---
title: "Sandbox - yonyon.ai (Yonatan Gross)"
description:
  "How agents can exercise the yonyon.ai public API without touching production data. The public API
  is the sandbox: read-only, anonymous, rate-limited."
canonical: https://yonyon.ai/sandbox
last-updated: 2026-09-14
---

# Sandbox - yonyon.ai (Yonatan Gross)

> Test environment for agents. Last updated: 2026-09-14

yonyon.ai has **no mutable production data**. The public API is anonymous and read-only: listing
projects, asking questions, and reading docs cannot create, update, or delete anything. That makes
the live origin the sandbox. There is no second hostname because a second host would serve the same
bytes.

## How to reach it

- **Base URL:** `https://yonyon.ai`
- **OpenAPI servers entry:** the spec lists this origin with description
  `Sandbox (read-only public API; no production side effects)`.
- **Optional header:** `X-Sandbox: true` is accepted and ignored. It exists so an agent that always
  sends a sandbox flag does not have to special-case this host.

## What you can call

Every call below is safe to retry. Nothing is billed. Rate limit: 10 requests per IP per minute.

```
GET  https://yonyon.ai/api
GET  https://yonyon.ai/api/v1/projects?limit=1
POST https://yonyon.ai/api/v1/jobs   {"op":"projects"}
GET  https://yonyon.ai/api/v1/jobs/{job_id}
POST https://yonyon.ai/ask           {"query":"What does Yonatan build?"}
POST https://yonyon.ai/api/mcp       {"jsonrpc":"2.0","id":1,"method":"tools/list"}
POST https://yonyon.ai/api/mcp/docs  {"jsonrpc":"2.0","id":1,"method":"tools/list"}
```

## What does not exist

- No API keys, no OAuth tokens, no write operations.
- No checkout, no orders, no user accounts.
- No staging hostname. If a client requires a distinct sandbox URL, use this origin and the
  `X-Sandbox: true` header; the response is identical.

## Related

- Developer guide: https://yonyon.ai/developers.md
- OpenAPI spec: https://yonyon.ai/.well-known/openapi.json
- Auth (none required): https://yonyon.ai/auth.md