Both base URLs are live. A reachable endpoint does not grant access: every request other than the OpenAPI contract requires an environment-specific key and current server-side grant.
Sandbox and production use separate databases, keys, and grants. A key issued for one environment never works in the other.
Use synthetic data in sandbox. Sandbox sends messages only to recipients on PayPathIQ’s sandbox allowlist, so they do not reach the Customers you create. Payment integrations use test-mode credentials. Production does not accept an
isTest flag.