Sandbox Simulations

Unit exposes the following sandbox-specific endpoints, in addition to all other endpoints. They allow you to easily test and simulate real-world events - external activity, or internal activity that may normally take a long time to occur.

Note

Simulation operations are subject to the same authentication scheme as the Live APIs, and therefore require a valid Authentication token.

Simulating Application Statuses

By default, most applications in our sandbox will be approved immediately. Applications may be sent to manual review based on applicant information provided. Below are ways to simulate other statuses:

Status	Description
PendingReview	Individual application: set the SSN on the application to 000000004. Business application: set the SSN of the Officer or any Beneficial Owner on the application to 000000004.
AwaitingDocuments	Individual application: set the SSN on the application to 000000002 to simulate AwaitingDocuments for Address Verification, or 000000003 to simulate AwaitingDocuments for Id Document, or 000000006 to simulate AwaitingDocuments for Social Security Card. Business application: set the SSN of the Officer on the application to 000000005.
Denied	Individual application: set the SSN on the application to 000000001.

What to expect in your integration

Reserved SSNs are outcome shortcuts for sandbox testing. They do not reproduce every production evaluation detail (vendor scores, fraud flag text, or manual-review notes) byte-for-byte.

When building a native onboarding UI, use the application resource as the source of truth:

Surface	What you get
GET /applications/{id} (default)	status, message, and relationships (for example required documents when status is AwaitingDocuments).
Application webhooks	application.denied, application.awaitingDocuments, application.pendingReview, application.approved, and related events when status changes.
Unit Dashboard	Evaluation flags and operational denial context for reviewers (not returned on the default application GET).
Optional API fields	evaluationFlags and decisionReasonCodes when you pass extra fields on GET (server-side use; do not treat vendor scores as end-customer copy).

Denied sandbox test (000000001): Expect status: Denied and an application.denied webhook. Show a generic denial screen in your app unless you intentionally fetch optional evaluation fields on the server. Dashboard evaluation flags on the same application (for example Denied Fraud) are not a contract for what the default GET response includes.

Other reserved SSNs: Use 000000002 / 000000003 / 000000006 for document-collection paths, 000000004 for PendingReview, or approve/deny in-flight applications with the sandbox endpoints below. For production flag meanings (not sandbox shortcuts), see End-Customer Applications.

There is no retryAllowed (or similar) attribute on the application resource. Branch your UX on status and webhooks. In sandbox, the same SSN can usually be submitted again after Denied so you can re-run tests (duplicate application rules).

Optional evaluation fields on GET

By default, GET /applications/{id} omits evaluationFlags and decisionReasonCodes. To include them (for server-side logging or support tooling), add query parameters:

GET https://api.s.unit.sh/applications/{id}?extraFields[application]=evaluationFlags,decisionReasonCodes

For business applications you can also request officer or beneficial-owner flags, for example extraFields[officer]=evaluationFlags.

Registered Agent Address

To simulate a business applications whose address matches a registered agent's address:

Name	Type	Description
street	string	13 Registered Agent st
city	string	New York
state	string	NY
postalCode	string	12345
country	string	US

Example Address type:

{
  "street": "13 Registered Agent st",
  "city": "New York",
  "state": "NY",
  "postalCode": "12345",
  "country": "US"
}

Application Form 2FA

When simulating an application via an application form on Sandbox, use 000001 as your phone verification code to complete the two factor authentication challenge. Note that a verification SMS will not be sent to the phone number provided, to avoid accidental breaching of the consent to electronic communications requirements.

Approve Application

Approves an Application under PendingReview or AwaitingDocuments status. The Customer Created webhook event will be fired.

Verb	POST
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/approve
Data Type	applicationApprove
Timeout (Seconds)	5

Example Request:

curl -X POST 'https://api.s.unit.sh/sandbox/applications/10001/approve'
-H 'Content-Type: application/vnd.api+json'
-H 'Authorization: Bearer ${TOKEN}'
--data-raw '{
  "data": {
    "type": "applicationApprove",
    "attributes": {
      "reason": "sandbox"
    }
  }
}'

Deny

Denies an Application under PendingReview or AwaitingDocuments status. The Application Denied webhook event will be fired.

Verb	POST
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/deny
Data Type	applicationDeny
Timeout (Seconds)	5

Example Request:

curl -X POST 'https://api.s.unit.sh/sandbox/applications/10001/deny'
-H 'Content-Type: application/vnd.api+json'
-H 'Authorization: Bearer ${TOKEN}'
--data-raw '{
  "data": {
    "type": "applicationDeny",
    "attributes": {
      "reason": "sandbox"
    }
  }
}'

Approve Document

Approves an Application Document. The Document Approved webhook event will be fired.

Verb	POST
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/documents/{documentId}/approve
Timeout (Seconds)	5

Example Request:

curl -X POST 'https://api.s.unit.sh/sandbox/applications/10001/documents/1/approve'
-H 'Content-Type: application/vnd.api+json'
-H 'Authorization: Bearer ${TOKEN}'
--data-raw '{}'

Reject

Rejects an Application Document. The Document Rejected webhook event will be fired.

Verb	POST
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/documents/{documentId}/reject
Data Type	documentReject
Timeout (Seconds)	5

Example Request:

curl -X POST 'https://api.s.unit.sh/sandbox/applications/10001/documents/1/reject'
-H 'Content-Type: application/vnd.api+json'
-H 'Authorization: Bearer ${TOKEN}'
--data-raw '{
  "data": {
    "type": "documentReject",
    "attributes": {
      "reason": "blurry image",
      "reasonCode": "PoorQuality"
    }
  }
}'

Download

Download the application document file, in order to test if the upload was successful and the file is valid.

Verb	GET
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/documents/{documentId}/download
Timeout (Seconds)	5

Example Request:

curl -X GET 'https://api.s.unit.sh/sandbox/applications/10001/documents/1/download' \
-H "Authorization: Bearer ${TOKEN}"

Download Back-Side

Download the application document back-side file, in order to test if the upload was successful and the file is valid.

Verb	GET
URL	https://api.s.unit.sh/sandbox/applications/{applicationId}/documents/{documentId}/download/back
Timeout (Seconds)	5

Example Request:

curl -X GET 'https://api.s.unit.sh/sandbox/applications/10001/documents/1/download/back' \
-H "Authorization: Bearer ${TOKEN}"