify the contract.

APIIntermediate

Each token owns a separate copy of the data, so you cannot break anyone else's run. Tokens expire after 2 hours, and everything resets when the server restarts.

Endpoints

POST/api/practice/v1/tokenMint a token and an isolated dataset. No auth required.
GET/api/practice/v1/bugsList bugs. Supports page, limit, status, severity.
POST/api/practice/v1/bugsCreate a bug. Body: { name, severity?, status?, area? }
GET/api/practice/v1/bugs/:idFetch one bug.
PATCH/api/practice/v1/bugs/:idPartial update.
DELETE/api/practice/v1/bugs/:idDelete a bug.

Quick start (curl)

# 1. Mint a token (also creates your private dataset)
curl -s -X POST http://localhost:3000/api/practice/v1/token

# 2. Use it
TOKEN="paste_token_here"
curl -s http://localhost:3000/api/practice/v1/bugs \
  -H "Authorization: Bearer $TOKEN"

# 3. Create one
curl -s -X POST http://localhost:3000/api/practice/v1/bugs \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Cart badge does not update","severity":"major"}'

Live console

Same endpoints you would hit from Postman or curl. Start by minting a token.

Challenges

Work through these before revealing anything. Answers are opinions worth arguing with, not gospel.

  1. 01

    Request a protected endpoint without a token. Which status code comes back, and is it correct?

    sign in to track
  2. 02

    Create a bug with a missing required field. Is the validation error shaped usefully?

    sign in to track
  3. 03

    Page through the collection with ?page= and ?limit=. What happens past the last page, or with limit=0?

    sign in to track
  4. 04

    DELETE the same resource twice. Is the endpoint idempotent?

    sign in to track
  5. 05

    Send a PATCH with an unexpected field. Does the API reject it or silently accept it?

    sign in to track