Sandbox i klucze testowe

Klucz testowy allee_sk_test_… działa pod tym samym adresem co produkcja, ale wszystkie dane trafiają do osobnej bazy sandboxu. Rozstrzyga wyłącznie rodzaj klucza — żaden nagłówek ani parametr nie przełączy klucza produkcyjnego na sandbox i odwrotnie. Odpowiedzi sandboxu mają nagłówek X-Allee-Mode: test.

Konto demo

Przy pierwszym żądaniu powstaje konto demo: 20 aktywnych ofert, cennik, warunki, GPSR i kupujący demo (dane fikcyjne, bez danych osobowych z produkcji).

curl -sS -X GET "${ALLEE_API_URL:-https://api.allee.pl}/allee/sandbox" \
  -H "Authorization: Bearer $ALLEE_API_KEY" \
  -H "Accept: application/vnd.allegro.public.v1+json" \
  -w '\nHTTP %{http_code}\n'

<?php
// allee API: GET /allee/sandbox (PHP 8, rozszerzenie curl)
$base = getenv('ALLEE_API_URL') ?: 'https://api.allee.pl';
$ch = curl_init($base . '/allee/sandbox');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ALLEE_API_KEY'),
        'Accept: application/vnd.allegro.public.v1+json',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);
$odp = curl_exec($ch);
echo 'HTTP ', curl_getinfo($ch, CURLINFO_RESPONSE_CODE), "\n", $odp, "\n";

# allee API: GET /allee/sandbox (Python 3, biblioteka requests)
import os

import requests

BASE = os.environ.get("ALLEE_API_URL", "https://api.allee.pl")
headers = {
    "Authorization": "Bearer " + os.environ["ALLEE_API_KEY"],
    "Accept": "application/vnd.allegro.public.v1+json",
}
r = requests.request("GET", BASE + "/allee/sandbox", headers=headers, timeout=60, allow_redirects=False)
print("HTTP", r.status_code)
print(r.text)

// allee API: GET /allee/sandbox (Node.js 18+, wbudowany fetch; plik .mjs)
const BASE = process.env.ALLEE_API_URL ?? "https://api.allee.pl";
const res = await fetch(`${BASE}/allee/sandbox`, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ALLEE_API_KEY}`,
    "Accept": "application/vnd.allegro.public.v1+json",
  },
  redirect: "manual",
});
console.log("HTTP", res.status);
console.log(await res.text());

// allee API: GET /allee/sandbox (C#, .NET 8+, HttpClient)
using System.Net.Http.Headers;
using System.Text;

var baseUrl = Environment.GetEnvironmentVariable("ALLEE_API_URL") ?? "https://api.allee.pl";
using var http = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false });
using var req = new HttpRequestMessage(new HttpMethod("GET"), baseUrl + "/allee/sandbox");
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("ALLEE_API_KEY"));
req.Headers.Accept.ParseAdd("application/vnd.allegro.public.v1+json");
using var res = await http.SendAsync(req);
Console.WriteLine($"HTTP {(int)res.StatusCode}");
Console.WriteLine(await res.Content.ReadAsStringAsync());

// allee API: GET /allee/sandbox (Java 11+, java.net.http; uruchom: java Main.java)
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String base = System.getenv().getOrDefault("ALLEE_API_URL", "https://api.allee.pl");
        HttpRequest req = HttpRequest.newBuilder(URI.create(base + "/allee/sandbox"))
                .header("Authorization", "Bearer " + System.getenv("ALLEE_API_KEY"))
                .header("Accept", "application/vnd.allegro.public.v1+json")
                .method("GET", HttpRequest.BodyPublishers.noBody())
                .build();
        HttpClient http = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build();
        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println("HTTP " + res.statusCode());
        System.out.println(res.body());
    }
}

// allee API: GET /allee/sandbox (Go 1.20+, net/http; uruchom: go run main.go)
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	base := os.Getenv("ALLEE_API_URL")
	if base == "" {
		base = "https://api.allee.pl"
	}
	req, err := http.NewRequest("GET", base+"/allee/sandbox", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("ALLEE_API_KEY"))
	req.Header.Set("Accept", "application/vnd.allegro.public.v1+json")
	klient := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
	res, err := klient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	dane, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println("HTTP", res.StatusCode)
	fmt.Println(string(dane))
}

