Plaid Sandbox Items, transactions, webhooks, transfers, ledgers, test clocks, OAuth selection, and report simulations. Generated from an immutable SHA-256 pin of Plaid's official OpenAPI 2020-09-14_1.698.7; the installed family admits 301 of 331 official routes and records 30 exact exclusions. PLAID-CLIENT-ID and PLAID-SECRET come only from the encrypted connection, Plaid-Version is binding-owned, every new mutation requires approval, reads are uncached, and JSON inputs are recursively closed. Plaid's POST-based PDF routes remain explicit exclusions until response capture supports read-tier POST. No workflow or work-entity Source is published over this sensitive surface.