Sandbox · Hormaz Daruwala

Sandbox / test environment

Every read endpoint on hormazdaruwala.vercel.app is safe to call: no auth, no side effects, demo rate limit of 60 requests per minute advertised via RateLimit headers. Writes are sandbox-safe by design: POST /api/contact only validates and returns 202 with a pollable job_id (poll GET /api/jobs/{id}), POST /api/batch only runs allowlisted reads, and MCP tools are all read-only (readOnlyHint). Nothing here sends email or mutates data, so agents can exercise the full surface without touching production. Machine-readable sandbox description lives at GET /api/sandbox and the markdown twin at /sandbox.md.

Try it

# safe reads
curl https://hormazdaruwala.vercel.app/api/profile
curl "https://hormazdaruwala.vercel.app/api/projects?q=ai&limit=5"

# sandbox-safe write: validates, returns 202 + job_id + Location
curl -i -X POST https://hormazdaruwala.vercel.app/api/contact \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: demo-001' \
  -d '{"name":"Ada","email":"ada@example.com","message":"Freelance Next.js build, Q1 timeline"}'

# poll the job
curl https://hormazdaruwala.vercel.app/api/jobs/<job_id>

# self-serve demo key for gated endpoints
curl -X POST https://hormazdaruwala.vercel.app/api/agent/key \
  -H 'Content-Type: application/json' -d '{}'

Versioning: /api/* is v1 current, mirrored at /api/v1/*; every response carries API-Version: v1 and Deprecation: false. Full policy in /docs and /openapi.json.