The sandbox that remembers

One living world across your whole stack.

A made-up company whose people, tickets, deals and payments change like the real thing, in every API you integrate with.

Start building Try it now

Plans from $49 a month with AI generation included, billed in advance. Starter comes with a 7-day free trial. Cancel any time.

Using a coding agent? Skip the set-up. Give it one line:

Set up Slurry for me: fetch and follow https://slurry.io/agent-setup.md

Works with Claude Code, Codex, Cursor and Copilot. It shows a live demo, installs the MCP server and creates your first simulation. Read the instructions

Bernard D'Amore-Walsh, Support Team Lead at Highfield Partners, in four simulations of one generated world.

Underlined: the same person

JiraIssue assignee

GET /rest/api/3/issue/MA-40

{
  "id": "10040",
  "key": "MA-40",
  "fields": {
    "summary": "Search results ignore archived projects filter",
    "status": { "name": "In Progress" },
    "priority": { "name": "Medium" },
    "assignee": {
      "accountId": "o9MybnOteJrX",
      "displayName": "Bernard D'Amore-Walsh",
      "emailAddress": "bernard.damorewalsh@highfieldpartners.co.uk"
    }
  }
}

SlackMessage author

GET /api/conversations.history

{
  "type": "message",
  "ts": "1793559659.801453",
  "user": "U0RXJDBVUDV",
  "text": "Can someone take a look at the failing deploy?",
  "user_profile": {
    "real_name": "Bernard D'Amore-Walsh",
    "display_name": "Bernard D'Amore-Walsh",
    "name": "bernard.damorewalsh"
  }
}

users.info

{
  "id": "U0RXJDBVUDV",
  "profile": {
    "real_name": "Bernard D'Amore-Walsh",
    "display_name": "Bernard D'Amore-Walsh",
    "email": "bernard.damorewalsh@highfieldpartners.co.uk"
  }
}

GmailEmail sender

GET /gmail/v1/users/me/messages/19b439f06a683653

{
  "id": "19b439f06a683653",
  "threadId": "19b439f06a683653",
  "labelIds": ["SENT"],
  "payload": {
    "headers": [
      { "name": "From", "value": "Bernard D'Amore-Walsh <bernard.damorewalsh@highfieldpartners.co.uk>" },
      { "name": "To", "value": "Dashawn Effertz <dashawn.effertz@highfieldpartners.co.uk>" },
      { "name": "Subject", "value": "CoolAir HVAC - revised quote for chiller service" },
      { "name": "Date", "value": "Thu, 17 Sep 2026 16:56:00 +0100" }
    ]
  }
}

HubSpotContact owner

GET /crm/v3/objects/contacts/1200000015838

{
  "id": "1200000015838",
  "properties": {
    "firstname": "Jaydon",
    "lastname": "Marquardt",
    "company": "Pennine Freight",
    "jobtitle": "Facilities Manager",
    "hubspot_owner_id": "40000008"
  }
}

GET /crm/v3/owners/40000008

{
  "id": "40000008",
  "email": "bernard.damorewalsh@highfieldpartners.co.uk",
  "firstName": "Bernard",
  "lastName": "D'Amore-Walsh",
  "type": "PERSON"
}

Try it

Call a live one. No account needed.

Public, read-only demo worlds with published keys. Paste a request into your terminal and look at the data.

How demos work

Salesforce demo

demo-salesforce.slurry.io

curl https://demo-salesforce.slurry.io/services/data/v62.0/query?q=SELECT+Id,Name,StageName,Amount+FROM+Opportunity+LIMIT+5 \
  -H "Authorization: Bearer slurry_sim_live_goUY5TJ_S-BlWD_5sOPNGN3amuHtRevr"

Stripe demo

demo-stripe.slurry.io

curl https://demo-stripe.slurry.io/v1/customers?limit=5 \
  -H "Authorization: Bearer slurry_sim_live_pyUJZLftgZWIcqIClvHPqoGFPgg6G5wZ"

How it works

From spec to living API in minutes.

Slurry uses a model where it is good - reading specs and writing believable data - and a deterministic engine everywhere else.

01
Pick an API, or bring your spec
Choose from the library - CRM, ERP, payments, HR and more - or upload an OpenAPI or Swagger file.
library: project-management
02
Slurry builds a coherent world
A model reads the spec once and generates seed data that fits together: customers own their orders, invoices reference real line items.
840 records across 6 collections
03
Get a URL, locked down by default
Your simulation goes live behind an API key and an IP allow-list seeded with your address. Switching it off is a deliberate choice.
https://acme-tickets.slurry.io
04
Use it like the real thing
Writes persist. Data moves on a schedule. State changes fire signed webhooks. Rules give you the 503 your vendor sandbox never will.
POST /tickets 201 Created

What you get

Everything a vendor sandbox should have been.

State

It remembers

State that carries across endpoints and over time: a POST shows up in the list, the schedule moves it on, a webhook tells you.

Seed data

Coherent, not random

Records that reference each other correctly, in volumes that make sense for the API you picked. Not a pile of schema-shaped strings.

Behaviour

It keeps living

A behaviour plan moves tickets, settles invoices and creates new records on a schedule, so Thursday’s data is not Tuesday’s.

Webhooks

Events on change

Every change emits an event. Deliveries are HMAC-signed and retried with backoff, with no separate webhook tool to bolt on.

Rules

Failure on demand

Fixed responses, errors with a probability, latency with jitter, conditional matches and chaos, per endpoint.

Access

Private by default

API keys hashed at rest and an IP allow-list switched on from the first second. Off is the choice you make.

MCP

Agents welcome

An MCP server lets an agent create, configure, fast-forward and tear down its own simulation without a person in the loop.

AI generation included

Every plan includes a monthly allowance for AI-designed worlds. Serving requests never uses AI. Need more? Prepaid packs, or your own model key.

One company, every API

Describe your company once.

Every simulation in your account draws on the same made-up company: its employees, teams and customers. Add Slack next to Jira and the people are already there.

Describe it once: Write a short brief and a model designs the cast once, or skip the brief and get one built without AI. Edit the people and customers by hand whenever you like.
The same people in every simulation: Names, emails, titles, departments and customer companies match across Jira, Slack, Gmail, HubSpot and the rest, so Bernard in a ticket is Bernard in the CRM.
Vendor ids stay vendor-specific: Each API keeps its own id formats and references: a Jira accountId, a Slack user id, a HubSpot owner id. Your integration still has to map them, just like production.

How the organisation world works

Bernard D'Amore-Walsh

bernard.damorewalsh@highfieldpartners.co.uk

Support Team Lead, Customer Success. One of 40 employees at Highfield Partners, which has 12 customer companies.

How each API identifies Bernard D'Amore-Walsh
API	Field	Vendor id
Jira	accountId	o9MybnOteJrX
Slack	user	U0RXJDBVUDV
Gmail	From	bernard.damorewalsh@highfieldpartners.co.uk
HubSpot	hubspot_owner_id	40000008

Taken from the generated world on this page. Gmail has no user id for a sender: the address is the identity.

A world, not a mock

The sandbox that remembers.

A static mock is a list of responses. A Slurry simulation is closer to a customer account that lives between your test runs: fast-forward time, script behaviour, reset to seed.

A clock: Fast-forward up to 30 simulated days in one call. Each behaviour rule catches up (up to 200 steps per rule) and the resulting changes fire webhooks.
A plot: A declarative behaviour plan: transitions, creates, updates and deletes, each on its own schedule. You can read it, edit it, and switch rules off.
Consequences: Every change is an event on a timeline, delivered to your webhook with a signature and a retry schedule, just like production.
An undo button: Reset restores the original seed records. Snapshots save any state you like, and forks give each test run its own copy.

terminal

# Jump a week ahead: each behaviour rule catches up on 168 hours
curl -X POST https://api.slurry.io/v1/simulations/acme-tickets/fast-forward \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "hours": 168 }'
# {"hours":168,"changes":412}

# Make search fail 30% of the time and watch your retries work
curl -X POST https://api.slurry.io/v1/simulations/acme-tickets/rules \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Flaky search", "kind": "error", "method": "GET",
        "pathPattern": "/v1/tickets/search",
        "config": { "status": 503, "probability": 0.3 } }'

# Back to the original seed records
curl -X POST https://api.slurry.io/v1/simulations/acme-tickets/reset \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY"

The model writes the plan. The engine plays it.

A model is called when a simulation is created, never on the request path or the scheduler tick. Responses come back in milliseconds, runs are reproducible, and generation cost is bounded and visible before you spend it.

Library

Stateful simulations of the business APIs you integrate with.

Ready-made simulations grouped by the categories teams integrate with most. Cannot find yours? Upload the spec and get one anyway.

Browse the library

MCP server

Built for agents, not just for people.

Before your agent touches a real customer’s CRM, let it touch a fake one that behaves the same way: the same state, the same webhooks, the same failure modes. Prove it is safe on a system that is not real before anyone lets it near one that is.

› search_library
› list_verticals
› ask_slurry
› get_integration_guide
› list_simulations
› create_simulation
› get_simulation
› get_status
› get_usage
› report_issue

All 67 tools and set-up guides

.cursor/mcp.json

{
  "mcpServers": {
    "slurry": {
      "type": "http",
      "url": "https://api.slurry.io/mcp"
    }
  }
}

Streamable HTTP. Authenticate with an account key; restrict it to your IP ranges if you like. Included on every plan.

Security

Locked down by default, because it has to be.

Slurry is for synthetic test data only. It is not, and must never be used as, a store of real customer, payment or personal data. We built the controls as if it were anyway.

IP allow-list on by default, seeded with the creator’s address
Simulation and account keys stored as SHA-256 hashes, shown once
Your own model keys encrypted with AES-256-GCM
Simulations only ever return JSON, never HTML
Webhooks to private or internal addresses blocked at connect time
Per-plan rate limits and abuse monitoring on content and traffic
Two-factor authentication and breached-password checks
An audit log of every security-relevant action

Security and trust

Pricing

One monthly price. AI generation included.

Each plan includes a monthly allowance for AI-designed worlds. Serving requests never uses AI, so traffic never adds to the bill. Overflow with prepaid credit or your own model key.

Starter

$49/ month

7-day free trial, then billed monthly in advance, excluding VAT

For one developer wiring up an integration.

$10 of AI generation a month

3 live simulations
3 concurrent forks
50k requests / month

Start 7-day trial

Team

Scale

$499/ month

Billed monthly in advance, excluding VAT

For platforms and QA at volume.

$100 of AI generation a month

Up to 50 team members with roles
60 live simulations
100 concurrent forks

Choose Scale

Compare plans and what AI generation covers

FAQ

Questions developers ask first.

Anything else: hello@slurry.io

Is Slurry a mock server or a sandbox?

Neither, in the usual sense. A mock server returns a fixed response. A vendor sandbox is a smaller, often stale copy of production you need permission to reach. Slurry is a fake system that keeps state and changes over time, and you can reach it now.

How realistic is the generated data?

A model generates it against the shape of the API you picked or uploaded, so entities reference each other correctly and values suit the domain. It will not match your production data, and it is not meant to. It is meant to be coherent enough that your tests mean something.

Does this replace testing against the real API?

No. Nothing that simulates a partner API can guarantee it matches the real one exactly, and vendor sandboxes cannot either. Use Slurry to build and stress-test your integration cheaply and repeatably, then do a final pass against the real thing before go-live.

Is this an official sandbox for any vendor?

No. Slurry is not affiliated with, endorsed by or connected to any vendor whose API shape it simulates. Library entries are built from publicly available API descriptions. Specs you upload stay private to your account.

Can I upload a spec for an API that is not public?

Yes, if you have the right to use it. That responsibility is yours under the terms of service. We never publish or share uploaded specs.

What happens when the AI allowance runs out?

Your simulations keep serving requests, keeping state and running their behaviour plans. AI is only used to design a world or compile a plain-English rule. The allowance resets each billing period; in between, buy a prepaid pack or connect your own model key.

Can an AI agent use Slurry without a person setting it up?

Yes. That is what the MCP server is for. An agent with an account key can create, fork, snapshot, fast-forward, reset and delete its own simulations. MCP access is included on every plan.

What about SOAP, SFTP, EDI or email?

Not yet. HTTP APIs, webhooks and the MCP server come first. If your integration depends on one of these, tell us at hello@slurry.io. It directly shapes what we build next.

What stops people abusing it?

Payment up front, IP allow-lists by default, rate limits, and monitoring that reviews uploaded content and watches traffic for anomalies. Accounts that break the acceptable use policy are suspended. Report anything suspicious to abuse@slurry.io.

Pick an API. Break it on purpose.

Subscribe, pick an API and send your first request in minutes. Plans from $49 a month, cancel any time.

Start building Talk to us about your API