Journey Lanes

Release notes

What’s new in Journey Lanes

New features, improvements and fixes, newest first.

Sign in with an authenticator app

  • NewUse a code from an authenticator app on your phone instead of the email code. Set it up under account menu → Your data → Authenticator app: scan the QR code, enter a code, and save your 10 recovery codes for when you don’t have your phone.
  • NewNew recovery codes and turning the app off both ask for a current code. A password reset link also asks for one when you use an app.
  • BetterPlatform admins need an authenticator app for the pages that run the installation. Until they set one up, a banner takes them there.

Passwords from data breaches are refused

  • BetterWhen you choose a password, Journey Lanes checks it against Have I Been Pwned’s list of passwords from data breaches and asks for another one if it’s there. Your password never leaves Journey Lanes: only the first 5 characters of a hash of it are sent.

See where you’re signed in, and other security improvements

  • NewAccount menu → Your data lists where you’re signed in: the browser, the approximate network, password or single sign-on, and when it was last used. Sign out one of them, or everywhere else.
  • BetterAPI tokens now expire after 30, 90 or 365 days. Tokens made to never expire stop working one year from today; make a new one before then.
  • BetterAPI token access follows the person who made it: if they can now only view the project, so can the token.
  • BetterLoad tests have a size per plan (requests and how many at once), and projects a number of flows, environments and repositories per plan. When several load tests are running, a new one asks you to try again shortly.
  • BetterUp to 50 invitations a day per organization and per person inviting, and resending an invitation waits 10 minutes.
  • BetterA discount code that can’t be used says just that, whatever the reason, and trying codes is limited. Admins can generate codes that are hard to guess.
  • BetterThe flow list of the public API comes a page at a time; the command line and the GitHub Action read every page.
  • FixedThe page behind “Stop these alerts” in an alert email shows its styles and its button works.

Single sign-on for organizations

  • NewOrganizations on Business and Enterprise sign in through their own identity provider, with OpenID Connect or SAML 2.0: Microsoft Entra ID, Okta, Google Workspace, Auth0, Keycloak and others. Set it up under Organization → Single sign-on, with the values to paste into your provider and a Test connection button.
  • NewProve your email domains with a DNS record. People in them choose “Sign in with SSO”, join the organization the first time they sign in, and get a role from their groups if you map them.
  • NewRequire single sign-on: password sign-in stops for your domains, except for the owners you choose as break-glass. Each of their password sign-ins is emailed to the owners.
  • NewSee members who stopped signing in through your identity provider, get a weekly email of them, and remove them in one go.

Audit log and a trust page

  • NewOrganization owners and admins have an audit log under Organization: who invited, removed or changed people, changed projects, environments, secrets, API tokens, code hosts, relay agents, alerts and billing, and who signed in. Filter it, search it and export it as CSV or JSON. Secrets show only that they changed, never their value.
  • NewEach audit log entry is sealed to the one before it, so Check seals shows whether any entry was changed or removed. Entries are kept a year, longer on plans that say so.
  • NewA trust page with the security overview, the sub-processors, where your data is, answers to common security questions, 90 days of status history, and the data processing agreement as a PDF to sign.
  • BetterYour own audit log entries are part of your data download.

Monitoring that keeps up

  • BetterMonitored flows are queued and shared fairly between organizations, so a busy installation keeps every monitor on its interval and one organization’s many monitors don’t delay anyone else’s.
  • BetterAfter 7 days, passing monitor runs that changed nothing are kept as counts per hour instead of one by one. Failures and the first pass after a failure stay in full, and run counts don’t change.

Flows as code: API tokens, a public API and the command line

  • NewProject owners make API tokens under API tokens in the top bar: each can read, change or run the project’s flows, as you choose, can expire and can be limited to an address range. Organization owners see and revoke all of them.
  • NewA public API for flows and runs, with an OpenAPI reference, for scripts and CI. Runs started through it count like any run.
  • NewKeep flows in your repository: flow files in .journeylanes/flows/ become flows on every scan, change when the file changes, and are archived when it’s removed. In the app they’re read-only until an owner detaches one.
  • NewThe journeylanes command line runs flows and waits for them, and pushes and pulls flow files. In GitHub Actions it adds a summary of the runs to the job.

