API Mocking & Sandbox Environment Designer

## CONTEXT
I want client developers to build and test against my API without hitting production or causing real side effects, so I need a mocking and sandbox strategy for 2026. Good sandboxes accelerate integration dramatically: they provide realistic data, deterministic test scenarios, simulated errors and edge cases, and safe test credentials, all without real money moving or real records changing. The challenge is keeping the sandbox faithful to production behavior (so it does not give false confidence) while letting clients trigger rare conditions on demand. I want a design covering both spec-driven mocks for early development and a stateful sandbox for end-to-end testing.

## ROLE
Act as a developer-experience engineer who has built API sandboxes that integrators actually trust. You balance realism, controllability, and safety, and you know how sandbox/production drift erodes trust.

## RESPONSE GUIDELINES
- Distinguish lightweight spec-driven mocks from a stateful sandbox environment.
- Emphasize how clients deterministically trigger edge cases and errors.
- Address fidelity to production and how drift is prevented.
- Cover test credentials, data, and isolation between tenants.
- Recommend concrete tooling and patterns, not just concepts.

## TASK CRITERIA

### 1. Mocking Layer (Early Development)
- Generate mocks directly from the OpenAPI/GraphQL spec for instant feedback.
- Provide example-driven responses matching documented schemas.
- Allow local mock servers so clients work offline.
- Keep mocks in sync with the spec automatically.

### 2. Stateful Sandbox Environment
- Design a sandbox that persists state for realistic multi-step flows.
- Isolate each client/tenant's sandbox data.
- Provide seeded, realistic test data sets.
- Make resets and clean slates easy for repeatable tests.

### 3. Scenario & Error Simulation
- Let clients deterministically trigger specific errors and edge cases.
- Simulate rate limiting, timeouts, and downstream failures on demand.
- Provide magic test values (e.g., card numbers) that force outcomes.
- Support webhook/event simulation for async flows.

### 4. Credentials, Safety & Isolation
- Issue distinct test credentials clearly separated from production.
- Guarantee no real side effects (no charges, no real emails) in sandbox.
- Prevent sandbox data from ever touching production systems.
- Handle data expiry and quota in the sandbox.

### 5. Fidelity & Maintenance
- Keep sandbox behavior faithful to production to avoid false confidence.
- Define how sandbox stays updated as the real API evolves.
- Document the sandbox thoroughly with example flows.
- List sandbox anti-patterns (drift, hidden differences, shared state).

## ASK THE USER FOR
- The integration flows clients most need to test, including edge cases.
- Whether your API has a spec and what side effects must be simulated.
- Your infrastructure and appetite for a stateful sandbox vs simple mocks.
- Multi-tenant isolation and data-sensitivity requirements.