Restricted endpoints

Some API endpoints are marked restricted in production. This guide explains what that means and how sandbox and production access differ.

Tip: You can explore restricted endpoint documentation and call these endpoints freely in sandbox. Commercial approval is only required for production.

What does "restricted" mean?

Restricted endpoints are documented publicly but require commercial approval before you can use them against production servers. They are flagged in the technical reference with a warning banner.

Restricted endpoints typically cover capabilities that need a closer business review — for example, product catalog access, fulfillment, and labs catalog search. The restriction is about production use, not about whether you can build against the API.

Restricted does not mean:

• The endpoint is hidden from documentation
• You need pre-approval before starting development
• Your integration will be denied by default

Restricted does mean:

• You should build and test the integration in sandbox first
• You need Fullscript approval before calling the endpoint in production
• Your production application must be reviewed as part of the go-live process
• Approval to production will likely take additional time and may require additional compliance verification

Sandbox vs production access

Fullscript separates development from live integrations at two levels.

Account access

Your API Dashboard account moves through access states as you progress:

1. Requested — you have signed up but have not yet completed the account qualification form.
2. Sandbox — you can create sandbox applications, obtain OAuth credentials, and call sandbox API endpoints, including restricted ones.
3. Sandbox and production — you can create production applications and call production API endpoints.

Complete the account qualification form on the API Dashboard to receive sandbox access. Production account access is granted after your integration review.

Endpoint access

Even with a production account, individual restricted endpoints may require explicit approval for your use case. In sandbox, all documented endpoints are available without per-endpoint approval.

Use the integration environments table or the development sandbox guide for the correct base URLs per region.

FYI: Sandbox and production use separate OAuth applications, secrets, and base URLs. Store environment-specific values in configuration, such as environment variables, so you can switch cleanly at go-live.

When you are ready to go live, see Going to production.

Frequently asked questions

Can I call restricted endpoints in sandbox?

Yes. All documented endpoints, including restricted ones, are available in sandbox for development and testing.

How do I know an endpoint is restricted?

Restricted endpoints show a warning banner in the technical reference.

What happens if I call a restricted endpoint in production without approval?

The API will reject the request. Build and validate your integration in sandbox first, then complete the production review before switching to production hosts.