Symulator kupującego

POST /allee/sandbox/orders, POST /allee/sandbox/returns i POST /allee/sandbox/messages robią to, co na produkcji robi kupujący:

curl -sS -X POST "${ALLEE_API_URL:-https://api.allee.pl}/allee/sandbox/orders" \
  -H "Authorization: Bearer $ALLEE_API_KEY" \
  -H "Accept: application/vnd.allegro.public.v1+json" \
  -H "Content-Type: application/vnd.allegro.public.v1+json" \
  --data-binary @- \
  -w '\nHTTP %{http_code}\n' <<'JSON'
{
  "offerId": "900000000000021",
  "quantity": 2,
  "paymentType": "ONLINE",
  "invoice": true,
  "messageToSeller": "Proszę o staranne zapakowanie."
}
JSON

<?php
// allee API: POST /allee/sandbox/orders (PHP 8, rozszerzenie curl)
$base = getenv('ALLEE_API_URL') ?: 'https://api.allee.pl';
$body = [
    'offerId' => '900000000000021',
    'quantity' => 2,
    'paymentType' => 'ONLINE',
    'invoice' => true,
    'messageToSeller' => 'Proszę o staranne zapakowanie.',
];
$ch = curl_init($base . '/allee/sandbox/orders');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ALLEE_API_KEY'),
        'Accept: application/vnd.allegro.public.v1+json',
        'Content-Type: application/vnd.allegro.public.v1+json',
    ],
    CURLOPT_POSTFIELDS => json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
    CURLOPT_RETURNTRANSFER => true,
]);
$odp = curl_exec($ch);
echo 'HTTP ', curl_getinfo($ch, CURLINFO_RESPONSE_CODE), "\n", $odp, "\n";

# allee API: POST /allee/sandbox/orders (Python 3, biblioteka requests)
import os

import requests

BASE = os.environ.get("ALLEE_API_URL", "https://api.allee.pl")
headers = {
    "Authorization": "Bearer " + os.environ["ALLEE_API_KEY"],
    "Accept": "application/vnd.allegro.public.v1+json",
    "Content-Type": "application/vnd.allegro.public.v1+json",
}
body = {
    "offerId": "900000000000021",
    "quantity": 2,
    "paymentType": "ONLINE",
    "invoice": True,
    "messageToSeller": "Proszę o staranne zapakowanie.",
}
r = requests.request("POST", BASE + "/allee/sandbox/orders", headers=headers, json=body, timeout=60, allow_redirects=False)
print("HTTP", r.status_code)
print(r.text)

// allee API: POST /allee/sandbox/orders (Node.js 18+, wbudowany fetch; plik .mjs)
const BASE = process.env.ALLEE_API_URL ?? "https://api.allee.pl";
const body = {
  "offerId": "900000000000021",
  "quantity": 2,
  "paymentType": "ONLINE",
  "invoice": true,
  "messageToSeller": "Proszę o staranne zapakowanie."
};
const res = await fetch(`${BASE}/allee/sandbox/orders`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ALLEE_API_KEY}`,
    "Accept": "application/vnd.allegro.public.v1+json",
    "Content-Type": "application/vnd.allegro.public.v1+json",
  },
  body: JSON.stringify(body),
  redirect: "manual",
});
console.log("HTTP", res.status);
console.log(await res.text());

// allee API: POST /allee/sandbox/orders (C#, .NET 8+, HttpClient)
using System.Net.Http.Headers;
using System.Text;

var baseUrl = Environment.GetEnvironmentVariable("ALLEE_API_URL") ?? "https://api.allee.pl";
using var http = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false });
using var req = new HttpRequestMessage(new HttpMethod("POST"), baseUrl + "/allee/sandbox/orders");
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("ALLEE_API_KEY"));
req.Headers.Accept.ParseAdd("application/vnd.allegro.public.v1+json");
var json = """
{
  "offerId": "900000000000021",
  "quantity": 2,
  "paymentType": "ONLINE",
  "invoice": true,
  "messageToSeller": "Proszę o staranne zapakowanie."
}
""";
req.Content = new StringContent(json, Encoding.UTF8);
req.Content.Headers.ContentType = new MediaTypeHeaderValue("application/vnd.allegro.public.v1+json");
using var res = await http.SendAsync(req);
Console.WriteLine($"HTTP {(int)res.StatusCode}");
Console.WriteLine(await res.Content.ReadAsStringAsync());

