Per-suffix live request log — read back your own last 50 sandbox request/response pairs

Returns the ring buffer of the last 50 request/response pairs the presenting apier_sandbox_test_<suffix> bearer produced on the captured part of the authenticated sandbox surface, newest first, retained for 15 minutes. CAPTURE SCOPE (what lands in the log): the authenticated /api/v1/sandbox/company/{org}/* read routes (every response they return, including magic-header X-Apier-Simulate short-circuits), the write loop (POST /api/v1/sandbox/actions/plan, POST /api/v1/sandbox/auth/approval-token, POST /api/v1/sandbox/actions/execute — every response they return once the bearer has authenticated, including early-return 4xx and the 500 boundary, with the request body stored alongside, bounded at the write-side byte budget and redacted/truncated like the response body), and the rate-limit 429 short-circuits the authenticated wrapper emits on any sandbox route — so a full plan → mint → execute loop replays from this endpoint. The sandbox is deliberately exempt from the production usage tracker, so without this endpoint a developer or agent debugs blind; with it, an agent can read back exactly what it sent and what the sandbox answered, and self-correct.

ISOLATION: the log is strictly per-suffix. Rows are stored keyed on the SHA-256 hash of the bearer suffix (raw bearer material never lands in storage), and the endpoint serves ONLY the presenting bearer's own namespace. The {suffix} path segment is convenience/documentation: when it does not match the presenting bearer's suffix the response is 403 SANDBOX_LOG_SUFFIX_MISMATCH, never another suffix's rows. A REAL API key is rejected 401 SANDBOX_TEST_KEY_REQUIRED: real keys carry no suffix namespace, so there is nothing they could read here.

REDACTION: the Authorization header is never stored. Any bearer-shaped token appearing inside a stored body or query string is replaced with ***REDACTED*** before persisting, and stored bodies are truncated at 8 KB with a ...[truncated] marker.

Capture is fire-and-forget on the serving side: a log write failure never changes a sandbox response (the determinism contract is about the response, not the log), so the log is best-effort: complete in practice, but not a guaranteed audit trail. Reading the log does NOT append to it (the read must not churn the 50-row ring you are inspecting). The zero-auth public mirror (/api/v1/sandbox/public/*) has no suffix and is never logged.