Get the app Map (opens in a new tab)List your business

Developers

Sandbox

Try everything with no real money: ready test merchants, instant link approval, orders you create yourself, and simulated cancels, timeouts and refunds.

Coming soonThe Partner API is not open yet. These docs are here so you can plan your integration; hosts and keys are issued at launch.Register as a developer →

On this page

What it is

The sandbox is a full copy of the API with completely separate data. Same rules, same errors, same events. The only difference: no real money and no real customers.

Sandbox Live
Address https://sandbox.partners.aurmap.com/v1 (live now) https://partners.aurmap.com/v1 (opens for each developer once approved)
Keys pk_test_xxx / sk_test_xxx pk_live_xxx / sk_live_xxx
mode in answers and events test live

The sandbox address works now with sandbox keys. The live address opens for each developer once their integration is reviewed and approved.

Test merchants

Every partner account comes with:

Merchant Places For
Test restaurant two branches: plc_test_olaya and plc_test_malqa menus and orders
Test shop one branch products and stock Coming soon

You find them in the developer dashboard under “Sandbox”, and can open their pages in the sandbox AurMap app.

Issue a code as usual, then approve it on the merchant’s behalf:

bash
aurmap POST /v1/sandbox/link-codes/7KQ2M9XA/approve '{"place_id":"plc_test_olaya"}'
json
{ "code": "7KQ2M9XA", "status": "redeemed", "link_id": "lnk_test_2h6j4n" }

To test a refusal: POST /sandbox/link-codes/{code}/decline.

Create an order

bash
aurmap POST /v1/sandbox/orders '{"place_id":"plc_test_olaya","items":[{"item_id":"chicken-burger","size_id":"l","qty":1,"options":[{"group_id":"sauce","option_id":"hot"}]}],"payment":{"method":"cash"},"customer":{"name":"Test customer","phone_e164":"+966500000099"}}'
json
{ "order_id": "ord_test_9k2p4a", "number": "M-1002", "status": "received", "accept_by": "2026-10-14T12:50:00Z", "totals": { "currency": "SAR", "total_minor": 3220 }, "payment": { "method": "cash", "status": "unpaid", "amount_minor": 3220 } }

The order is priced from your published menu exactly as in live, and you receive order.created.

js
const order = await aurmap('POST', '/v1/sandbox/orders', {
  place_id: 'plc_test_olaya',
  items: [{ item_id: 'chicken-burger', size_id: 'l', qty: 1, options: [{ group_id: 'sauce', option_id: 'hot' }] }],
  payment: { method: 'card' },
});
php
$order = aurmap('POST', '/v1/sandbox/orders', [
    'place_id' => 'plc_test_olaya',
    'items' => [['item_id' => 'chicken-burger', 'size_id' => 'l', 'qty' => 1, 'options' => [['group_id' => 'sauce', 'option_id' => 'hot']]]],
    'payment' => ['method' => 'card'],
]);

Simulate the other side

Request Simulates Result
POST /sandbox/orders/{id}/customer-cancel the customer cancels before acceptance order.cancelled with reason customer
POST /sandbox/orders/{id}/expire the accept window ends now order.cancelled with reason timeout
POST /sandbox/orders/{id}/aurmap-refund AurMap support refunded order.cancelled with reason aurmap_refund
bash
aurmap POST /v1/sandbox/orders/ord_test_9k2p4a/customer-cancel
json
{ "order_id": "ord_test_9k2p4a", "status": "cancelled", "cancel": { "reason": "customer", "by": "customer" } }

If the order is already accepted, customer-cancel answers 409 ALREADY_ACCEPTED, exactly as in live.

You can also shorten the accept window to one minute in the dashboard, to test timeouts quickly.

Test cards

You do not need cards to test your system. POST /sandbox/orders sets the payment status directly.

To try paying yourself in the sandbox AurMap app, use the test cards listed in the developer dashboard:

Outcome Card
Successful payment Coming soon
Declined by the bank Coming soon
Extra check (3-D Secure) Coming soon

Send a test event

The “send test” button on the Webhooks page sends endpoint.test to your endpoint. Use it to confirm your signature check before anything else.

Start over

bash
aurmap POST /v1/sandbox/reset

Deletes every sandbox order, link and menu of your account. The test merchants stay. Data older than 30 days is deleted automatically.