// allee API: POST /allee/sandbox/orders (Java 11+, java.net.http; uruchom: java Main.java)
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String base = System.getenv().getOrDefault("ALLEE_API_URL", "https://api.allee.pl");
        String body = """
        {
          "offerId": "900000000000021",
          "quantity": 2,
          "paymentType": "ONLINE",
          "invoice": true,
          "messageToSeller": "Proszę o staranne zapakowanie."
        }
        """;
        HttpRequest req = HttpRequest.newBuilder(URI.create(base + "/allee/sandbox/orders"))
                .header("Authorization", "Bearer " + System.getenv("ALLEE_API_KEY"))
                .header("Accept", "application/vnd.allegro.public.v1+json")
                .header("Content-Type", "application/vnd.allegro.public.v1+json")
                .method("POST", HttpRequest.BodyPublishers.ofString(body))
                .build();
        HttpClient http = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build();
        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println("HTTP " + res.statusCode());
        System.out.println(res.body());
    }
}

// allee API: POST /allee/sandbox/orders (Go 1.20+, net/http; uruchom: go run main.go)
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
)

func main() {
	base := os.Getenv("ALLEE_API_URL")
	if base == "" {
		base = "https://api.allee.pl"
	}
	body := `{
  "offerId": "900000000000021",
  "quantity": 2,
  "paymentType": "ONLINE",
  "invoice": true,
  "messageToSeller": "Proszę o staranne zapakowanie."
}`
	req, err := http.NewRequest("POST", base+"/allee/sandbox/orders", strings.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("ALLEE_API_KEY"))
	req.Header.Set("Accept", "application/vnd.allegro.public.v1+json")
	req.Header.Set("Content-Type", "application/vnd.allegro.public.v1+json")
	klient := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
	res, err := klient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	dane, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println("HTTP", res.StatusCode)
	fmt.Println(string(dane))
}

curl -sS -X POST "${ALLEE_API_URL:-https://api.allee.pl}/allee/sandbox/messages" \
  -H "Authorization: Bearer $ALLEE_API_KEY" \
  -H "Accept: application/vnd.allegro.public.v1+json" \
  -H "Content-Type: application/vnd.allegro.public.v1+json" \
  --data-binary @- \
  -w '\nHTTP %{http_code}\n' <<'JSON'
{
  "offerId": "900000000000021",
  "text": "Czy płyta ma polski lektor?"
}
JSON

<?php
// allee API: POST /allee/sandbox/messages (PHP 8, rozszerzenie curl)
$base = getenv('ALLEE_API_URL') ?: 'https://api.allee.pl';
$body = [
    'offerId' => '900000000000021',
    'text' => 'Czy płyta ma polski lektor?',
];
$ch = curl_init($base . '/allee/sandbox/messages');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ALLEE_API_KEY'),
        'Accept: application/vnd.allegro.public.v1+json',
        'Content-Type: application/vnd.allegro.public.v1+json',
    ],
    CURLOPT_POSTFIELDS => json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
    CURLOPT_RETURNTRANSFER => true,
]);
$odp = curl_exec($ch);
echo 'HTTP ', curl_getinfo($ch, CURLINFO_RESPONSE_CODE), "\n", $odp, "\n";

# allee API: POST /allee/sandbox/messages (Python 3, biblioteka requests)
import os

import requests

BASE = os.environ.get("ALLEE_API_URL", "https://api.allee.pl")
headers = {
    "Authorization": "Bearer " + os.environ["ALLEE_API_KEY"],
    "Accept": "application/vnd.allegro.public.v1+json",
    "Content-Type": "application/vnd.allegro.public.v1+json",
}
body = {
    "offerId": "900000000000021",
    "text": "Czy płyta ma polski lektor?",
}
r = requests.request("POST", BASE + "/allee/sandbox/messages", headers=headers, json=body, timeout=60, allow_redirects=False)
print("HTTP", r.status_code)
print(r.text)

