A Google Secret Manager mock for the client libraries’ REST transport

Connect

Python (google-cloud-secret-manager)

from google.cloud import secretmanager
from google.oauth2 import service_account
from google.api_core.client_options import ClientOptions

# the sandbox's service account key file: https://api.sondahub.com/sandbox/google-secret-manager/service-account.json
creds = service_account.Credentials.from_service_account_file(
    'sondahub-service-account.json', scopes=['https://www.googleapis.com/auth/cloud-platform'])
client = secretmanager.SecretManagerServiceClient(
    credentials=creds, transport='rest', client_options=ClientOptions(api_endpoint='https://api.sondahub.com'))

# carry the sandbox session from each answer to the next request
http = client._transport._session   # the requests.Session the REST transport sends with
def keep(response, *args, **kwargs):
    token = response.headers.get('X-Sondahub-Session')
    if token:
        http.headers['X-Sondahub-Session'] = token
http.hooks['response'].append(keep)

parent = 'projects/sondahub-demo'
secret = client.create_secret(request={'parent': parent, 'secret_id': 'my-secret',
                                       'secret': {'replication': {'automatic': {}}}})
client.add_secret_version(request={'parent': secret.name, 'payload': {'data': b'hello world'}})
print(client.access_secret_version(request={'name': secret.name + '/versions/latest'}).payload.data)

Import it. In Sonda: Import → From a URL, paste the OpenAPI address. You get a folder per resource and a request per operation, with example bodies and names from the seed, so most requests work as they are. Then set the auth: any bearer token (sandbox-token works). Any client that imports OpenAPI 3 takes the same address.

Try it here

curl "https://api.sondahub.com/v1/projects/sondahub-demo/secrets" \
  -H "Authorization: Bearer sandbox-token"

curl "https://api.sondahub.com/v1/projects/sondahub-demo/secrets/stripe-api-key/versions/latest:access" \
  -H "Authorization: Bearer sandbox-token"

curl "https://api.sondahub.com/v1/projects/sondahub-demo/secrets/stripe-api-key/versions/1:access" \
  -H "Authorization: Bearer sandbox-token"

curl -X POST "https://api.sondahub.com/v1/projects/sondahub-demo/secrets?secretId=my-secret" \
  -H "Authorization: Bearer sandbox-token" \
  -H "Content-Type: application/json" \
  -d '{"replication":{"automatic":{}},"labels":{"env":"dev"}}'

curl -X POST "https://api.sondahub.com/v1/projects/sondahub-demo/secrets/my-secret:addVersion" \
  -H "Authorization: Bearer sandbox-token" \
  -H "Content-Type: application/json" \
  -d '{"payload":{"data":"aGVsbG8gd29ybGQ=","dataCrc32c":"3381945770"}}'

curl "https://api.sondahub.com/v1/projects/sondahub-demo/secrets/my-secret/versions/latest:access" \
  -H "Authorization: Bearer sandbox-token"

curl "https://api.sondahub.com/v1/projects/sondahub-demo/secrets?filter=labels.env%3Dprod" \
  -H "Authorization: Bearer sandbox-token"

From the shell, keep the token yourself: curl -i shows X-Sondahub-Session; send it back with -H "X-Sondahub-Session: …". How sessions work.

The seed project

These answer in every project; what you create lives in the project (and location) you created it in.

Versions are numbered from 1. latest is the newest; an alias names one. Disabling stops access; destroying drops the data — or, with versionDestroyTtl on the secret, disables it now and destroys it when the delay runs out (enabling it in between cancels). A secret with expireTime or ttl deletes itself. Regional secrets live under /locations/{location} in 21 locations.

Every value in the seed is fake and made up when the site is built. What you write is kept in your own session token and nowhere else — but this is a public playground: never send it a real secret. Not affiliated with, or endorsed by, Google.

What it answers

Errors are google.rpc.Status: {"error": {"code", "message", "status"}}. Enums come back as numbers when the client asks with $alt=json;enum-encoding=int, as the REST transports do.

Also on sondahub

Fake REST API · Public GraphQL API · gRPC-Web & Connect · SOAP test server · JSON-RPC & XML-RPC · OData test server · FHIR test server · Socket.IO test server · WebSocket test server · SSE test server · Public MQTT broker · MCP test server · MCP OAuth test server · Writes that persist · OpenAPI mock server · Webhook tester · Chaos and rate limits · SAML test IdP and SP · SCIM 2.0 test server · OAuth 2.0 test server · Auth test endpoints · HTTP test endpoints · Fake JSON data · JSONPlaceholder alternative · Stripe sandbox · Twilio sandbox · SendGrid sandbox · Authorize.net sandbox · OpenAI sandbox · Anthropic sandbox · AWS Secrets Manager sandbox · Azure Key Vault sandbox · 1Password Connect sandbox · Doppler sandbox · Infisical sandbox

The mock APIs themselves: fake e-commerce API, fake IoT API, fake banking API, fake social media API, fake helpdesk API, fake flight booking API, fake user directory API. Built as the playground for LockFlare Sonda, the API client that lives on your computer.