Sandbox & environments

RDCPASS runs two fully separate environments. Build and test in the sandbox, with synthetic identities and free usage for all eight services; move to production once your due-diligence dossiers are approved.

Two environments

# Production
https://api.rdcpass.cd

# Sandbox
https://sandbox.rdcpass.cd

The request and response formats are identical in both environments: switching is a matter of base URL and keys.

The sandbox plan

Every application gets the free sandbox plan at creation, covering all eight services: KYC Validation, Face Recognition, Age Verification, KYB Verification, AML & CTF Screening, Credit Scoring, Fraud Reporting and Login with RDCPASS. Every scope — including Sensitive and Biometric ones — can be selected in sandbox without subscription or enhanced due diligence, so you can build your full integration before going live. Single, batch and asynchronous requests all work exactly as in production.

Quotas reset daily at 00:00 UTC. These quotas cover single calls; batches have a separate batch quota of 5,000 items and 20 batches per day per service. Beyond the quota, calls return 429 quota_exceeded — see Rate limits & quotas. Sandbox calls cost no real money, but they are billed at the published rates against a simulated wallet: every organization starts prepaid with 5,000 USD of test credit, so you can test your billing integration end to end. When the test credit runs out, calls return 402 insufficient_balance (or 402 credit_limit_reached on postpaid) — request a balance increase from the console. Postpaid organizations receive an invoice every 30 days, due within 15 days. While an invoice is overdue, billable calls return 402 invoice_overdue. Errors, idempotent replays and polling are never billed.

Test identities

Use these RDCPASS IDs with KYC Validation, Age Verification, AML & CTF Screening, Credit Scoring and Face Recognition (1:1). Each produces a fixed, documented outcome:

The same people can also be looked up by document: passport OB0000001 and CENI card 0000000000001 resolve to COD-0000-0000-0001.

Beyond these fixtures, the sandbox holds hundreds of generated citizens and businesses. Browse and download all of them, with every identifier, on Sandbox test data.

Other test fixtures

Asynchronous jobs and batches complete within seconds in sandbox and deliver the same webhooks as production, so you can test your whole event pipeline.

Fraud reports you file feed the sandbox fraud network like in production: once confirmed (5 minutes), a report naming a suspect is returned by AML & CTF Screening and lowers Credit Scoring for that identity, name or company — for every sandbox organization. Reports never change the documented test identities above (COD-0000-0000-xxxx, RCCM 00-B-00xxx): use …0888, …0999 and 00-B-00888 to see the network’s effect.

Real public data in the sandbox

Identities stay synthetic, but two services use real, openly published data so your tests behave like production:

• AML & CTF Screening checks the official sanctions lists — the UN Security Council Consolidated List, OFAC SDN, the EU consolidated list and the UK consolidated list (about 30,000 entries) — in addition to the documented test identities. Lists are refreshed daily from their publishers. Hits from these lists carry a source object with the list’s own reference, the sanctions programmes and, when the UN publishes one, the link to the INTERPOL–UN Security Council Special Notice.
• Credit Scoring credit files are synthetic but calibrated to published statistics for the DRC (World Bank Global Findex and World Development Indicators): the share of files with mobile money, bank, phone and utility data, and income levels, follow national figures. The documented consents and scores above never change.

Sources: United Nations Security Council; U.S. Treasury (OFAC); © European Union; contains public sector information licensed under the Open Government Licence v3.0 (UK); The World Bank (CC BY 4.0).

Path to production

When your integration is ready, submit your business and application dossiers from the console. Your sandbox request logs serve as test evidence. Once approved, the same application receives production keys — see Going to production.

Next steps