{
  "info": {
    "_postman_id": "822b0380-8795-4f58-8367-2af1ed8a39f6",
    "name": "KDPika Licensing API v1 \u2014 Sandbox",
    "description": "Real11-operation Sandbox sequence. Mutates test data and ends by revoking its test license. No payment integration. Run serially; do not retry uncertain creates/renewals. Secrets use local run variables, never logs or exported populated environments.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "base_url",
      "value": "https://licensing.kdpika.com/api/v1",
      "type": "string"
    },
    {
      "key": "app_id",
      "value": "YOUR_SANDBOX_PUBLIC_APP_ID",
      "type": "string"
    },
    {
      "key": "api_key",
      "value": "YOUR_SANDBOX_DEVELOPER_API_KEY",
      "type": "string"
    },
    {
      "key": "product_id",
      "value": "YOUR_INTERNAL_PRODUCT_ID",
      "type": "string"
    },
    {
      "key": "plan_id",
      "value": "YOUR_PRODUCT_PLAN_ID",
      "type": "string"
    },
    {
      "key": "customer_email",
      "value": "customer@example.invalid",
      "type": "string"
    },
    {
      "key": "installation_id",
      "value": "YOUR_PERSISTED_SANDBOX_INSTALLATION_ID",
      "type": "string"
    },
    {
      "key": "idempotency_key",
      "value": "YOUR_UNIQUE_SANDBOX_TEST_EVENT_ID",
      "type": "string"
    },
    {
      "key": "license_id",
      "value": "YOUR_LICENSE_ID",
      "type": "string"
    },
    {
      "key": "license_key",
      "value": "YOUR_SANDBOX_LICENSE_KEY",
      "type": "string"
    },
    {
      "key": "activation_token",
      "value": "YOUR_SANDBOX_ACTIVATION_TOKEN",
      "type": "string"
    },
    {
      "key": "allow_loopback",
      "value": "0",
      "type": "string"
    }
  ],
  "item": [
    {
      "name": "01 public-key",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/public-key",
        "description": "Retrieve the current public verification key. Use the correct installation/environment and verify signed state before granting access."
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "02 create-license",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          },
          {
            "key": "Idempotency-Key",
            "value": "{{idempotency_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses",
        "description": "Issue a license after your backend verifies the buyer purchase. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"product_id\": \"{{product_id}}\",\n  \"plan_id\": \"{{plan_id}}\",\n  \"customer\": {\n    \"email\": \"{{customer_email}}\",\n    \"name\": \"Synthetic collection customer\"\n  }\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(201));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));",
              "if (body.success === true && body.license) { pm.variables.set('license_id', body.license.id); pm.variables.set('license_key', body.license.license_key); }"
            ]
          }
        }
      ]
    },
    {
      "name": "03 activate",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "X-App-ID",
            "value": "{{app_id}}",
            "type": "text"
          },
          {
            "key": "X-Environment",
            "value": "SANDBOX",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/activate",
        "description": "Bind a customer license to one persisted installation. Use the correct installation/environment and verify signed state before granting access.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"license_key\": \"{{license_key}}\",\n  \"device_id\": \"{{installation_id}}\",\n  \"email\": \"{{customer_email}}\",\n  \"device_name\": \"Sandbox collection\",\n  \"platform\": \"test\",\n  \"app_version\": \"1.0.0\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!/^TEST[A-Z0-9]*-/i.test(String(get('license_key') || ''))) reject('Use a TEST-prefixed Sandbox license key.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));",
              "pm.test('Sandbox signed snapshot', () => pm.expect(body.license.payload.environment).to.equal('sandbox'));",
              "if (body.success === true && body.license?.payload?.environment === 'sandbox') pm.variables.set('activation_token', body.activation_token);"
            ]
          }
        }
      ]
    },
    {
      "name": "04 validate",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{activation_token}}",
            "type": "text"
          },
          {
            "key": "X-Installation-ID",
            "value": "{{installation_id}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/validate",
        "description": "Refresh the signed state of an activated installation. Use the correct installation/environment and verify signed state before granting access.",
        "body": {
          "mode": "raw",
          "raw": "{}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));",
              "pm.test('Validation accepted', () => pm.expect(body.valid).to.equal(true));"
            ]
          }
        }
      ]
    },
    {
      "name": "05 get-license",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}",
        "description": "Read a scoped unsigned license summary. Management credentials belong on your trusted backend."
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "06 deactivate",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{activation_token}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/deactivate",
        "description": "Release this installation device seat. Use the correct installation/environment and verify signed state before granting access.",
        "body": {
          "mode": "raw",
          "raw": "{}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "07 suspend",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}/suspend",
        "description": "Suspend an eligible license and invalidate its active tokens. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"reason\": \"Sandbox collection test\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "08 restore",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}/restore",
        "description": "Restore an eligible license without reviving old tokens. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"reason\": \"Sandbox collection test\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "09 renew",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}/renew",
        "description": "Extend license expiry without charging or changing its plan. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"days\": 30\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "10 reset-devices",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}/reset-devices",
        "description": "Release active devices and revoke their tokens. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    },
    {
      "name": "11 revoke",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Accept",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "User-Agent",
            "value": "KDPikaDocsCollection/1.0",
            "type": "text"
          },
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "Authorization",
            "value": "Bearer {{api_key}}",
            "type": "text"
          }
        ],
        "url": "{{base_url}}/licenses/{{license_id}}/revoke",
        "description": "Revoke a license and its active tokens. Management credentials belong on your trusted backend.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"reason\": \"Sandbox collection test\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      },
      "protocolProfileBehavior": {
        "followRedirects": false
      },
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const get = name => pm.variables.get(name);",
              "const reject = message => { console.warn(message); pm.execution.skipRequest(); };",
              "const base = String(get('base_url') || '');",
              "const safe = /^https:\\/\\/[^/@?#\\s]+\\/api\\/v1$/.test(base);",
              "const local = String(get('allow_loopback')) === '1' && /^http:\\/\\/(?:127\\.0\\.0\\.1|localhost):[0-9]+\\/api\\/v1$/.test(base);",
              "if (!safe && !local) reject('Use an HTTPS API base or an explicitly opted-in loopback test base.');",
              "if (!String(get('api_key') || '').startsWith('lmp_sandbox_')) reject('A Sandbox developer API key is required.');"
            ]
          }
        },
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const body = pm.response.json();",
              "pm.test('Expected HTTP status', () => pm.expect(pm.response.code).to.equal(200));",
              "pm.test('Successful JSON response', () => pm.expect(body.success).to.equal(true));",
              "pm.test('Request correlation ID', () => pm.expect(body.request_id).to.match(/^req_[a-f0-9]{24}$/));"
            ]
          }
        }
      ]
    }
  ]
}