Journey Lanes
NewSign in with an authenticator app

User journey testing, API flow testing and synthetic monitoring

Describe how people use your product. Get a flow you can run.

Journey Lanes reads your repositories, draws each user journey with one lane per role, builds a mock backend from your code, and tests the journey end to end against that mock or your live environment, after every deploy and on an interval. Anyone on the team can build and change a flow: no test code to write.

Create an account See how it works

Reads GitHub, GitLab and Bitbucket repositories, OpenAPI, GraphQL and gRPC

  • Flows from plain language
  • Mock backend from your code
  • Live environments
  • Monitoring and alerts
  • Access audits
Portal / Ordering Mock Run flow
Describe the journey

A company admin logs in. The company admin sees the users and can create a user. An employee logs in. The employee sees the products and can order a product and update their order.

The flow Journey Lanes draws from the sentence above Company Admin: Log in via Keycloak, then Users (GET /api/users), then Create user (POST /api/users). Employee: Log in via Keycloak, then Products (GET /api/products), then Order product (POST /api/orders), then Update order (PATCH /api/orders/:id). Company AdminROLE_COMPANY_ADMIN EmployeeROLE_EMPLOYEE Mock backendCollections Screen Users GET /api/users Action Create user POST /api/users Screen Products GET /api/products Action Order product POST /api/orders Action Update order PATCH /api/orders/:id Data User Mock collection Data Product Mock collection Data Order Mock collection
  1. Company AdminPOST /realms/portal/protocol/openid-connect/token200
  2. Company AdminGET /api/users200
  3. Company AdminPOST /api/users201
  4. EmployeePOST /realms/portal/protocol/openid-connect/token200
  5. EmployeeGET /api/products200
  6. EmployeePOST /api/orders201
  7. EmployeePATCH /api/orders/:id200
Drawn by Journey Lanes from the sentence above, against a sample portal API: 2 roles, 7 steps, then run against the mock backend.

Everything in one place

One project holds your repositories, the journeys through your product, the environments they run against, and what happened on every run.

Map the journeys

  • Read your code: endpoints, records, roles and frontend pages from GitHub, GitLab or Bitbucket, or from OpenAPI, GraphQL and gRPC descriptions
  • Describe a journey in plain language, or let a tour show what one role may do
  • Add steps by hand from a menu of every endpoint, sorted by collection and method
  • Reuse what works: saved roles with their sign-in, copy and paste between flows
  • Explain this failure on a failed step: the cause in the flow, the code or the environment

Run and check

  • A mock backend built from your entities, with Keycloak-style tokens per role
  • Checks on status, response time and response fields
  • Refusals as steps: a missing name must answer 422, another tenant 403
  • Live replay of every run on the canvas, step by step

Live environments

  • Sign in like your users: OAuth, login requests, login pages and single sign-on, with two-factor codes and passkeys
  • Flows that make their own data: unique names per run, invitations read from a test inbox
  • Writes and load tests off until you allow them, per environment
  • Deploy checks from CI or Argo CD, with a GitHub commit status
  • Private networks through a relay agent you run

Watch over time

  • Monitoring on an interval, with pass rate and timings
  • One alert when a flow starts failing and one when it recovers: email, Teams, Slack or webhook
  • Load tests that check error rate, p95, and that every create landed
  • API changes found by a daily rescan, with an alert when they break monitored flows

Find access problems

  • Access audit: every role probes every endpoint with its own and other tenants’ ids
  • Findings by severity, from cross-tenant reads to endpoints open without login
  • Your decisions become the access policy the mock enforces

Work as a team

  • Organizations and projects, with viewers, editors and owners
  • Invites by email; people outside a project see nothing of it
  • Undo and redo for every change to a flow
  • Export a flow as a Playwright test or a Postman collection

One tool for journey, flow and chain testing

The same flows answer the questions different kinds of tests ask. Each guide explains the practice with any tool, and how Journey Lanes does it.

User journey testing

One task, start to finish, as each role does it: sign in, see, create, and be refused what the role may not do.

API flow testing

Calls in the order a client makes them, each using what the one before returned, with checks on status, fields and timing.

Chain testing across services

One process through every service it touches, each step sent to the service that defines it, on every environment.

Synthetic monitoring

The same journeys on an interval against your live environment, with one alert when they fail and one when they recover.

Access control testing

Every role against every endpoint, with other tenants’ ids and without a token: tenant isolation and IDOR, checked.

End-to-end API testing

Real sign-ins, real environments and data each run makes for itself, after every deploy from your pipeline.

From the sticky notes on your wall to a flow that runs

Write down who signs in, what they see and what they can do, the way you would on a wall. Each role becomes a lane, each action a step that calls a real endpoint from your code, and a system lane shows the records each step touches.

