# Quickstart

> To make your first Atlas Labs write, create a sandbox with one `curl` call, check its status, read your missions and send a write with an `Idempotency-Key`: four steps, no sign-up, against a fictional printing company. Every response carries `meta.simulation: true`.

Canonical: `https://automationatlas.io/labs/docs/quickstart/` · Checked: `2026-10-16`

Atlas Labs is a fictional company's API; every figure in every response is simulation data.

> **New here?** Atlas Labs is a free, anonymous sandbox from Automation Atlas, the independent site that reviews automation tools: a fictional company with two real APIs, curated by automation engineers rather than by a vendor, so you can test a tool somewhere no vendor owns. There is no sign-up, and we keep almost nothing about you. [Read why it's free →](https://automationatlas.io/labs/about/)

## 1. Create a sandbox

No account, no email, no payment. Pick a preset or leave the body empty for `starter`.

*curl · Create a sandbox — `POST` `/labs/api/v1/sandboxes`*

```bash
curl -s -X POST https://automationatlas.io/labs/api/v1/sandboxes \
  -H "Content-Type: application/json" \
  -d '{"preset": "starter"}'
```

The response includes two keys, shown once: a **Factory key** (`lab_fac_…`) for production, inventory and shipping, and a **Head Office key** (`lab_off_…`) for sales, purchasing, finance and HR. Save both, because there is no way to retrieve them again. If the sandbox is full you get a `202` with a queue ticket instead of the `201` above; poll the path in `poll` until it returns your keys, as [Waiting for a sandbox](https://automationatlas.io/labs/docs/queue/) explains.

## 2. Check your sandbox's status

Either key works on shared endpoints like this one.

*curl · Check sandbox status — `GET` `/labs/api/v1/sandbox`*

```bash
curl -s https://automationatlas.io/labs/api/v1/sandbox \
  -H "Authorization: Bearer lab_off_yourkey"
```

## 3. Read your missions

Missions are detected from what actually happened in the sandbox, not from a checkbox you tick. They tell you what to try next.

*curl · List missions — `GET` `/labs/api/v1/missions`*

```bash
curl -s https://automationatlas.io/labs/api/v1/missions \
  -H "Authorization: Bearer lab_off_yourkey"
```

## 4. Make your first write

Every write accepts an `Idempotency-Key` header, and the routes that move money or stock (`13` of them, listed on [Authenticate with your key](https://automationatlas.io/labs/docs/tools/rest-api/#safe-write)) refuse a write without one. Send the same key twice with the same body and you get the original response back with `Idempotency-Replayed: true`; send it twice with a different body and the second call is rejected, so a retried request can never double-charge or double-ship.

*curl · Accept a sales order — `POST` `/labs/api/v1/office/sales-orders/{id}/accept`*

```bash
curl -s -X POST https://automationatlas.io/labs/api/v1/office/sales-orders/so_01J.../accept \
  -H "Authorization: Bearer lab_off_yourkey" \
  -H "Idempotency-Key: $(uuidgen)"
```

The response is the sales-order row. Its `status` is `in_production`, with `bridged_work_order_id` set, on the default `starter` preset (bridge `auto`), and `accepted` on a preset with a manual bridge.

## Presets

*Reference table — Atlas Labs product configuration, not part of the fictional simulation.*

| Preset | Automate | Bridge | HR | Missions |
| --- | --- | --- | --- | --- |
| `starter` (default) | Head Office | Automatic | Off | 6 |
| `standard` | Both | Manual | Off | 8 |
| `full` | Both | Manual | On | 10 |
| `custom` | Your choice | Your choice | Toggle | Built from the modules you enable |

“Automate” names the side or sides you run yourself; an NPC autopilot runs only the other side, and with `both` there is no NPC. On `starter` you run the Head Office and the Factory runs itself, so you can focus entirely on the Head Office API. Switch sides at any time with `PATCH /labs/api/v1/sandbox`.

## Limits and next steps

- Sessions last `30 minutes` and can be extended twice from the console, up to `90 minutes` total.
- A sandbox goes read-only when it ends: for a short grace period its keys can still read, and writes get `423 sandbox_expired`. Keys stop working when their sandbox is deleted, at the end of that period: from then on every request with them gets `401 unauthorized`. Stop any script still using old keys, and create a new sandbox for fresh ones.
- Requests are rate-limited per key, per IP group, and (without a key) per IP group again; every authenticated response carries `X-RateLimit-Limit` and `X-RateLimit-Remaining`, and a `429` carries `Retry-After` in seconds. Wait that long and resend the same request.
- Read [Concepts](https://automationatlas.io/labs/docs/concepts/) for how the Factory and Head Office systems connect through the bridge.
- Read [Webhooks](https://automationatlas.io/labs/docs/webhooks/) to get events pushed to you instead of polling.
- Read [Integrations](https://automationatlas.io/labs/docs/tools/) for Zapier, Make, n8n, Power Automate, Pipedream, Frends, Moxo and AI-agent (MCP) recipes, and [Authenticate with your key](https://automationatlas.io/labs/docs/tools/rest-api/) for tested curl, JavaScript and Python snippets.