Testheon Practice API
Synthetic, deterministic REST practice data with isolated sandboxes. All responses are noindex and private/no-store.
Resources
/practice/api/v1/users— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/products— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/orders— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/customers— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/employees— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/tasks— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/tickets— GET, POST, GET/PUT/PATCH/DELETE by ID/practice/api/v1/bookings— GET, POST, GET/PUT/PATCH/DELETE by ID
Sessions
Browsers receive the secure lab_sid cookie. API-only tests may create header mode with X-Lab-Mode: header, then send X-Lab-Session.
GET /practice/api/v1/lab/session returns sandbox stats. POST /practice/api/v1/lab/reset restores seed data for only that sandbox.
Collection controls
page, limit, cursor on products/employees, sort, field filters, q, delay=0..10000, simulate, seed, and size.
Authentication practice
POST /practice/api/v1/auth/token issues short-lived bearer and refresh tokens. Session-cookie, bearer-token and public demo API-key exercises are isolated from WordPress accounts.
Use GET /practice/api/v1/auth/roles for the permission matrix and open the Auth app for UI flows.
Testheon Store
GET /practice/api/v1/store/catalog supports search, category, price, rating, sort and pagination. Cart, coupon, checkout, order, profile, location, reset and one-shot scenario routes share the same isolated sandbox.
Open the indexable Store overview for API setup → UI test → API verification and network interception exercises.
Contract and errors
{"error":{"code":"VALIDATION_FAILED","message":"...","details":[]},"requestId":"..."}Every identity and credential is synthetic, session-scoped practice data.