// allee API: POST /allee/sandbox/messages (Node.js 18+, wbudowany fetch; plik .mjs)
const BASE = process.env.ALLEE_API_URL ?? "https://api.allee.pl";
const body = {
  "offerId": "900000000000021",
  "text": "Czy płyta ma polski lektor?"
};
const res = await fetch(`${BASE}/allee/sandbox/messages`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ALLEE_API_KEY}`,
    "Accept": "application/vnd.allegro.public.v1+json",
    "Content-Type": "application/vnd.allegro.public.v1+json",
  },
  body: JSON.stringify(body),
  redirect: "manual",
});
console.log("HTTP", res.status);
console.log(await res.text());

// allee API: POST /allee/sandbox/messages (C#, .NET 8+, HttpClient)
using System.Net.Http.Headers;
using System.Text;

var baseUrl = Environment.GetEnvironmentVariable("ALLEE_API_URL") ?? "https://api.allee.pl";
using var http = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false });
using var req = new HttpRequestMessage(new HttpMethod("POST"), baseUrl + "/allee/sandbox/messages");
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("ALLEE_API_KEY"));
req.Headers.Accept.ParseAdd("application/vnd.allegro.public.v1+json");
var json = """
{
  "offerId": "900000000000021",
  "text": "Czy płyta ma polski lektor?"
}
""";
req.Content = new StringContent(json, Encoding.UTF8);
req.Content.Headers.ContentType = new MediaTypeHeaderValue("application/vnd.allegro.public.v1+json");
using var res = await http.SendAsync(req);
Console.WriteLine($"HTTP {(int)res.StatusCode}");
Console.WriteLine(await res.Content.ReadAsStringAsync());

// allee API: POST /allee/sandbox/messages (Java 11+, java.net.http; uruchom: java Main.java)
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String base = System.getenv().getOrDefault("ALLEE_API_URL", "https://api.allee.pl");
        String body = """
        {
          "offerId": "900000000000021",
          "text": "Czy płyta ma polski lektor?"
        }
        """;
        HttpRequest req = HttpRequest.newBuilder(URI.create(base + "/allee/sandbox/messages"))
                .header("Authorization", "Bearer " + System.getenv("ALLEE_API_KEY"))
                .header("Accept", "application/vnd.allegro.public.v1+json")
                .header("Content-Type", "application/vnd.allegro.public.v1+json")
                .method("POST", HttpRequest.BodyPublishers.ofString(body))
                .build();
        HttpClient http = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build();
        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println("HTTP " + res.statusCode());
        System.out.println(res.body());
    }
}

// allee API: POST /allee/sandbox/messages (Go 1.20+, net/http; uruchom: go run main.go)
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
)

func main() {
	base := os.Getenv("ALLEE_API_URL")
	if base == "" {
		base = "https://api.allee.pl"
	}
	body := `{
  "offerId": "900000000000021",
  "text": "Czy płyta ma polski lektor?"
}`
	req, err := http.NewRequest("POST", base+"/allee/sandbox/messages", strings.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("ALLEE_API_KEY"))
	req.Header.Set("Accept", "application/vnd.allegro.public.v1+json")
	req.Header.Set("Content-Type", "application/vnd.allegro.public.v1+json")
	klient := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
	res, err := klient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	dane, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println("HTTP", res.StatusCode)
	fmt.Println(string(dane))
}

Różnice sandboxu

Zdjęcia z adresów są „przyjmowane” bez pobierania (oferta od razu aktywna).
Wgrywanie plików wprost do magazynu (POST /allee/uploads, POST /allee/feeds/documents) → 403 SANDBOX_UNSUPPORTED — podawaj adresy URL i wsady w treści żądania.
Podpisane linki do faktur i raportów z sandboxu mają parametr mode=test objęty podpisem — pobierasz je tak samo jak w produkcji, bez tokenu.
Nic nie trafia do wyszukiwarki allee.pl ani do kupujących; e-maile nie wychodzą.