An Azure Key Vault mock that the Azure SDK signs in to

Connect

Python (azure-keyvault-secrets, azure-identity)

from azure.identity import ClientSecretCredential
from azure.keyvault.secrets import SecretClient
from azure.core.pipeline.policies import SansIOHTTPPolicy

credential = ClientSecretCredential(
    '9e3779b1-c302-605a-db25-3734c1b23920',                    # the tenant the vault's challenge names
    '9e3779b1-6169-8a45-9fb9-5cba1e342fb5',
    'sondahub~sandbox.client-secret',
    authority='https://api.sondahub.com/sandbox/azure-key-vault/login',
    disable_instance_discovery=True,
)

class SondahubSession(SansIOHTTPPolicy):   # carry the sandbox session from each answer to the next request
    token = None
    def on_request(self, request):
        if SondahubSession.token:
            request.http_request.headers['X-Sondahub-Session'] = SondahubSession.token
    def on_response(self, request, response):
        SondahubSession.token = response.http_response.headers.get('X-Sondahub-Session') or SondahubSession.token

client = SecretClient('https://api.sondahub.com', credential, per_call_policies=[SondahubSession()])

client.set_secret('my-api-key', 's3cr3t', content_type='text/plain', tags={'env': 'dev'})
print(client.get_secret('my-api-key').value)

Node (@azure/keyvault-secrets, @azure/identity)

import { ClientSecretCredential } from '@azure/identity'
import { SecretClient } from '@azure/keyvault-secrets'

const credential = new ClientSecretCredential('9e3779b1-c302-605a-db25-3734c1b23920', '9e3779b1-6169-8a45-9fb9-5cba1e342fb5', 'sondahub~sandbox.client-secret', {
  authorityHost: 'https://api.sondahub.com/sandbox/azure-key-vault/login',
  disableInstanceDiscovery: true,
})

// carry the sandbox session from each answer to the next request
let session = null
const sondahubSession = {
  name: 'sondahubSession',
  async sendRequest(request, next) {
    if (session) request.headers.set('X-Sondahub-Session', session)
    const response = await next(request)
    session = response.headers.get('X-Sondahub-Session') ?? session
    return response
  },
}

const client = new SecretClient('https://api.sondahub.com', credential, { additionalPolicies: [{ policy: sondahubSession, position: 'perCall' }] })
const secret = await client.getSecret('orders-db-connection')

Import it. In Sonda: Import → From a URL, paste the OpenAPI address. You get a folder per resource and a request per operation, with example bodies and names from the seed, so most requests work as they are. Then set the auth: any bearer token (sandbox-token works). Any client that imports OpenAPI 3 takes the same address.

Try it here

curl "https://api.sondahub.com/secrets?api-version=2025-07-01"

curl "https://api.sondahub.com/secrets?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

curl "https://api.sondahub.com/secrets/orders-db-connection?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

curl -X PUT "https://api.sondahub.com/secrets/my-api-key?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token" \
  -H "Content-Type: application/json" \
  -d '{"value":"s3cr3t-value","contentType":"text/plain","tags":{"env":"dev"}}'

curl "https://api.sondahub.com/secrets/legacy-ftp-password?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

curl -X DELETE "https://api.sondahub.com/secrets/sendgrid-api-key?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

curl "https://api.sondahub.com/deletedsecrets?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

curl -X POST "https://api.sondahub.com/deletedsecrets/old-webhook-secret/recover?api-version=2025-07-01" \
  -H "Authorization: Bearer sandbox-token"

From the shell, keep the token yourself: curl -i shows X-Sondahub-Session; send it back with -H "X-Sondahub-Session: …". How sessions work.

The seed vault

A set makes a new version and the newest is what a read gets; PATCH changes a version’s attributes, content type and tags, not its value. A delete is soft: the secret moves to /deletedsecrets for 90 days, its name can’t be reused (409 ObjectIsDeletedButRecoverable), and it can be recovered or purged. A backup is every version in one signed blob; restore it into a vault that doesn’t have the name.

Every value in the seed is fake and made up when the site is built. What you write is kept in your own session token and nowhere else — but this is a public playground: never send it a real secret. Not affiliated with, or endorsed by, Microsoft.

What it answers

Every vault call takes ?api-version=. Errors are Key Vault’s: {"error": {"code", "message", "innererror"}}.

Also on sondahub

Fake REST API · Public GraphQL API · gRPC-Web & Connect · SOAP test server · JSON-RPC & XML-RPC · OData test server · FHIR test server · Socket.IO test server · WebSocket test server · SSE test server · Public MQTT broker · MCP test server · MCP OAuth test server · Writes that persist · OpenAPI mock server · Webhook tester · Chaos and rate limits · SAML test IdP and SP · SCIM 2.0 test server · OAuth 2.0 test server · Auth test endpoints · HTTP test endpoints · Fake JSON data · JSONPlaceholder alternative · Stripe sandbox · Twilio sandbox · SendGrid sandbox · Authorize.net sandbox · OpenAI sandbox · Anthropic sandbox · AWS Secrets Manager sandbox · Google Secret Manager sandbox · 1Password Connect sandbox · Doppler sandbox · Infisical sandbox

The mock APIs themselves: fake e-commerce API, fake IoT API, fake banking API, fake social media API, fake helpdesk API, fake flight booking API, fake user directory API. Built as the playground for LockFlare Sonda, the API client that lives on your computer.