Help centre and support

  • NewA help centre with step-by-step articles for every part of Journey Lanes, from connecting GitHub to invoices, with a search. The ? in the app’s top bar links to the help for the screen you’re on.
  • NewHelp and support in the account menu: ask a question, optionally with a screenshot and a link to the project, flow or run you’re in, and follow the answers in the app and by email.
  • NewA contact page for questions before you have an account.

Discount codes and extra people

  • NewHave a discount code? Enter it under Billing and invoices when you choose or upgrade a plan. The checkout shows the price with the discount, and what it costs once the discount ends.
  • NewTeam and Business can add people on top of the plan, one at a time, without moving to a bigger plan. You pay for the rest of the period now; fewer people take effect at the renewal.
  • BetterInvoices list the plan, a discount and extra people as separate lines.

Emails that reach the inbox

  • NewEvery alert email has a link to stop alerts from that channel for your address, in one click and without signing in. Mail apps show it as their own unsubscribe button.
  • BetterEmails are marked as messages from the system, and the sign-in code email is plainer, so mail providers trust them more and file them in the inbox rather than spam.

Search fields stay empty

  • FixedBrowsers and password managers no longer fill your email address into Search endpoints or Find a repository.

Two-step sign-in and designed emails

  • NewSigning in takes a second step: after your password, Journey Lanes emails you a 6-digit code, and only that code, in the same browser, signs you in. On a device of your own, tick “Trust this browser for 30 days” to skip it there. See and forget trusted browsers under account menu → Your data.
  • BetterEvery email from Journey Lanes has the same clear design, with what happened, what to do, and one button, and reads well on phones, in dark mode and in Outlook.

Safer exports and organizations

  • FixedExported Playwright tests and Postman collections only ever contain your flow’s values as text or numbers, never as code, and a flow’s checks are checked when it’s saved or imported.
  • FixedTwo owners changing roles or leaving at the same moment can no longer leave an organization without an owner.
  • BetterMoving a project to another organization takes being an owner of the organization it’s in. What the project used this month comes along to the new organization.
  • BetterA flow’s own mock data has an address of its own: sharing it doesn’t give away the project’s mock.
  • BetterTemporary inboxes can’t sign up, and one inbox gets one free trial, also with name+something@ addresses.

Your code and mock stay with your team

  • FixedConnecting a GitHub organization now takes one of its admins, and an installation connects to one organization in Journey Lanes. Before, someone with read access to a single repository could connect it.
  • BetterThe mock backend’s address carries a key of the project’s own, and its sign-ins use the project’s own password instead of “mock”. Both are shown to the project’s members, change when someone leaves the project, and owners can replace them under Mock sign-ins. Update the address in frontends and Postman collections that use the mock.
  • NewOwners and admins can choose which repositories from a code host connection the organization’s projects may use (Organization → Code hosts).
  • BetterSomeone removed from a project stops seeing its live updates straight away, and removing a repository removes its API change history too.

Clearer billing: reminders, locked prices and corrected invoices

  • NewOwners get an email 7 days and 1 day before a free trial ends, and when it ended, and a warning 30 and 7 days before the card on file expires if that’s before the next renewal.
  • BetterYour subscription keeps the price you bought it at. A new price only applies after an email at least 30 days ahead, and you can cancel or change plan before it does.
  • NewAn invoice with the wrong name, address or VAT number can be corrected: you get a credit note and a corrected invoice, and the original stays as it was. Ask us through support.
  • NewWhen you cancel, you can tell us why. It’s optional.
  • BetterConfirmed EU VAT numbers are checked again every month. If one is no longer valid, you get an email and VAT is charged again from the next renewal.
  • BetterPlans by agreement can have an end date, shown under Billing and invoices, with reminders 30 and 7 days before.

Hand over ownership and move projects

  • NewOwners can hand ownership of an organization to someone else in one step, and every owner gets an email when owners change.
  • NewOwners and admins of two organizations can move a project from one to the other. Before it happens you see who loses access and what needs reconnecting, such as repositories and relay agents of the old organization.
  • BetterWhen an organization has no owner left who can act, the people who run Journey Lanes can make one of its members an owner. Everyone in it gets an email with the reason.