Then run it. The mock answers the way your code says it should, and the same flow runs against your test or acceptance environment, signed in with a test account per role.

How a flow comes together

A wall covered in green, pink, blue and yellow sticky notes mapping out a process
Photo: Hugo Rocha on Unsplash

What a flow gives you

One lane per role

Who signs in, what they see, and what they may do, side by side. A company admin and an employee get their own lanes, and every step names the endpoint it calls.

A backend before yours is ready

Each project gets a mock built from your endpoints and entities, with Keycloak-style tokens and data scoped per tenant. Point your frontend or Postman at it too.

Checks that hold the description to its word

“Can only see their own companies” becomes a check on the response. “Cannot create a company” becomes a step that must be refused with 403.

Runs that keep running

Monitor a flow on an interval and get one alert by email, Microsoft Teams, Slack or webhook when it starts failing, and one when it recovers.

Built for the whole team, not only developers

A product owner or tester can put a complete chain test together by clicking: pick the steps, let Journey Lanes fill in how each call works, and run it.

  • Help meReads the code behind a step and sets it up: a body that passes validation, the path keys, pagination, filters and sorting it supports, and the checks for the answer.
  • Explain this failureOn a failed step: why it failed, where the cause is, and a change to the step you can apply in one click.
  • Endpoints menuEvery endpoint from the scan, by collection, with GET, POST, PUT, PATCH and DELETE in that order. One click adds it after the selected step.
  • Saved rolesSet up how a role signs in once, and start every new flow with it, test accounts and all.
  • Copy, paste and undoDuplicate a flow, copy steps into another one, and undo any change with ⌘Z.
A team around a whiteboard in an office while one of them presents a plan
Photo: Vitaly Gariev on Unsplash

Reads the code you already have

Connect a code host or add an API description, and Journey Lanes picks out what a journey is made of. Nothing is added to your code, the frontend and API can live in separate repositories, and a daily rescan notices when the API changes.

Endpoints
OpenAPI and Swagger, GraphQL schemas, gRPC .proto files, Express, Elysia, Hono, Fastify, NestJS, Next.js, Symfony and API Platform, Laravel, FastAPI, Django, Rails, Spring Boot, ASP.NET Core, Go routers
Records
Prisma, Doctrine, Eloquent, TypeScript interfaces, OpenAPI and GraphQL schemas, Django models, Rails schema, JPA entities, C# classes, Go structs
Validation
Symfony constraints, Elysia and zod schemas, class-validator DTOs
Roles
Keycloak realms and clients, role checks such as IsGranted, hasRole, @Roles, @PreAuthorize and [Authorize(Roles)], Laravel role middleware, Symfony role hierarchies
Pages
React Router, Vue Router, Angular and Next.js routes, with the API calls each page makes

What the scanners read · All integrations

Colourful source code on a computer monitor
Photo: Markus Spiske on Unsplash

Fits the stack you run

Named because Journey Lanes works with them; see integrations for how each one connects.

Code and APIs
GitHub, GitLab, Bitbucket · OpenAPI 3.0/3.1, Swagger 2.0 · GraphQL · gRPC and reflection
Frameworks
NestJS, Express, Next.js · Symfony, Laravel · Django, FastAPI · Rails · Spring Boot · ASP.NET Core · Go
Sign-in
Keycloak, Auth0, Entra ID, Azure AD B2C, Okta, Cognito, Supabase, Firebase · TOTP, SMS and email codes · passkeys · SAML
Alerts and CI
Email, Microsoft Teams, Slack, webhooks · any CI, Argo CD, GitHub commit statuses · Playwright and Postman exports

Beyond the happy path

Access audit

Every role probes every endpoint with its own ids, other tenants’ ids and no token at all. Cross-tenant reads, writes into another company and endpoints open without login are flagged by severity.

About the audit

Load tests

Repeat one step, such as ordering a thousand products, with many requests in flight. Afterwards it checks error rate, p95, that every create landed, and that scope held.

About load tests

Tours per role

Pick a role your code knows, and get a flow of everything it may do, plus checks that a few things it may not do are refused.

About tours

Cases it catches

Things that go wrong in real products, and how each is caught. Every case is worked out step by step.

All 7 cases

Careful with live systems

Writes and load tests are off for a live environment until you allow them. Audits never send delete probes there, run history never keeps tokens or passwords, and load tests and audits only run against domains you have verified.

How Journey Lanes handles your systems and data

  • Credentials stored encrypted, never sent back to the browser
  • Personal data, passwords and one-time codes masked in run history
  • Only public addresses are called; private networks only through your own relay agent
  • Code hosts connected read-only
  • Platform admins get no access to your projects

Draw your first flow

Name your organization, connect a repository, and describe one journey. The mock backend is ready as soon as the scan is.

Create an account See how it works