How do I try GraphQL for free?

Visit https://demo.totalshiftleft.ai/graphiql for a live GraphiQL IDE — no login or setup required. Query users, products, and orders with full schema autocomplete.

Where can I try Swagger UI live?

The Swagger UI is live at https://demo.totalshiftleft.ai/docs — all REST endpoints are documented with try-it-out enabled.

Can I test REST and GraphQL against the same data?

Yes. The TotalShiftLeft API Sandbox shares one session-scoped data store across REST, GraphQL, and SOAP — a record created in REST appears instantly in GraphQL queries and SOAP responses.

Is there a SOAP API demo I can try?

Yes. POST to https://demo.totalshiftleft.ai/soap with a SOAP 1.1 envelope. The WSDL is at /soap?wsdl — import it into SoapUI or Postman to auto-generate all 14 operations.

How do I simulate API errors for testing?

Add ?error=500 to any REST endpoint to force that HTTP status, ?delay=2000 for artificial latency, or ?random_fail=true for ~30% random failures to test retry logic.

ShiftLeft Store API Learning Sandbox

A live, multi-protocol API you can hit right now — no setup, no login required.

This sandbox simulates a real online store (customers, products, orders) exposed simultaneously over REST, GraphQL, and SOAP — all sharing one live data store. Use it to practise API testing, explore protocols side-by-side, or demonstrate tools like Shift‑Left Studio without any backend setup.

Session-scoped · auto-expires after 30 min idle

🔒 JWT · API Key · OAuth2

⚡ REST · ⬡ GraphQL · 📄 SOAP

✨ Want to learn even faster?

Get a Free Shift-Left Studio Developer Account

Build no-code API tests against this sandbox — guided tutorials, real test runs, and a full toolkit for free.

Sign up free →

Recommended Learning Path

📋

STEP 1

Read the Requirements

Understand what the Store API does, what each field expects, and what errors to anticipate — before you write a single test.

Open Requirements →

⚡

STEP 2

Explore the REST API

Try all CRUD endpoints for users, products, and orders. Send real requests, see real responses — right in the browser.

Open REST →

🔑

STEP 3

Add Authentication

Log in with JWT, use a static API key, or try OAuth2 client credentials. Test all three methods against the same endpoints.

Open Auth →

⬡

STEP 4

Try GraphQL

Query the same store data with GraphQL. Fetch exactly the fields you need, resolve nested entities in one call, compare with REST.

Open GraphQL →

📄

STEP 5

Explore SOAP

14 SOAP operations with a complete WSDL. The same users and orders you created via REST appear here instantly — one shared data store.

Open SOAP →

📚

GUIDED

Guided Learning Scenarios

Step-by-step exercises from beginner to advanced. Each scenario explains the why behind every API call — not just the how.

Open Scenarios →

🎲

ADVANCED

Simulate Errors & Delays

Force HTTP errors, add artificial latency, or trigger ~30% random failures. Test how your tool or app handles the real world.

Open Simulate →

📖

TOOL

Swagger UI

Full OpenAPI 3.0 spec with try-it-out on every endpoint. Great for importing into Postman or generating client SDKs.

Open Swagger ↗

⬡

TOOL

GraphiQL IDE

Full GraphQL IDE with schema autocomplete, query history, and inline docs. The fastest way to explore the GraphQL schema.

Open GraphiQL ↗

Quick Facts

Base URL

https://demo.totalshiftleft.ai

Session Header

x-session-id: <id>

Demo Credentials

alice@demo.com / alice123

API Key

demo-key-sandbox-2026

Data Lifetime

30 min inactivity

Rate Limit

None (fair use)

What is this sandbox?

A multi-protocol API simulator built for demo environments. It exposes identical business data (Users, Products, Orders) across REST, GraphQL, and SOAP simultaneously — all sharing one session-scoped in-memory store. Use it to demonstrate API testing concepts, tooling integrations, and protocol comparisons without any persistent database setup.

💡 All data is session-scoped. Your session ID travels in the x-session-id response header. Data auto-expires after 30 minutes of inactivity. No data persists between sessions.

Base URL

http://localhost:3050

Protocols

Protocol	Endpoint
REST CRUD	/api/v1/{entity}
GraphQL	/graphql
SOAP 1.1	/soap
Auth	/auth/*
Flows	/api/v1/flows/*

Session Management

Mechanism	Value
Response header	x-session-id
Cookie	sandbox_session
Request header	x-session-id: <id>
TTL	30 min (sliding)
Max records/entity/session	10,000

Rate Limits

No per-client rate limit. Practice endpoint: GET /api/v1/rate-limited/ping (10 / minute / session)

Simulation Parameters

Append these query params to any REST endpoint to simulate real-world failure conditions:

Parameter	Type	Description	Example
?delay=N	integer (ms)	Artificial latency. Max 10,000 ms.	?delay=2000
?error=N	HTTP status	Force a specific HTTP error code.	?error=503
?random_fail=true	boolean	~30% chance of 500 error. For retry testing.	?random_fail=true

REST API

Full CRUD for users, products and orders over JSON. Data is session-scoped, shared with GraphQL and SOAP, and auto-expires after 30 min of inactivity.

