GBP SandboxThe sandbox Google never shipped for Business Profile.
A true test mode for the GBP API: create fake locations, seed reviews and metrics, then point your real integration at a byte-for-byte sandbox replica of the Google Business Profile API — no Google approval, no verified listings, no risk to production.
# Point your existing client at the sandbox — same paths, same shapes. - const HOST = "https://mybusiness.googleapis.com" + const HOST = "https://api.gbpsandbox.com" $ curl "$HOST/v4/accounts/123/locations/456/reviews?pageSize=50" \ -H "Authorization: Bearer sk_sandbox_live_..." { "reviews": [ { "starRating": "FIVE", "comment": "Fast and friendly!" } ], "averageRating": 4.6, "totalReviewCount": 128, "nextPageToken": "CgkI8aH..." }
Testing against real Google is risky and slow
There's no official way to safely build a Business Profile integration. So teams test against production — or not at all.
No official sandbox
Google ships no test environment for the GBP API. Your only options are to build against live data or guess — and find the bugs in production.
Access is gated and slow
New projects start at zero quota. Before a single call works you need a verified profile (60+ days old), a matching business website, and a manual approval from Google.
Production is fragile
Test against real listings and you risk polluting verified pages, posting real public replies, and tripping rate limits. And a review you create can't be deleted via API — only the customer or Google can remove it.
The API is scattered
Reviews and posts still live on the legacy v4 API while everything else moved to v1 — spread across several hosts, versions, and docs pages you have to stitch together yourself.
Five tools, one sandbox
Every surface you need to build, seed, test, and automate against Google Business Profile — from a polished UI to an MCP server for your AI agents.
A simple, beautiful dashboard
Create locations, seed reviews, and shape metrics from a clean UI built for humans — not config files.
The GBP API replica for your tests
A byte-for-byte copy of Google's endpoints. Point your real integration at it — only the host changes.
- https://mybusiness.googleapis.com + https://api.gbpsandbox.com # same paths, params & errors
A top-notch CLIComing soon
Script setup & teardown in CI or locally.
$ gbp-sandbox seed reviews --n 200 $ gbp-sandbox reset --env ci
A REST API to control your data
Seed & reset fake data programmatically.
POST /control/v1/reviews { "rating":"FIVE", "reply":null }
An MCP server on topComing soon
Drive the whole sandbox from AI agents in natural language — create locations, seed reviews, and trigger failures straight from your editor or assistant.
Everything you need to test like it's production
Faithful where it counts, controllable where it helps.
Byte-for-byte API replica
Identical paths, query params, pagination tokens, field masks, and google.rpc.Status error envelopes. Usually you change only the host.
Realistic performance metrics
Seed calls, direction requests, website clicks, Maps & Search impressions — plus reviews with any star rating and replied / unreplied state.
Rate limits & expired tokensNew
Enforce Google's real limits — 300 QPM, 50 reviews per page, 10 edits/min — then force a 429 to test your backoff, or expire an access token to run your refresh and re-consent paths on demand.
Fault injection
Trigger NOT_FOUND, PERMISSION_DENIED, eventual consistency, and other failure modes whenever you want to test the unhappy path.
Fake Business Profile page
A Google-looking page per location to verify your changes visually — private while you build, public and shareable when you're ready to demo.
Isolated environments
Keep dev, staging, and CI on separate datasets with their own credentials, so parallel test runs never clobber each other's state.
Point your existing integration at the sandbox in minutesNew
Drop-in skill for Claude Code that finds your GBP calls, swaps hosts and credentials, and wires up test fixtures — no rewrite.
A faithful copy of the endpoints you actually use
The core of any GBP integration — replicated exactly, across the same Google services.
Same resource names (accounts/{id}/locations/{id}/…), same pagination, same field masks. Only the host changes. See the full coverage table — every method we replicate, what's on the roadmap, and what is out of scope. Call something we don't replicate and you get a 501 UNIMPLEMENTED naming the method, not a 404 you have to guess at.
Test the failures you can't trigger in production
Rate limits, expired tokens, revoked access, and the field-validation errors Google only throws on a bad day. A dedicated Simulation console reshapes every quota per API family — exactly the tables you see in the Google Cloud console — arms auth failures, and forces any of Google's 74 location-write error codes. Each one comes back byte-for-byte, so your error branches run on command instead of by accident.
