> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/sandbox-mode.md).

# Sandbox Mode

Sandbox mode lets any signed-in user create their own DevNet validator from the CatalyX UI by entering a name. The platform fills in the network details.

Sandbox mode is an optional platform mode, added in 2.0.2. With it turned on, a signed-in user creates a **DevNet** validator straight from the CatalyX UI by entering a **name**. They do not need the network endpoints, an onboarding secret, or access to the cluster.

{% hint style="info" %}
**Sandbox mode is off by default.** A platform administrator turns it on with Helm values. If you do not see a **Create Validator** button on the Validators page, sandbox mode is not enabled on your platform. See [Turning sandbox mode on](#turning-sandbox-mode-on).
{% endhint %}

## How sandbox mode changes the UI

<table><thead><tr><th width="250">Area</th><th>Standard mode</th><th>Sandbox mode</th></tr></thead><tbody><tr><td><strong>Creating a validator</strong></td><td>Not in the UI. Apply a <code>Validator</code> resource — see <a href="/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/create-a-validator.md">Create a Validator</a>.</td><td>A <strong>Create Validator</strong> button on the <a href="/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/validators-list.md">Validators</a> page.</td></tr><tr><td><strong>What you see</strong></td><td>Every validator and application in the namespace.</td><td>Only the validators and applications you created.</td></tr><tr><td><strong>How many validators</strong></td><td>No limit.</td><td>One per user.</td></tr><tr><td><strong>Network</strong></td><td>DevNet, TestNet, or MainNet.</td><td>DevNet only.</td></tr><tr><td><strong>Editing a validator</strong></td><td>Edit the <code>Validator</code> resource.</td><td>No edit action in the UI.</td></tr></tbody></table>

***

## Create a sandbox validator

{% stepper %}
{% step %}
**Open the Validators page**

Select **Validators** in the sidebar. The **Create Validator** button appears at the top of the page while you have no validator yet.
{% endstep %}

{% step %}
**Fill in the form**

Click **Create Validator** and fill in the fields below. Only **Name** is required.

<table><thead><tr><th width="190">Field</th><th width="110">Required</th><th>Notes</th></tr></thead><tbody><tr><td><strong>Name</strong></td><td>Yes</td><td>Lowercase letters, numbers, and hyphens, for example <code>my-validator-1</code>.</td></tr><tr><td><strong>Party hint</strong></td><td>No</td><td>Format <code>word-word-number</code>, for example <code>my-validator-1</code>. When empty, the name is used.</td></tr><tr><td><strong>Enable PQS</strong></td><td>No</td><td>Adds a <a href="/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/participant-query-store.md">Participant Query Store</a> to the validator.</td></tr><tr><td><strong>PQS database</strong></td><td>No</td><td>Shown when PQS is enabled. For example <code>pqs_my_validator_1</code>.</td></tr><tr><td><strong>PQS version</strong></td><td>No</td><td>Shown when PQS is enabled. Overrides the Splice version for the PQS image.</td></tr></tbody></table>

{% hint style="warning" %}
**If you leave Party hint empty, choose a name in the `word-word-number` format.** The name is then used as the party hint, and a name such as `myval` is rejected.
{% endhint %}
{% endstep %}

{% step %}
**Click Create**

The platform does the rest:

* It gets an onboarding token from the sponsoring Super Validator and stores it as the Secret `<validator-name>-onboarding-secret`.
* It reads the current Splice version and migration ID from Scan.
* It creates the `Validator` with managed Keycloak, and marks you as its owner.
  {% endstep %}

{% step %}
**Wait for the validator to become Ready**

The new validator appears in your list. Its components start one by one, and the validator shows `Ready` once all of them are running. From there, open it to use the [Validator Details](/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/validators.md) tabs as usual.
{% endstep %}
{% endstepper %}

***

## Known limitations

* **DevNet only.** The onboarding token comes from the Super Validator's DevNet self-onboarding API.
* **One validator per user.** The **Create Validator** button is hidden once you have a validator.
* **No edit or delete in the UI.** Ask your platform administrator to change or remove a sandbox validator.
* **No admin view.** Validators without an owner — for example ones applied with `kubectl` — are hidden from every user while sandbox mode is on.
* **The onboarding Secret can be left behind.** It is written before the `Validator`, so it stays if the create fails, and it is not deleted with the validator.

***

## Turning sandbox mode on

This part is for platform administrators. Sandbox mode is enabled with the `api.sandbox.*` Helm values, and it also needs:

* The **operator database** (`operator.database.*`), because sandbox validators have no `spec.database`.
* **Managed authentication** (`operator.keycloak.*`), because every sandbox validator uses managed Keycloak.

See [Sandbox mode values](/catalyx-blockchain-manager/canton-network/version-2.0/installation-instructions-canton/platform-installation.md#sandbox-mode-values) and [Operator database](/catalyx-blockchain-manager/canton-network/version-2.0/installation-instructions-canton/platform-installation.md#operator-database) for the full list of values.

{% hint style="danger" %}
**The operator database applies to every validator on the platform, not only sandbox ones.** Once `operator.database.host` is set, the operator ignores each `Validator`'s own `spec.database`, except `pqsDatabase`. Do not turn sandbox mode on in a cluster that runs validators with their own databases.
{% endhint %}

If a sandbox URL is missing, creating a validator fails with `503`. If the operator database is not configured, the validator is created but never reconciles.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/sandbox-mode.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.