# TotalShiftLeft API Learning Sandbox

> A free, interactive multi-protocol API testing and learning platform. Try and learn REST, GraphQL, SOAP, Swagger, and API authentication live in your browser — no setup required. Built for API training demos, tool evaluations, and developer education.

## Reliability (live, server-rendered)

- Status: operational
- Public since: 2025-09-01
- Days online: 322
- Sessions today: 2
- Active sessions right now: 2
- Current process uptime: 29m
- Monthly SLO target: 99.5%
- Rate limit: ~600 req/min per IP
- Session idle TTL: 30 minutes
- Pricing: free forever — no signup, no credit card, no API key required
- Trust page: https://demo.totalshiftleft.ai/trust
- Machine-readable status: https://demo.totalshiftleft.ai/status.json

## Pages

- [Interactive Sandbox UI](https://demo.totalshiftleft.ai/ui): Main UI with REST CRUD explorer, GraphQL editor, SOAP operations, authentication testing, error & delay simulation, and guided learning scenarios.
- [Auth Testing Sandbox](https://demo.totalshiftleft.ai/auth-testing): Practice and verify 17 authentication schemes (Basic, API Key, Bearer/JWT, OAuth2 grants + PKCE, OAuth 1.0a, Digest, AWS SigV4, Hawk, HMAC, cookie/session, simulated mTLS) from Postman, RestAssured, Bruno, Karate, SoapUI, APIDog, Tricentis. Per-scheme protected endpoints at /auth/protected/{scheme}; catalog at /auth/methods.
- [Trust & Status](https://demo.totalshiftleft.ai/trust): Live operational status, uptime, free-forever pledge, fair-use commitment and incident contact.
- [Swagger / OpenAPI Docs](https://demo.totalshiftleft.ai/docs): Full OpenAPI 3.0 documentation with live try-it-out for every REST endpoint.
- [GraphiQL IDE](https://demo.totalshiftleft.ai/graphiql): Interactive GraphQL explorer with built-in schema browser, autocomplete, and a pre-loaded example query.
- [GraphQL SDL Schema](https://demo.totalshiftleft.ai/graphql): Full schema definition in SDL format — import into any GraphQL client.
- [SOAP WSDL](https://demo.totalshiftleft.ai/soap?wsdl): WSDL service definition for all 14 SOAP operations — import into SoapUI or Postman.
- [LLM Full Reference](https://demo.totalshiftleft.ai/llms-full.txt): Complete API reference, use cases, and structured data optimised for LLM context.

## Use cases (intent-rich landing pages)

- [Use Cases Index](https://demo.totalshiftleft.ai/use-cases): All scenarios this sandbox supports — pick the one that matches your role.
- [Postman Practice](https://demo.totalshiftleft.ai/use-cases/postman-practice): Public API to practice Postman collections, environments and tests.
- [QA / Test Automation](https://demo.totalshiftleft.ai/use-cases/qa-test-automation): API for writing automated tests with assertions, error simulation and JWT.
- [Frontend Developers](https://demo.totalshiftleft.ai/use-cases/frontend-developers): Predictable JSON API for React/Vue/Svelte prototypes — CORS open.
- [Load Testing](https://demo.totalshiftleft.ai/use-cases/load-testing): API for k6 / JMeter / Locust scripts — fair-use limits documented.
- [Security Testing](https://demo.totalshiftleft.ai/use-cases/security-testing): Authenticated API with OAuth2 / JWT / API key flows for OWASP practice.
- [Students & Bootcamps](https://demo.totalshiftleft.ai/use-cases/students-bootcamps): Free public API for coursework and bootcamp exercises.

## Comparisons (alternatives to other public APIs)

- [Alternatives Index](https://demo.totalshiftleft.ai/alternatives): Compare TotalShiftLeft sandbox to other free public APIs.
- [vs JSONPlaceholder](https://demo.totalshiftleft.ai/alternatives/jsonplaceholder): Read-only mock vs full CRUD sandbox with auth.
- [vs ReqRes](https://demo.totalshiftleft.ai/alternatives/reqres): Static fixtures vs session-scoped multi-protocol sandbox.
- [vs Postman Echo](https://demo.totalshiftleft.ai/alternatives/postman-echo): Echo-only vs persistent CRUD across REST/GraphQL/SOAP.
- [vs DummyJSON](https://demo.totalshiftleft.ai/alternatives/dummyjson): JSON-only fake API vs multi-protocol with WSDL and OAuth2.
- [vs Beeceptor](https://demo.totalshiftleft.ai/alternatives/beeceptor): Mock-server creation vs ready-made multi-protocol sandbox.

## Optional

- [API Info JSON](https://demo.totalshiftleft.ai/api): Machine-readable getting-started guide with all endpoint URLs.
- [Status JSON](https://demo.totalshiftleft.ai/status.json): Machine-readable live status (CORS-open, no auth, no rate limit).
- [Health Check](https://demo.totalshiftleft.ai/health): Minimal liveness probe.