Environments & base URLs
Use identical v1 contracts in an isolated Sandbox and Production environment, with separate credentials, data, callbacks, and money rails.
Endpoints
| Purpose | URL | Behavior |
|---|---|---|
| Documentation | https://docs.lendeasy.ai |
Product guides, recipes, and generated API reference. |
| OAuth token exchange | https://auth.lendeasy.ai/oauth2/token |
Client-credentials token issuance. |
| Sandbox API | https://sandbox.api.lendeasy.ai |
Fictional data and simulated provider outcomes. |
| Production API | https://api.lendeasy.ai |
Live customer records and real money movement. |
Every public resource is under /v1. For example:
curl https://sandbox.api.lendeasy.ai/v1/loans/7204 \
-H "Authorization: Bearer $TOKEN" \
-H "LendEasy-Tenant: demo-lender"Do not append tenant IDs to the host or path. The LendEasy-Tenant header is the only tenant selector; the issued token authorizes what the caller may do within it. The Servicing Plane is the /v1/servicing namespace under the same base URL, not a separate host.
Sandbox behavior
Sandbox preserves the Production contract: resource state machines, validation, approval decisions, idempotency, event ordering, errors, and response fields are the same. Only external effects are simulated.
Use deterministic test controls supplied with your tenant to exercise outcomes such as:
- ACH settlement, return, and cancellation windows;
- card authorization, settlement, and chargeback;
- payout approval, submission, settlement, and failure;
- stale core facts, action timeouts, and reconciliation drift;
- webhook retry, duplicate delivery, and out-of-order delivery.
Sandbox clocks use real time unless your provisioned test tenant includes a controlled business-date fixture. Never assume advancing a wall clock changes a loan’s effective business date.
Isolation guarantees
The two environments do not share credentials, IDs, idempotency records, customer data, provider configuration, webhook signing secrets, or generated artifacts. An identifier may coincidentally have the same text in both environments; it still names a different resource.
Production readiness
Promotion is configuration, but not merely a URL swap. Confirm all of the following:
- Create dedicated Production OAuth clients with minimum scopes and named owners.
- Register Production webhook URLs and verify the new signing secret.
- Map real provider accounts and verify each supported rail end to end.
- Set approval thresholds, actor roles, and emergency revocation procedures.
- Validate business calendars, time zones, statement cutoffs, and product configuration.
- Rehearse payment returns, funding failures, stale facts, and reconciliation repair.
- Keep Sandbox and Production data pipelines, logs, secrets, and alert destinations separate.
Configuration pattern
Use environment variables and reject unknown environments at application start:
LENDEASY_ENV=sandbox
LENDEASY_BASE_URL=https://sandbox.api.lendeasy.ai
LENDEASY_CLIENT_ID=...
LENDEASY_CLIENT_SECRET=...