# Drop Business Info "Update Location per day" to 3 — the 4th patch 429s $ curl -X POST .../control/v1/quota:set -d '{ "quotas": { "businessInformation": { "updateLocationRequestsPerDay": 3 } } }' { "error": { "code": 429, "status": "RESOURCE_EXHAUSTED", "message": "Quota exceeded for quota metric 'Update Location requests'...", "details": [{ "@type": "type.googleapis.com/google.rpc.ErrorInfo", "reason": "RATE_LIMIT_EXCEEDED", "domain": "googleapis.com" }] } }
# Arm PIN_DROP_REQUIRED on the next PATCH /v1/locations/* $ curl -X POST .../control/v1/locations:force-patch-error -d '{ "code": "PIN_DROP_REQUIRED" }' { "error": { "code": 400, "status": "INVALID_ARGUMENT", "message": "Request contains an invalid argument.", "details": [{ "@type": "type.googleapis.com/google.rpc.ErrorInfo", "reason": "PIN_DROP_REQUIRED", "domain": "mybusinessbusinessinformation.googleapis.com", "metadata": { "field_mask": "storefront_address" } }] } }
# Kill the access token — the next call 401s, your refresh heals it $ gbp-sandbox auth expire { "error": { "code": 401, "status": "UNAUTHENTICATED", "message": "Request had invalid authentication credentials..." } } # Or revoke the refresh token, and test the re-consent path instead $ gbp-sandbox auth revoke-refresh
Google changes categories without warning.
You'll know first.
We crawl every Google Business Profile category and attribute across 240+ countries, every day. When Google adds, renames, or removes one, it lands in the public changelog — so your integration never ships stale taxonomy and your clients' profiles never break silently.
Don't want to poll? Pro includes real-time webhooks — an HMAC-signed POST to your endpoint the moment a change is detected. Be informed, never miss a change, keep every client's data fresh.
Simple, developer-friendly pricing
Limits track your real scale — never how thoroughly you test. Start free, upgrade when it goes into CI.
Move one environment off real Google and stop the pollution risk today.
No credit card required
Start building free- All core GBP-compatible endpointsSame paths, params, field masks & error envelopes
- End-user OAuth consent flowTest “Sign in with Google” against the replica
- 3 sandbox locationsEnough for multi-location review workflows
- 1 isolated environmentDev, staging or CI — pick one
- 25 reviews per locationEnough to page through nextPageToken end to end
- Swap your integration in minutesDrop-in skill for Claude Code that finds your GBP calls, swaps hosts and credentials, and wires up test fixtures — no rewrite
- Manual review & metric seedingFrom the dashboard
- Basic performance metrics
- 1 API credential
Give dev, staging, and every CI job a clean, already-verified dataset.
billed monthly
Get Pro- Everything in Free, plus:
- Reproduce Google's failure modes on demandForce a 429, expire or revoke a token, inject NOT_FOUND / PERMISSION_DENIED / eventual-consistency errors
- 25 locations per environmentRun real multi-location review workflows
- 10 isolated environmentsOne each for dev, staging & every CI job
- 1,000 reviews per locationMulti-page review workflows
- Programmatic seeding & reset (REST API & CLI)Wire fixtures straight into CI
- Location groupsOrganize & move locations (locations.transfer)
- Attribute & category editing
- Realistic performance metricsSeed calls, direction requests, website clicks, Maps & Search impressions
- Public, shareable Business Profile page
- Real-time changelog webhooksSigned alerts when Google changes categories or attributes
- Multiple API credentials & priority support
Questions, answered
Is there a sandbox or test mode for the Google Business Profile API?
Google doesn't ship an official sandbox for the Business Profile API. GBP Sandbox is a drop-in replica — same paths, parameters, field masks and response shapes on a different host — so you can test your GBP integration end-to-end without touching production.
How do I test the GBP API without a verified Business Profile?
Point your existing client at the sandbox host with a sandbox credential. No Google approval, no verified listing, no quota request — create fake locations and seed reviews from the dashboard in minutes.
Is this affiliated with Google?
No. GBP Sandbox is an independent testing tool and is not affiliated with, endorsed by, or sponsored by Google. We replicate the public API contract so you can build against it safely.
Do I need Google API access to use it?
No — that's the whole point. There's no access request, no verified listing requirement, and no quota approval. Sign up and start making calls in minutes.
Can I use my existing client code?
Yes. Paths, query parameters, pagination tokens, field masks, and response shapes match Google's, so in most cases you only change the base URL and use a sandbox credential.
Which endpoints are supported?
Today: list locations, get attributes, list categories, update location, list reviews, reply to a review, and fetch performance metrics — across the same Google services. Posts and media are on the roadmap.
Is my data isolated from other users?
Yes. Every sandbox account is fully isolated, with its own locations, reviews, metrics, and credentials. Nothing is shared between tenants.
What happens if I cancel?
Your replica API access is disabled and your sandbox data is retained for a grace period, so you can pick up exactly where you left off if you resubscribe.
Stuck on the GBP API? You're not the first.
The Business Profile API is under-documented and full of edge cases. Our forum is where developers compare notes, report what's broken, and shape what we build next.
Report a bug
Found a response that doesn't match Google? Tell us and we'll fix the replica — fidelity reports jump the queue.
Suggest a feature
Need an endpoint, a fault mode, or a seeding option we don't have yet? Post it — the roadmap is built from these threads.
Get GBP support
Quota limits, field masks, review replies, verification quirks — ask people who have already hit the same wall.
Free to join — no account required to read.
Start testing against Google Business Profile today
Spin up a sandbox in minutes. No Google approval required.