Evaluate identity
and delegated
authority in a
controlled
environment.
A Zoiko iD sandbox is an intended, isolated evaluation context
for testing supported identity and authorization integrations
without implying production entitlement. Availability must be
independently confirmed.
Explore Quickstarts
Open API Reference
Sandbox availability has not been confirmed.
Use the documentation to explore intended patterns. If you need an evaluation
environment, ask about options.
Read the Quickstarts
Ask about optionsConfirm five things first
None of these is checked for you. Each stays Unknown until you
confirm it against current documentation or with your account
team.
Sandbox availability to your account
Approved access for your organization
Integration scope to test
Supported API or SDK version
Testing data restrictions
Choose what you want to evaluate
Scenarios are illustrative until an approved registry marks them available for your
account.
Authentication and SSO
Test how a verified identity assertion reaches the trust layer.
Confirms who is asking
Does not grant any actionWho acts, and for whom
Person
A human who signs in and makes a request.
e.g. synthetic user
Organization
The tenant boundary the test runs within.
e.g. test organization A
Service or machine
A non-human principal with its own identity.
e.g. synthetic service
Agent
An automated principal acting under a mandate.
e.g. synthetic agent
Verification is not authority.
A verified actor still needs a mandate and a current policy decision before any action is permitted.
Four stages, each separate
A test flow can establish identity, evaluate delegated scope, apply policy, and record
evidence. Passing one stage does not imply the others.
Authenticate the actor
Confirms who is asking.
Does not establish that anyaction is allowed.
Evaluate delegated scope
Checks sponsor, action, resource,
and expiry.
Does not prove the mandateis still current.
Apply policy and context
Evaluates the request against the
current policy version.
Does not show that policy isunchanged.
Record the outcome
Captures the decision and its
basis for review.
Does not show thedownstream app acted.
A mandate, shown as a document
Illustration: a supported agent may act under bounded, revocable authority authorized
by its sponsor, subject to current policy and expiry.
Mandate card
Timestamps are illustrative. Real values appear only from a verified data model.
Secrets are never shown
here
Sandbox credentials are issued only by the approved, authenticated service,
scoped to your organization, and expire.
Issued by the
service
Only the authenticated sandbox service issues
credentials.
Masked, then
gone
Secret values are not shown again after you leave
the page.
Never paste into
support
Support will never ask for a secret value. Describe
the symptom instead.
How a decision becomes
reviewable
A sample trail showing how identity, mandate, policy version, and a trust
signal link into one record.
Sample data · synthetic
Actor authenticated
Mandate evaluated
Policy decision recorded
Trust signal changed
Event link is a placeholder. No customer identifiers are included.
Progress is recorded from real runs only
Until a test runner is connected, every step shows Not started. A blocked test is reported as blocked, never as passed.
Prerequisites
Not started
Configure subject
Not started
Permitted request
Not started
Inspect decision
Not started
Test revocation
Not started
Review evidence
Not started
States: Not started · In progress · Passed · Needs action · BlockedWhen a test is blocked, check these in order
Protocol support
Environment availability
Credential scope and versionRead the docs and ask about evaluation options. No access button is shown.
Shown only when the approved service confirms access for your account.
Sign in to check eligibility. Your place on this page is kept.
Contact your account team through the approved route.
The documentation remains available. No recovery time is promised.
Request renewal through a supported route. No bypass is offered.
Sandbox and production are different systems
Sandbox
Isolated test context
Synthetic or authorized data
Scoped test credentials
Production
Live customer identities and data
Governed entitlements and contracts
Operational support and change control
Security review
Production credentials require signed authorization.
Entitlements
Confirmed in writing, not inferred from a test.
Integration review
Your architecture reviewed end to end.
Governance sign-off
Operational owners approve the rollout.