Sandbox and testing

The sandbox is ColiSwift’s own pre-production at https://coli.swiftmanager.net. It runs the same code as production with separate data: test sellers, test products, test orders. Production (https://coliswift.com) is the live platform with real sellers, real customers and real money — never test there.

Getting set up

1. Create your test seller

• Sign up as a seller on https://coli.swiftmanager.net/signup. On the sandbox the account is validated at once and its COD Drop access is opened — you can sign in immediately. (In production a new seller waits for ColiSwift’s validation, and COD Drop access is opened on request.)
• Use your own test seller: there is one connection per app and seller, and an app you create can only be connected by the seller account that created it.
• Create a store and a few products — in ColiSwift, or with POST /stores and POST /products once connected. Note their references.

2. Create your app

Signed in as your test seller, open Intégrations → Applications développeur. This screen exists on the sandbox only.

• Create an app: name, description, logo, redirect URIs, the scopes it may ask for, a webhook URL and an optional event filter — the same fields ColiSwift registers for a production app (Apps and credentials).
• The client_id, the client_secret and the webhook secret are shown once, right after creation. Copy them then: only a hash of the client secret is kept.
• Redirect URIs: https:, or http://localhost / 127.0.0.1 / [::1] on any port. The webhook URL must be public HTTPS (never a private or loopback address): to receive webhooks on your laptop, use a tunnel.
• Up to 5 active apps per seller account (DEVELOPER_APP_LIMIT beyond that: delete one first).
• Edit an app at any time. Removing a scope narrows the existing connections at once (see Apps and credentials).
• Rotate the client secret (the old one stops working immediately) or the webhook secret (the next deliveries are signed with the new one).
• Delete an app: every connection is revoked, every token dies and pending deliveries are marked dead. A deleted app cannot be edited again (APP_DEACTIVATED); it frees a slot.
• Each app card lists the last 20 webhook deliveries with their status (delivered, pending, failed, dead), attempt count and the HTTP status your endpoint answered.

3. Connect your seller to your app

Run the OAuth flow against https://coli.swiftmanager.net with your app’s client_id, one of its redirect URIs and PKCE. Sign in as your test seller on the consent page and approve.

4. Build and test

• Create orders with POST /orders and read them back.
• On the sandbox nobody works your orders: move them forward yourself with the advance helper and receive the real lead.* webhooks.
• Check your webhook endpoint and its signature code with a test event.
• Test the failure paths: an expired access token (refresh), a reused refresh token (connection revoked), the seller disconnecting the app from their Integrations page (401 on the next call), a scope removed from your app (403 on the calls it allowed).

Advance an order (test helper)

Moves an order your app created one step through its life, the way ColiSwift’s teams would. Nothing is simulated: each step runs ColiSwift’s real status engine as the « Système ColiSwift » account (confirmation, validation and stock reservation, delivery), so the order and the webhooks you receive are exactly those of a real order. Sandbox only: in production the route does not exist (404).

curl -X POST "https://coliswift.com/api/partner/v1/test/orders/shop_10482/advance" \
  -H "Authorization: Bearer $COLISWIFT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "to": "confirmed"
}'

const res = await fetch('https://coliswift.com/api/partner/v1/test/orders/shop_10482/advance', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.COLISWIFT_ACCESS_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "to": "confirmed"
  }),
});
const data = await res.json();

$ch = curl_init('https://coliswift.com/api/partner/v1/test/orders/shop_10482/advance');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('COLISWIFT_ACCESS_TOKEN'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => <<<'JSON'
{
  "to": "confirmed"
}
JSON,
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);

import os, requests

res = requests.post(
    "https://coliswift.com/api/partner/v1/test/orders/shop_10482/advance",
    headers={"Authorization": f"Bearer {os.environ['COLISWIFT_ACCESS_TOKEN']}"},
    json={
        "to": "confirmed",
    },
)
data = res.json()

{
  "from": "open",
  "to": "confirmed",
  "stage": "confirmed",
  "allowedNext": [
    "shipped",
    "cancelled"
  ],
  "order": {
    "lead_id": "6f1c2a9e-3b7d-4c11-9a52-0d8e4b7f2c10",
    "external_id": "shop_10482",
    "order_code": "MA03112026-0042",
    "currency": "MAD",
    "country": "MA",
    "store_id": "b2d4e6f8-1a3c-4e5f-8a9b-0c1d2e3f4a5b",
    "status": "confirmed",
    "confirmed_at": "2026-11-03T10:15:05.000Z",
    "articles_amount": "398.00",
    "lines": [
      {
        "line_id": "c0a8e1f2-5d6b-4a7c-9e8f-1a2b3c4d5e6f",
        "product_id": "9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b",
        "product_reference": "SERUM-ARGAN-30",
        "product_name": "Sérum à l'huile d'argan 30 ml",
        "variant_id": null,
        "variant_label": null,
        "quantity": 2,
        "unit_price": "199.00"
      }
    ],
    "created_at": "2026-11-03T09:58:41.000Z",
    "updated_at": "2026-11-03T10:15:05.000Z"
  }
}

Steps and allowed paths

open → confirmed → shipped → delivered or returned; cancelled from open or confirmed. delivered, returned and cancelled are final. The stage is read from the order’s columns, so an order a ColiSwift user moved by hand is followed too; an order in a state the helper does not handle (e.g. a delivery problem) is closed and cannot be advanced.

Each step fires exactly the lead.* events the real gesture fires (one change can produce several, see order events). They are delivered like any event: to your app’s webhook URL, signed, while the seller’s connection is live.

Errors

A refusal of ColiSwift’s status engine itself (for example a line out of stock at confirmation) is answered as that engine answers it, and the order is left as it was.

Send a test event

On your app’s card, « Envoyer un événement de test » queues one test.ping event for that app only. It goes through the normal pipeline: signed with your app’s webhook secret (X-Coliswift-Signature), sent with the usual headers, retried on failure, listed in the app’s deliveries a few seconds later. It needs a webhook URL on the app (NO_WEBHOOK_URL otherwise), but no seller connection. At most one every 10 seconds per app and 30 per hour per seller (429 TEST_EVENT_RATE_LIMITED).

{
  "data": {
    "client_id": "cs_client_0f1e2d3c4b5a69788796a5b4c3d2e1f0",
    "message": "Test event from the ColiSwift sandbox. Verify X-Coliswift-Signature with your webhook secret."
  },
  "event": "test.ping",
  "event_id": "evt_5f1c9a0b2d3e4f5a6b7c8d9e",
  "occurred_at": "2026-11-02T11:20:41.302Z",
  "seller_id": "6a1c2f0e-3b7d-4c55-9e10-2f8a4b7c9d01",
  "sequence": 4201
}

seller_id is your test seller, data.client_id your app. test.ping is not in any scope and never reaches another app; acknowledge it with 2xx like any event.

Self-checks

• Send the same POST /orders twice: the second answer must be 200 with "duplicate": true.
• Send a price as a JSON number: you must get 400 VALIDATION_ERROR — then fix your encoder.
• Call with a token whose scopes lack the endpoint’s: 403 INSUFFICIENT_SCOPE with required (request a narrower scope on the authorize URL to try it).
• Send a test event and check that your endpoint accepts its signature — then rotate the webhook secret and check that it rejects a body signed with the old one.
• Walk one order to delivered and one to returned with the advance helper, and check that your copy matches GET /orders/{externalId} at every step.