# Call the sandbox's API from the terminal with rivr api and rivr orders - Date: 2026-10-25 - Type: New - Surface: Developer portal and CLI - What you need to do: Nothing. - Address: https://developers.rivr.io/changelog/2026-10-25-rivr-api-and-orders-commands `rivr api ` calls the sandbox's /api/public from your terminal, the way `stripe get` and `stripe post` do, without you holding a secret: the portal runs the call as one of your merchants, in the sandbox, through the same code as the Workbench page. Give a body with `--data ''` or `--data @file.json`, choose the merchant with `--merchant ` (the first in your organisation otherwise) and send an `Idempotency-Key` with `--idempotency-key `. The answer is formatted JSON with the status, the `Rivr-Request-Id` when the API sent one and the body, and the exit code is 1 for a 4xx or 5xx answer, so a script stops where the call failed. `rivr orders get `, `cancel ` and `refund ` are the same calls for an order; `cancel` and `refund` send a new `Idempotency-Key` unless you give one, and print it so you can repeat the call. `rivr orders list` prints the newest orders. /api/public has no order list, so it is the list on the Orders page. The limits are the Workbench's: only paths under /api/public (a path outside it, `..` and encoded dots are refused), only a merchant in your organisation, a write needs the same permission as the Orders page and is audited, and the rate limit is the portal's own. The API has no partial refund, so `rivr orders refund` takes no amount. The approval page of `rivr login` says what a token may do.