Testing

Keep proof stages explicit.

Public discovery can be tested against production. State-changing flows should be proven with synthetic or controlled non-production data until a real production actor, payment boundary, and provider are intentionally approved.

Public smokesafe on prod

Mutation proofsandbox/synthetic

PHI rulenever copy prod

Sandbox

The sandbox is the fastest proof surface — and it is live today.

Anyone can create a sandbox key instantly and drive the full S0–S8 booking and payment state machine against a synthetic provider with simulated payments. No approval, no real money, no real PHI. Live-mode runs — real provider, real money — open with our first design partners.

curl -X POST https://api.opendoc.com/developers/signup \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]" }'

# The returned key is odk_sandbox_... and is shown once.
curl "https://api.opendoc.com/search?q=knee%20MRI&state=GA" \
  -H "Authorization: Bearer $OPENDOC_SANDBOX_KEY"

Proof ladder

Call the proof stage by its real name.

Docs-onlyThe route or workflow is described but not yet executed.

Local proofRuns on a developer machine against local services and synthetic fixtures.

DB smokeWrites and reads back against an isolated database with synthetic or controlled fixtures.

API proofExercises the real route contract through HTTP.

Browser proofVerifies the user-facing flow and rendered state.

Production smokeRead-only or explicitly approved live checks against production infrastructure.

Safe production checks

Use public read paths for integration smoke.

curl https://api.opendoc.com/health
curl https://api.opendoc.com/protocol
curl "https://api.opendoc.com/search?q=knee%20pain&geo=us-GA"
curl https://docs.opendoc.com/opendoc-api-docs.html

Health is not product proof. A healthy API means the process is alive. Use /protocol and focused route checks to verify integration behavior.

Synthetic data

Development uses generated or controlled data, not production patient data.

OpenDoc's policy is a bright line: production patient data is never copied to development, even if someone calls it anonymized. NPI registry data is public and may be used for provider-directory shape, but patient data and transaction proofs must use synthetic or explicitly controlled fixtures.

AllowedSynthetic patients, synthetic bookings, public NPI registry rows, Stripe test mode, local OIDC/JWKS helpers, controlled provider proof fixtures.

Not allowedProduction patient exports, anonymized production patient datasets, real PHI in local files, AI prompts, or non-production databases.

EvidenceRecord commands, environment class, proof result, and whether the run was docs-only, local, staging, or production smoke.

State-changing tests

Do not mutate production by accident.

Transactions, provider activation, event subscriptions, proof-of-service, and payment flows are state-changing. Test them with a known synthetic actor, synthetic offer/slot, and Stripe test configuration unless a production run has been explicitly approved.

# Example public-only transaction smoke inputs:
export OPENDOC_PROTOCOL_URL=https://api.opendoc.com
export OPENDOC_SMOKE_PROVIDER_ID=<known-provider-id>
export OPENDOC_SMOKE_SCP_ID=<known-scp-id>
export OPENDOC_SMOKE_PROVIDER_HSO_ID=<known-offer-id>
export OPENDOC_SMOKE_SLOT_ID=<known-open-slot-id>

# Full protected smoke additionally needs mapped patient/provider tokens.
export OPENDOC_SMOKE_BEARER_TOKEN=<patient-oidc-or-agent-token>
export OPENDOC_SMOKE_PROVIDER_BEARER_TOKEN=<provider-or-scp-token>

When in doubt, stop at read-only smoke. A route can be reachable and healthy without proving that a live mutation should be attempted.