A 1Password Connect server mock for the Connect SDKs

Connect

Python (onepasswordconnectsdk)

from onepasswordconnectsdk.client import new_client

client = new_client('https://api.sondahub.com/sandbox/1password-connect', 'sondahub-connect-token')   # any token works

# carry the sandbox session from each answer to the next request
def keep(response):
    token = response.headers.get('X-Sondahub-Session')
    if token:
        client.session.headers['X-Sondahub-Session'] = token
client.session.event_hooks['response'] = [keep]

item = client.get_item('Admin console', 'Production')
print([(f.label, f.totp or f.value) for f in item.fields])

op CLI, through Connect

export OP_CONNECT_HOST=https://api.sondahub.com/sandbox/1password-connect
export OP_CONNECT_TOKEN=sondahub-connect-token
op item get Stripe --vault Production --fields credential

Import it. In Sonda: Import → From a URL, paste the OpenAPI address. You get a folder per resource and a request per operation, with example bodies and names from the seed, so most requests work as they are. Then set the auth: Bearer token sondahub-connect-token. Any client that imports OpenAPI 3 takes the same address.

Try it here

curl "https://api.sondahub.com/sandbox/1password-connect/v1/vaults" \
  -H "Authorization: Bearer sondahub-connect-token"

curl "https://api.sondahub.com/sandbox/1password-connect/v1/vaults/i7gwu4baaugmv7aapnir3saard/items" \
  -H "Authorization: Bearer sondahub-connect-token"

curl "https://api.sondahub.com/sandbox/1password-connect/v1/vaults/i7gwu4baaugmv7aapnir3saard/items/p7dw1zbar0s1wdaay8xkz7aaei" \
  -H "Authorization: Bearer sondahub-connect-token"

curl "https://api.sondahub.com/sandbox/1password-connect/v1/vaults/i7gwu4baaugmv7aapnir3saard/items?filter=title%20eq%20%22Orders%20database%22" \
  -H "Authorization: Bearer sondahub-connect-token"

curl -X POST "https://api.sondahub.com/sandbox/1password-connect/v1/vaults/i7gwu4baaugmv7aapnir3saard/items" \
  -H "Authorization: Bearer sondahub-connect-token" \
  -H "Content-Type: application/json" \
  -d '{"vault":{"id":"i7gwu4baaugmv7aapnir3saard"},"title":"Grafana","category":"LOGIN","tags":["prod"],"urls":[{"href":"https://grafana.example.com","primary":true}],"fields":[{"id":"username","label":"username","purpose":"USERNAME","value":"[email protected]"},{"id":"password","label":"password","purpose":"PASSWORD","generate":true,"recipe":{"length":24,"characterSets":["LETTERS","DIGITS","SYMBOLS"]}}]}'

curl -X PATCH "https://api.sondahub.com/sandbox/1password-connect/v1/vaults/i7gwu4baaugmv7aapnir3saard/items/ckjrfeaaghkvt5bafsxnidaa1g" \
  -H "Authorization: Bearer sondahub-connect-token" \
  -H "Content-Type: application/json" \
  -d '[{"op":"replace","path":"/fields/port/value","value":"6432"},{"op":"add","path":"/tags/-","value":"pgbouncer"}]'

curl "https://api.sondahub.com/sandbox/1password-connect/v1/activity" \
  -H "Authorization: Bearer sondahub-connect-token"

From the shell, keep the token yourself: curl -i shows X-Sondahub-Session; send it back with -H "X-Sondahub-Session: …". How sessions work.

The seed vaults

Items take any of the 22 categories, with fields (STRING, CONCEALED, EMAIL, URL, OTP, DATE, MENU…), purposes (USERNAME, PASSWORD, NOTES), sections, URLs and tags. A field with generate: true gets a password from its recipe — length 1 to 64, LETTERS, DIGITS, SYMBOLS, excluded characters — and its entropy. Every write moves the item’s version and the vault’s content version.

Every value in the seed is fake and made up when the site is built. What you write is kept in your own session token and nowhere else — but this is a public playground: never send it a real secret. Not affiliated with, or endorsed by, 1Password.

What it answers

All under /sandbox/1password-connect. Errors are Connect’s: {"status", "message"}.

Also on sondahub

Fake REST API · Public GraphQL API · gRPC-Web & Connect · SOAP test server · JSON-RPC & XML-RPC · OData test server · FHIR test server · Socket.IO test server · WebSocket test server · SSE test server · Public MQTT broker · MCP test server · MCP OAuth test server · Writes that persist · OpenAPI mock server · Webhook tester · Chaos and rate limits · SAML test IdP and SP · SCIM 2.0 test server · OAuth 2.0 test server · Auth test endpoints · HTTP test endpoints · Fake JSON data · JSONPlaceholder alternative · Stripe sandbox · Twilio sandbox · SendGrid sandbox · Authorize.net sandbox · OpenAI sandbox · Anthropic sandbox · AWS Secrets Manager sandbox · Azure Key Vault sandbox · Google Secret Manager sandbox · Doppler sandbox · Infisical sandbox

The mock APIs themselves: fake e-commerce API, fake IoT API, fake banking API, fake social media API, fake helpdesk API, fake flight booking API, fake user directory API. Built as the playground for LockFlare Sonda, the API client that lives on your computer.