A sandbox API your agent can actually trust
Endpoints designed for AI coding agents like Claude Code, Cursor, Copilot, and Devin. Cursor pagination, deeply nested data, realistic relational shapes, and 15 deliberate failure modes. Deterministic responses make agent failures reproducible.
Free tier is open - 100 requests/day per IP, no signup. Upgrade for 10M/month + every failure scenario.
Built on twelve years of API infrastructure.
ReqRes has been serving test API requests since 2014. Today we handle over 150 million requests per month across individual developers, QA teams at enterprises like Lloyds Banking Group and Microsoft, and computer science classrooms worldwide.
The Agent Sandbox is built on the same infrastructure: the same per-customer metering, the same rate limiting, the same request logging, the same billing rails that have handled that volume for over a decade. When your agent hits /agent/v1/, it's hitting a system that's been in production longer than most of your dependencies.
Try a request right now
No signup. No key. Paste this into your terminal:
curl https://reqres.in/agent/v1/users?limit=2
Response includes cursor pagination, nullable nested fields, ULIDs with type prefixes, and ISO 8601 timestamps. Same request always returns the same data (deterministic seeding). Free tier caps at 100 requests/day per IP - add -H "x-agent-id: agt_..." with a subscriber key to raise the cap.
What's different from /api/users?
The legacy /api/users endpoint serves 12 fixture users with shallow shapes. Great for humans learning HTTP. Wrong shape for agents practicing real-world code.
| Aspect | /api/users | /agent/v1/users |
|---|---|---|
| Pagination | Offset (?page=N) | Cursor (?cursor=...) |
| ID format | Integer (1-12) | ULID (usr_01H...) |
| Fields per record | 5 flat fields | 20+ fields, 3 levels nested |
| Nullable fields | None | Many (forces null-handling) |
| Determinism | Static fixture | Seeded, reproducible |
| Total fixture size | 12 users | 247 per seed, ∞ seeds |
What's in the sandbox
Cursor-paginated user list. Sparse fieldsets. Silent param clamping. Forces correct pagination handling.
Deeply nested resource with optional ?expand= for addresses, activity, organizations. Heterogeneous activity records.
Returns a session OR an MFA challenge depending on the email. Trains agents to handle shape-varying responses and hypermedia next_step hints.
Relational data: orders reference users, products, addresses. Money is always {amount, currency, formatted}. Some line items reference deleted products.
15 deliberate failure modes (enumerated below). Every response includes X-Agent-Sandbox-Intentional - configure your error reporter (Sentry, Bugsnag) to suppress responses carrying that header so your training scenarios don't fill your alert queue.
Every failure scenario, enumerated
Free tier unlocks 3 samples (rate-limited, validation-error, malformed-json). The other 12 return 403 scenario_requires_upgrade until you're on Agent Developer.
| Scenario | Status | Tier | Description |
|---|---|---|---|
rate-limited | 429 | Free | Rate-limit throttling with Retry-After. |
server-error | 500 | Paid | Generic 5xx. Exercises your retry path. |
bad-gateway | 502 | Paid | Upstream returned garbage. Test fallback + backoff. |
timeout | 504 | Paid | Gateway timeout. Returns immediately with X-Agent-Sandbox-Simulated-Delay: 30000. |
validation-error | 422 | Free | Multi-field validation failure with field_errors object. |
unauthorized | 401 | Paid | Missing/invalid auth token, with WWW-Authenticate. |
forbidden | 403 | Paid | Authenticated but missing scope. |
not-found | 404 | Paid | Resource not found with a "Did you mean?" hint. |
conflict | 409 | Paid | Optimistic-concurrency failure; body carries current_version + your_version. |
too-large | 413 | Paid | Payload exceeds max size; includes max_bytes. |
slow | 200 | Paid | Returns immediately with X-Agent-Sandbox-Simulated-Delay: 10000. Delay client-side. |
partial-content | 206 | Paid | Partial response with Content-Range. Exercises Range handling. |
redirect-loop | 302 | Paid | 3-hop chain (?hop=0 → 1 → 2 → JSON). Exercises follow-redirect caps. |
malformed-json | 200 | Free | 200 + Content-Type: application/json with truncated body. |
empty-response | 200 | Paid | 200 + Content-Length: 0 and no body. |
Programmatic list: GET /agent/v1/scenarios returns the same catalog as JSON for agent discovery.
Pricing
Free
$0Explore the sandbox with IP-based rate limits. Good for prototyping and first-integration smoke tests.
- • All fixture endpoints (/users, /orders, /auth/login)
- • 100 requests/day per IP
- • 3 sample failure scenarios (rate-limited, validation-error, malformed-json)
- • No signup required
Agent Developer
$49 /moHigher cap + every failure scenario. You get an issued key to put in x-agent-id.
- • 10M requests/month (~333,333/day)
- • All 15 failure scenarios unlocked
- • Usage dashboard at app.reqres.in/agents
- • Dev plan quotas on the main ReqRes BaaS product
Agent Platform
Contact salesBuilding an AI coding tool of your own? Talk to us about higher volumes, private namespaces, and custom SLAs.
- • 100M+ requests/month
- • Custom SLA + private namespace
- • Per-customer rate-limit tenancy
Kickstart prompt (paste into your LLM)
Copy this straight into Claude Code, Cursor, ChatGPT, or whatever you build with. Then tell it what you want to build.
I'm wiring up code against ReqRes for Agents - a deterministic HTTP sandbox for AI coding agents.
Spec (fetch and read first):
https://reqres.in/llm.txt
https://reqres.in/openapi.json
Facts to keep in working memory:
- Base URL: https://reqres.in/agent/v1
- Auth: free tier is open (no header), capped at 100 requests/day per IP. Paid tier sends `x-agent-id: agt_<64 hex>` for 10M requests/month. Keys are issued only via https://app.reqres.in/agents - never invent or guess the value. Arbitrary strings return 401.
- Endpoints: GET /users, GET /users/:id (?expand=addresses,activity,organizations), POST /auth/login, GET /orders, GET /scenarios/:name, GET /health.
- IDs are ULIDs with a type prefix (usr_, ord_, prd_, adr_, act_). 26 chars after the prefix.
- Money is always {amount (integer in smallest unit), currency, formatted}. Never a decimal.
- Pagination is cursor-based. Pass meta.next_cursor back unchanged. Treat cursors as opaque.
- Deterministic: same (seed, cursor, params) → same response. Default seed=42.
- /scenarios/:name exposes 15 deliberate failures (rate-limited, server-error, timeout, validation-error, malformed-json, redirect-loop, …) for exercising retry/backoff/error paths. Every response sets X-Agent-Sandbox-Intentional; suppress that in your error reporter so training runs don't fill your alert queue.
- Free tier only unlocks 3 of the 15 scenarios (rate-limited, validation-error, malformed-json); the rest return 403 until you're on Agent Developer.
Now please: <tell the agent what to do - e.g. "write a retry-with-exponential-backoff wrapper and test it against /scenarios/rate-limited and /scenarios/server-error" or "generate a typed TypeScript client with full type inference for /users expansion">Built for agents to discover
Agents don't need a human-readable docs site -- they need a machine-readable manifest. Point your agent at any of these: