The sandbox that remembers.

Point Slurry at an OpenAPI spec, or pick one from the library, and get a hosted copy of that API that keeps state, changes on its own and fires webhooks when it does. No sales call, no partner agreement, no waiting on a security review.

Request access Browse the library

Plans from $19 a month, billed in advance. Cancel any time.

acme-jira.slurry.io

$ curl https://acme-jira.slurry.io/rest/api/3/issue/ACME-142 \
  -H "Authorization: Bearer slurry_sim_7Hq2mP9xKc4vW1tRz8bN"

200 OK14 msx-slurry-operation: getIssue

{
  "id": "10142",
  "key": "ACME-142",
  "fields": {
    "summary": "Invoice sync drops line items over 250",
    "status": { "name": "In Review" },
    "priority": { "name": "High" },
    "assignee": { "displayName": "Priya Raman" },
    "reporter": { "displayName": "Tom Okafor" },
    "comment": { "total": 4 },
    "updated": "2026-09-25T09:41:12.000+0000"
  }
}

What changed in the last hourLive

09:41issue.updated ACME-142 - In Progress to In Reviewwebhook 200
09:38issue.created ACME-187 - Bulk export times out for EU tenantswebhook 200
09:22comment.created ACME-142 - by Tom Okaforwebhook 200
09:07issue.updated ACME-131 - In Review to Doneretry 503

How it works

From spec to living API in minutes.

Slurry uses a model where it is good - reading specs and writing believable data - and a deterministic engine everywhere else.

01
Pick an API, or bring your spec
Choose from the library - CRM, ERP, payments, HR and more - or upload an OpenAPI or Swagger file.
library: project-management
02
Slurry builds a coherent world
A model reads the spec once and generates seed data that fits together: customers own their orders, invoices reference real line items.
1,240 records across 6 collections
03
Get a URL, locked down by default
Your simulation goes live behind an API key and an IP allow-list seeded with your address. Switching it off is a deliberate choice.
https://acme-jira.slurry.io
04
Use it like the real thing
Writes persist. Data moves on a schedule. State changes fire signed webhooks. Rules give you the 503 your vendor sandbox never will.
POST /issues 201 Created

What you get

Everything a vendor sandbox should have been.

State

It remembers

A POST changes what the next GET returns. A delete stays deleted. The most requested, longest unshipped feature in mocking tools.

Seed data

Coherent, not random

Records that reference each other correctly, in volumes that make sense for the API you picked. Not a pile of schema-shaped strings.

Behaviour

It keeps living

A behaviour plan moves tickets, settles invoices and creates new records on a schedule, so Thursday’s data is not Tuesday’s.

Webhooks

Events on change

Every change emits an event. Deliveries are HMAC-signed and retried with backoff, with no separate webhook tool to bolt on.

Rules

Failure on demand

Fixed responses, errors with a probability, latency with jitter, conditional matches and chaos, per endpoint.

Access

Private by default

API keys hashed at rest and an IP allow-list switched on from the first second. Off is the choice you make.

MCP

Agents welcome

An MCP server lets an agent create, configure, fast-forward and tear down its own simulation without a person in the loop.

BYOK

Your model key, or ours

Use prepaid generation credit, or connect Anthropic, OpenAI or OpenRouter and pay for the platform alone.

A world, not a mock

A clock, a plot and an undo button.

Every other tool treats a fake API as a list of responses. Slurry treats it as a customer account that lives between your test runs.

A clock: Fast-forward up to 30 simulated days in one call. The behaviour plan runs as if the time had passed, and webhooks fire as they would have.
A plot: A declarative behaviour plan: transitions, creates, updates and deletes, each on its own schedule. You can read it, edit it, and switch rules off.
Consequences: Every change is an event on a timeline, delivered to your webhook with a signature and a retry schedule, just like production.
An undo button: Reset restores the exact original seed, byte for byte. Break it on purpose, then put it back.

terminal

# Jump a week ahead: the behaviour plan runs as if 168 hours passed
curl -X POST https://api.slurry.io/v1/simulations/acme-jira/fast-forward \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "hours": 168 }'
# {"hours":168,"changes":412}

# Make search fail 30% of the time and watch your retries work
curl -X POST https://api.slurry.io/v1/simulations/acme-jira/rules \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Flaky search", "kind": "error", "method": "GET",
        "pathPattern": "/rest/api/3/search",
        "config": { "status": 503, "probability": 0.3 } }'

# Back to the exact original seed
curl -X POST https://api.slurry.io/v1/simulations/acme-jira/reset \
  -H "Authorization: Bearer $SLURRY_ACCOUNT_KEY"

The model writes the plan. The engine plays it.

A model is called when a simulation is created, never on the request path or the scheduler tick. Responses come back in milliseconds, runs are reproducible, and generation cost is bounded and visible before you spend it.

Library

Start with the APIs that are hardest to get a sandbox for.

Ready-made simulations grouped by the categories teams integrate with most. Cannot find yours? Upload the spec and get one anyway.

Browse the library

MCP server

Built for agents, not just for people.

Before your agent touches a real customer’s CRM, let it touch a fake one that behaves the same way: the same state, the same webhooks, the same failure modes. Prove it is safe on a system that is not real before anyone lets it near one that is.

› search_library
› list_simulations
› create_simulation
› get_simulation
› list_records
› recent_activity
› fast_forward
› reset_simulation
› set_status
› add_rule

All 15 tools and set-up guides

claude_desktop_config.json / .cursor/mcp.json

{
  "mcpServers": {
    "slurry": {
      "type": "http",
      "url": "https://api.slurry.io/mcp",
      "headers": {
        "Authorization": "Bearer slurry_acct_..."
      }
    }
  }
}

Streamable HTTP. Authenticate with an account key; restrict it to your IP ranges if you like. Included from the Team plan.

Security

Locked down by default, because it has to be.

Slurry is for synthetic test data only. It is not, and must never be used as, a store of real customer, payment or personal data. We built the controls as if it were anyway.

IP allow-list on by default, seeded with the creator’s address
Simulation and account keys stored as SHA-256 hashes, shown once
Your own model keys encrypted with AES-256-GCM
Simulations only ever return JSON, never HTML
Webhooks to private or internal addresses blocked at connect time
Per-plan rate limits and abuse monitoring on content and traffic
Two-factor authentication and breached-password checks
An audit log of every security-relevant action

Security and trust

Pricing

Two numbers, kept apart on purpose.

A monthly platform fee for simulations, requests and controls. Generation credit, prepaid or on your own model key, for the model work. Never blended.

Starter

$19/ month

For one developer wiring up an integration.

3 live simulations
50k requests / month
Scheduled behaviour

Team

Scale

$249/ month

For platforms and QA at volume.

60 live simulations
3M requests / month
1 minute schedules

Compare plans and credit packs

FAQ

Questions developers ask first.

Anything else: hello@slurry.io

Is Slurry a mock server or a sandbox?

Neither, in the usual sense. A mock server returns a fixed response. A vendor sandbox is a smaller, often stale copy of production you need permission to reach. Slurry is a fake system that keeps state and changes over time, and you can reach it now.

How realistic is the generated data?

A model generates it against the shape of the API you picked or uploaded, so entities reference each other correctly and values suit the domain. It will not match your production data, and it is not meant to. It is meant to be coherent enough that your tests mean something.

Does this replace testing against the real API?

No. Nothing that simulates a partner API can guarantee it matches the real one exactly, and vendor sandboxes cannot either. Use Slurry to build and stress-test your integration cheaply and repeatably, then do a final pass against the real thing before go-live.

Is this an official sandbox for any vendor?

No. Slurry is not affiliated with, endorsed by or connected to any vendor whose API shape it simulates. Library entries are built from publicly available API descriptions. Specs you upload stay private to your account.

Can I upload a spec for an API that is not public?

Yes, if you have the right to use it. That responsibility is yours under the terms of service. We never publish or share uploaded specs.

What happens when generation credit runs out?

Your simulations keep serving requests, keeping state and running their behaviour plans. Credit is only spent when a model is called: analysing a spec and generating seed data. Top up, or connect your own model key.

Can an AI agent use Slurry without a person setting it up?

Yes. That is what the MCP server is for. An agent with an account key can create, configure, fast-forward, reset and delete its own simulations. MCP access is included from the Team plan.

What about SOAP, SFTP, EDI or email?

Not yet. HTTP APIs, webhooks and the MCP server come first. If your integration depends on one of these, tell us at hello@slurry.io. It directly shapes what we build next.

What stops people abusing it?

Payment up front, IP allow-lists by default, rate limits, and monitoring that reviews uploaded content and watches traffic for anomalies. Accounts that break the acceptable use policy are suspended. Report anything suspicious to abuse@slurry.io.

Pick an API. Break it on purpose.

We are opening accounts in small batches while we watch the abuse controls under real load. Leave your details and we will be in touch.