An AWS Secrets Manager mock that boto3 and the AWS SDKs run against

Connect

Set the SDK’s endpoint URL and it signs and sends every call here, as it would to AWS. For reads of the seed account that is all it takes; for your own writes to stick from one call to the next, add the few lines that carry X-Sondahub-Session.

Python (boto3)

import boto3

sm = boto3.client(
    'secretsmanager',
    region_name='us-east-1',
    endpoint_url='https://api.sondahub.com/sandbox/aws-secrets-manager',
    aws_access_key_id='AKIASONDAHUB000001',   # its signature is checked
    aws_secret_access_key='probe-secret',
)

# carry the sandbox session from each answer to the next request
session = {}
def send(request, **kwargs):
    if 'token' in session:
        request.headers['X-Sondahub-Session'] = session['token']
def keep(http_response, **kwargs):
    token = http_response.headers.get('X-Sondahub-Session')
    if token:
        session['token'] = token
sm.meta.events.register('before-sign.secrets-manager.*', send)
sm.meta.events.register('after-call.secrets-manager.*', keep)

sm.create_secret(Name='dev/myapp/api-key', SecretString='{"api_key": "abc123"}')
print(sm.get_secret_value(SecretId='dev/myapp/api-key')['SecretString'])

Node (@aws-sdk/client-secrets-manager)

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager'

const sm = new SecretsManagerClient({
  region: 'us-east-1',
  endpoint: 'https://api.sondahub.com/sandbox/aws-secrets-manager',
  credentials: { accessKeyId: 'AKIASONDAHUB000001', secretAccessKey: 'probe-secret' },
})

// carry the sandbox session from each answer to the next request
let session = null
sm.middlewareStack.add((next) => async (args) => {
  if (session) args.request.headers['x-sondahub-session'] = session
  const out = await next(args)
  session = out.response.headers['x-sondahub-session'] ?? session
  return out
}, { step: 'build', name: 'sondahubSession' })

const { SecretString } = await sm.send(new GetSecretValueCommand({ SecretId: 'prod/payments/stripe' }))

AWS CLI

export AWS_ACCESS_KEY_ID=AKIASONDAHUB000001 AWS_SECRET_ACCESS_KEY=probe-secret AWS_DEFAULT_REGION=us-east-1
aws secretsmanager get-secret-value --secret-id prod/payments/stripe \
  --endpoint-url https://api.sondahub.com/sandbox/aws-secrets-manager

The CLI can’t carry the session token from one command to the next, so it reads the seed account; writes answer exactly as AWS would but don’t stick.

Import it. In Sonda: Import → From a URL, paste the OpenAPI address. You get a folder per resource and a request per operation, with example bodies and names from the seed, so most requests work as they are. Then set the auth: AWS Signature Version 4, service secretsmanager, with the key above — each action has a path of its own (/sandbox/aws-secrets-manager/GetSecretValue), which the sandbox reads when X-Amz-Target is missing. Any client that imports OpenAPI 3 takes the same address.

Try it here

The page signs these with SigV4 and the published key, the way an SDK would.

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.ListSecrets" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"MaxResults":10}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.GetSecretValue" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"prod/payments/stripe"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.CreateSecret" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"Name":"dev/myapp/api-key","Description":"An API key for myapp","SecretString":"{\"api_key\":\"abc123\"}","Tags":[{"Key":"env","Value":"dev"}]}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.PutSecretValue" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"dev/myapp/api-key","SecretString":"{\"api_key\":\"def456\"}"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.GetSecretValue" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"dev/myapp/api-key","VersionStage":"AWSPREVIOUS"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.RotateSecret" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"prod/db/orders-postgres"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.GetSecretValue" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"legacy/ftp-password"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.RestoreSecret" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"SecretId":"legacy/ftp-password"}'

curl https://api.sondahub.com/sandbox/aws-secrets-manager \
  --aws-sigv4 "aws:amz:us-east-1:secretsmanager" \
  --user "AKIASONDAHUB000001:probe-secret" \
  -H "X-Amz-Target: secretsmanager.GetRandomPassword" \
  -H "Content-Type: application/x-amz-json-1.1" \
  -d '{"PasswordLength":24,"ExcludeCharacters":"/@\"'\''\\"}'

From the shell, keep the token yourself: curl -i shows X-Sondahub-Session; send it back with -H "X-Sondahub-Session: …". How sessions work.

The seed account

Account 123456789012, with these secrets in every region:

Every value in the seed is fake and made up when the site is built. What you write is kept in your own session token and nowhere else — but this is a public playground: never send it a real secret. Not affiliated with, or endorsed by, Amazon Web Services.

Versions and labels

Each value is a version, and its id is the ClientRequestToken that made it (the SDKs make one for you). AWSCURRENT is what a read gets; a new value takes it, and the old one becomes AWSPREVIOUS. Send the same token with the same value again and you get the same version back — with another value, ResourceExistsException. UpdateSecretVersionStage moves a label: rolling back is moving AWSCURRENT to the AWSPREVIOUS version, naming where it is now in RemoveFromVersionId.

DeleteSecret schedules deletion 7 to 30 days out: until then reads answer “marked for deletion”, ListSecrets hides it unless IncludePlannedDeletion, its name can’t be reused, and RestoreSecret brings it back. ForceDeleteWithoutRecovery deletes it now.

What it answers

All 23 Secrets Manager actions: CreateSecret, GetSecretValue, BatchGetSecretValue, DescribeSecret, ListSecrets, ListSecretVersionIds, PutSecretValue, UpdateSecret, UpdateSecretVersionStage, DeleteSecret, RestoreSecret, RotateSecret, CancelRotateSecret, TagResource, UntagResource, GetResourcePolicy, PutResourcePolicy, DeleteResourcePolicy, ValidateResourcePolicy, GetRandomPassword, ReplicateSecretToRegions, RemoveRegionsFromReplication, StopReplicationToReplica.

Also on sondahub

Fake REST API · Public GraphQL API · gRPC-Web & Connect · SOAP test server · JSON-RPC & XML-RPC · OData test server · FHIR test server · Socket.IO test server · WebSocket test server · SSE test server · Public MQTT broker · MCP test server · MCP OAuth test server · Writes that persist · OpenAPI mock server · Webhook tester · Chaos and rate limits · SAML test IdP and SP · SCIM 2.0 test server · OAuth 2.0 test server · Auth test endpoints · HTTP test endpoints · Fake JSON data · JSONPlaceholder alternative · Stripe sandbox · Twilio sandbox · SendGrid sandbox · Authorize.net sandbox · OpenAI sandbox · Anthropic sandbox · Azure Key Vault sandbox · Google Secret Manager sandbox · 1Password Connect sandbox · Doppler sandbox · Infisical sandbox

The mock APIs themselves: fake e-commerce API, fake IoT API, fake banking API, fake social media API, fake helpdesk API, fake flight booking API, fake user directory API. Built as the playground for LockFlare Sonda, the API client that lives on your computer.