Federal ID Sandbox
Where every integration starts. Hosts, the eight fixture identities, the pre-seeded consumer, and the limits.
Hosts
| Service | Sandbox | Production |
|---|---|---|
| API and member portal | https://sandbox.identity.federal.africa |
https://identity.federal.africa |
Federal ID sign-in (realm citizens) |
https://sandbox-auth.federal.africa/realms/citizens |
https://auth.federal.africa/realms/citizens |
Service credentials (realm ofis) |
https://sandbox-auth.federal.africa/realms/ofis |
https://auth.federal.africa/realms/ofis |
| Public keys | /.well-known/jwks.json on each API host |
The sandbox runs the same code as production, usually ahead of it. Identities issued there are test identities; nothing in the sandbox is permanent, and it may be reseeded.
Fixture identities
The sandbox database is seeded with eight deterministic test identities. The test consumer client sandbox-consumer has been granted consent on every active fixture for all six attributes. The two non-active fixtures deliberately have no consent record, so you can exercise identity_not_active and the consent-error family.
| Federal ID | Level | Status | Consent for sandbox-consumer |
|---|---|---|---|
FA-52-00000001 |
0, Unverified | active | Yes, all attributes |
FA-52-00000002 |
1, Basic Verified | active | Yes, all attributes |
FA-39-00000001 |
2, Strong Verified | active | Yes, all attributes |
FA-26-00000001 |
3, Institutional Trust | active | Yes, all attributes |
FA-91-00000001 |
1, Basic Verified (diaspora, North America) | active | Yes, all attributes |
FA-46-00000001 |
1, Basic Verified | suspended | None, by design |
FA-16-00000001 |
0, Unverified | revoked | None, by design |
FA-23-00000001 |
2, Strong Verified | active | Yes, all attributes |
FA-52-00000002 also holds a basic membership granted by the sandbox community client (sandbox-com, reference seed-basic-l1), so its lookup shows membership.tier "basic" and an assertion for membership_tier returns "basic". Every other fixture has no membership.
Your own sandbox client
Your sandbox credentials come with the scopes you asked for. With ofis:issue you can create further fixtures of your own; with ofis:enroll you can test the full sign-in and enrollment path with real sandbox accounts (register one on the sandbox login page). Sandbox redirect URIs may use a path wildcard such as https://api.example.com/v1/oidc/*; production URIs are exact.
Limits
- 600 requests per minute per client; 60 per minute per address for unauthenticated calls. Over the limit you get
429 throttledwithRetry-After. - Webhook endpoints must be
httpson a public hostname, even in the sandbox. - Assertions expire after one hour; linking codes after five minutes; ID tokens for enrollment must be under ten minutes old.