# Try it in the browser

This page is for developers who want to explore VBAPI operations without writing code. It shows how to log in and make calls from the **Try it** panel on each operation in the [API reference](/openapi/vbasoftware/vbasoftware.api).

This changes production data
VBAPI clients connect to production, so the write calls on this page create or change real records in the database you name in `vbasoftware-database`. Try the steps in a non-production database first if VBA has given you one, use clearly fake values while you test, and keep the "Check it worked" calls, which only read data. "Try it" in the API reference also calls production.

**Try it** opens Redocly Replay, and **Send** makes a real request to the production API with the credentials and database you enter. `GET` operations only read data, so they are safe to explore. `POST`, `PUT`, and `DELETE` create, change, or delete real records; only use them in a non-production database, if VBA has given you one.

## 1. Get an ID token

1. Open [`POST /user-authentication`](/openapi/vbasoftware/vbasoftware.api/user/userauthentication) and select **Try it**.
2. On the **Security** tab, enter your API key under `apiKeyAuth`, and your username and password under `basicAuth`.
3. On the **Headers** tab, enter `vbasoftware-client-id`, `vbasoftware-client-code`, and `vbasoftware-database` (for example `YOUR_DATABASE`). Make sure each header you fill in is ticked. Leave `vbasoftware-machine-id` empty.
4. Select **Send**. In the response, copy the value of `data.authenticationResult.idToken`.


If the response has a `challengeName` such as `NEW_PASSWORD_REQUIRED` instead of tokens, set a permanent password first with [`POST /change-temporary-password`](/openapi/vbasoftware/vbasoftware.api/user/userchangetemppassword); see the [Quick start](/developer-portal/get-started/quick-start#if-login-asks-for-an-extra-step).

The token expires after the number of seconds in `expiresIn`. When calls start returning `401`, repeat these steps.

## 2. Make a call

1. Open a read operation, for example [`GET /groups`](/openapi/vbasoftware/vbasoftware.api/groups/listgroups), and select **Try it**.
2. On the **Security** tab, enter your API key under `apiKeyAuth` and paste the ID token under `bearerAuth`.
3. On the **Headers** tab, enter `vbasoftware-database`.
4. On the **Query** tab, set `page` to `1` and `pageSize` to `5`, so the response stays small.
5. Select **Send**.


Your browser sends its own `User-Agent` header, so you do not need to add one here. In code, send a descriptive one; see the [Quick start](/developer-portal/get-started/quick-start).

## Read-only operations to try first

These list configuration records rather than people, so they are a good first look at your data:

| Operation | What it returns |
|  --- | --- |
| [`GET /groups`](/openapi/vbasoftware/vbasoftware.api/groups/listgroups) | Employer groups |
| [`GET /plans`](/openapi/vbasoftware/vbasoftware.api/plans/listplans) | Benefit plans |
| [`GET /plan-types`](/openapi/vbasoftware/vbasoftware.api/plan-types/listplantype) | Plan types |
| [`GET /billing-cycles`](/openapi/vbasoftware/vbasoftware.api/billing-cycles/listbillingcycle) | Billing cycles |
| [`GET /search-configs`](/openapi/vbasoftware/vbasoftware.api/search-config/listsearchconfigs) | Search configurations for the Search API |


Subscriber, member, claim, and authorization operations return real personal health information. Treat what is on your screen, and any screenshot you share, accordingly.

## If a call fails

| What you see | Likely cause | Fix |
|  --- | --- | --- |
| `401` from `POST /user-authentication` | Wrong username or password, or the wrong client ID, client code, or database for that user. | Check each value with whoever issued your credentials. |
| `challengeName: NEW_PASSWORD_REQUIRED` instead of tokens | The user still has a temporary password. | Set a permanent password with [`POST /change-temporary-password`](/openapi/vbasoftware/vbasoftware.api/user/userchangetemppassword), then log in again. |
| `401` on a data call | The ID token is missing, expired, or not sent as `Bearer`. | Log in again, and send `Authorization: Bearer <idToken>`. |
| `403` with `{"message":"Forbidden"}` on every call | The `x-api-key` header is missing or wrong. | Send your API key in `x-api-key` on every request, login included. |
| `429` | More than 25 requests per second (burst 50) on your API key. | Slow down and retry with backoff. The samples do this for you. |
| Login or data calls fail for a database you expect to use | The `vbasoftware-database` value does not match a database your user can reach. | Use the database name you were given, exactly as issued. |


## Next steps

- [Quick start](/developer-portal/get-started/quick-start): make the same calls from C#, Python, or TypeScript.
- [Credentials and environments](/developer-portal/get-started/credentials-and-environments): what each credential is and where it goes.