📖 Swagger Docs ↗ ⬇ Download OpenAPI Spec

🔗

Endpoint

/api/v1/{entity} · JSON · GET, POST, PUT, PATCH, DELETE and QUERY

📄

Contract

OpenAPI 3.0 at /openapi/rest.json — import into Shift-Left API, Postman, Insomnia or any API tool

⚠️

Errors

HTTP status + { success: false, error, message, details }

Try it — Users

👤 users 📦 products 🛒 orders

Endpoint Reference

GraphQL API

Full CRUD for users, products and orders with queries and mutations. Same session-scoped data as REST and SOAP — a record created in one appears instantly in the others.

⬡ GraphiQL IDE ↗ ⬇ Download SDL Schema

🔗

Endpoint

POST /graphql · JSON { "query", "variables" }

📄

Contract

SDL schema — schema.graphql — import into Shift-Left API or any GraphQL client from GET /graphql

⚠️

Errors

HTTP 200 with errors[] · extensions.code e.g. VALIDATION_ERROR

Try it — Users

👤 users 📦 products 🛒 orders

Free-form Query

Query / Mutation

Response

// Run a query to see the response

Schema Reference

Queries

users(page, limit, sort, order) → UserPage

user(id) → User

products(page, limit, sort, order) → ProductPage

product(id) → Product

orders(page, limit, sort, order) → OrderPage

order(id) → Order — includes user & product inline

sessionInfo → JSON

Mutations

createUser(input) / updateUser(id, input) / deleteUser(id)

createProduct(input) / updateProduct(id, input) / deleteProduct(id)

createOrder(input) / updateOrder(id, input) / deleteOrder(id)

Types

User — id, name, email, role, age, created_at, updated_at

Product — id, name, price, description, stock, category, created_at, updated_at

Order — id, user_id, product_id, quantity, status, notes, created_at, updated_at, user, product

*Page — items[], pageInfo { total, page, limit, pages, hasNext, hasPrev }

Key Concepts

• Nested resolution: Query order { user { name } product { price } } — linked entities resolved automatically

• Pagination: All list queries accept page, limit, sort, order

• Session: Send x-session-id header to share data with REST and SOAP

• Full SDL: /graphql — import into Shift-Left API or any GraphQL client

SOAP API

Full CRUD for users, products and orders over SOAP 1.1 — 15 operations described by a WSDL. Same session-scoped data as REST and GraphQL.

📄 View WSDL ↗ ⬇ Download WSDL

🔗

Endpoint

POST /soap · Content-Type: text/xml · SOAPAction header

📄

Contract

WSDL 1.1 at /soap?wsdl — import into Shift-Left API, SoapUI or Postman

⚠️

Errors

<soap:Fault> with <faultcode> + <faultstring> (and <detail> for validation)

Try it — Users

👤 users 📦 products 🛒 orders

Operation Reference

Authentication

Open sandbox — auth isn't required for CRUD. Use this section to learn and test it. 17 schemes available.

Mint or inspect a token, then apply it in the Auth Config box (sidebar) to authenticate your REST / GraphQL / SOAP calls.

🗝️ API key — x-api-key header 🪙 JWT — login token 🔐 OAuth2 — client credentials

These three plug into the sidebar Auth Config. Need Basic, Digest, HMAC, SigV4…? → Test an auth scheme.

➡ Apply a token in the Auth Config box (sidebar) to authenticate your data requests.

Pick a scheme, send it the way it expects, and get an instant pass/fail — from this UI or your own tool (Postman, RestAssured, Bruno, Karate, SoapUI, APIDog, Tricentis). Each scheme has a protected endpoint at /auth/protected/{id}. Full setup guide ↗

Send each test as

Learning Scenarios

Guided step-by-step exercises from beginner to advanced. Each scenario explains the why, not just the how.

Error & Delay Simulation

Add query params to any REST endpoint to test client-side error handling and resilience.

⏱ Artificial Delay

Simulate network latency or slow backends. Max 10,000 ms.

?delay=N

Delay (ms)

💥 Force HTTP Error

Force any HTTP error code. Useful for testing your UI error states.

?error=N

HTTP Status Code

🎲 Random Failure

~30% of requests will randomly fail. Build retry logic and test resilience.

?random_fail=true

Click multiple times — about 1 in 3 will fail.

🔗 Chain Params

Combine simulation params on any endpoint.

?delay=1000&random_fail=true

Entity

Custom params

💡 This is the executable contract for the sandbox: every test-data row and end-to-end step below is run against the live API before each release. Feed the downloaded .txt to Shift-Left Studio to generate tests from it.

Loading the requirements document…