Guides to journey, flow and chain testing

  • NewGuides on user journey testing, API flow testing, chain testing, end-to-end API testing, synthetic monitoring and access control testing, plus a comparison with Playwright and Postman. Each explains the practice first, then how to do it in Journey Lanes.
  • NewIn Dutch: guides on ketentesten and end-to-end testen, and a short overview of Journey Lanes.

Clearer relay agent messages

  • BetterAn address that only your network knows, and that isn’t on your relay agent’s allow list, now says which host and port to add to AGENT_ALLOW, instead of only that it can’t be found.
  • BetterWhen the relay agent is offline, a run stops at the first step that needs it and skips the rest, with the reason, instead of failing every step.

A website that covers what Journey Lanes does now

  • NewThe product pages are split by area: sources and scanning, flows and AI, the mock backend, live environments, checks and audits, monitoring, and CI and exports.
  • NewNew pages: integrations (what connects to what, and how), the relay agent, getting started, and frequently asked questions.
  • BetterThe security page now covers code host access, the sign-in browser, private networks, the request log, backups and AI. Pricing shows the AI requests each plan includes.

A safer sign-in browser and relay agent

  • BetterEvery sign-in in the real browser now gets a browser of its own, and every address it connects to is checked as it connects, also after a redirect. A login page that hangs is stopped at the time limit instead of holding the browser.
  • FixedA login page that answers with a redirect back to your app no longer sends the browser there: the code is read on the way, as with other sign-ins.
  • BetterOne organization’s sign-ins take turns in the browser, so another organization’s busy flows can’t keep yours waiting.
  • FixedA saved refresh token is traded one sign-in at a time, also when two runs start together, so it no longer stops working by being sent twice.
  • NewA relay agent can run more than once on the same token, and Journey Lanes spreads calls over the copies. AGENT_METHODS=GET,HEAD keeps an agent read-only, and the agent reconnects by itself when its connection goes quiet. The agent’s image is now published; the run command shows it.
  • BetterThe password and 2FA codes are taken out of the sign-in trace wherever a login page repeats them, and only harmless parts of addresses are shown.

Relay agents: test servers inside your network

  • NewA staging server behind a firewall or VPN, or a self-hosted GitLab or Bitbucket there, can now be reached through a relay agent: a small program you run inside that network. It connects out to Journey Lanes, so nothing in your firewall opens, and it only calls the hosts you list.
  • NewOrganization owners and admins make agents under Organization → Relay agents and see whether each is online. In an environment or a source, pick the agent under “Reach through”.
  • BetterRuns, monitoring, deploy checks, audits, load tests, sign-ins, email steps and scans all go through the agent for the hosts it allows; everything else stays direct. Each step says when it went through an agent.

gRPC streams, gRPC-Web and reflection

  • NewStreaming gRPC methods run as steps. A method that streams to the server sends the list of messages you write; a streamed reply is read as messages and count, so checks like “count equals 3” or “messages[0].status is SHIPPED” work. A stream that doesn’t end stops at 1,000 messages, 5 MB or the step’s time limit and keeps what came.
  • NewServices behind a grpc-web proxy: switch on gRPC-Web for that service under Manage environments → Services, and its gRPC calls go over plain HTTP.
  • NewAdd a gRPC server as a source: Add code or API → OpenAPI → gRPC server. Journey Lanes reads its services and messages through server reflection, without the .proto files, and Refresh reads them again.
  • BetterMessages with Struct, Value, ListValue, Any and FieldMask fields are written and read as plain JSON, an Any with its “@type”.
  • BetterOn the mock, streaming List and Watch methods stream its records.

Sign in with a real browser, and saved sign-ins

  • NewLogin pages that only work with JavaScript (Microsoft Entra and B2C, Okta, Auth0’s new login page, Cognito’s managed login, your own single-page app) can now be opened in a real browser: choose “Open the login pages with: a real browser” on a login-page sign-in. It types the username and password like a person, answers “Stay signed in?” with No, types a 2FA code when asked, and picks the identity provider you name.
  • NewA new kind of login-page sign-in: the app’s own login page, in a real browser. The sign-in is done when the browser reaches your app’s signed-in pages; the token is read from the page’s storage, or the API’s cookies are the session.
  • NewSaved sign-ins, for accounts that can’t be signed in automatically, like personal Google, Apple or Microsoft accounts: sign in once in your own browser and paste the refresh token (Journey Lanes keeps it current when it rotates) or the session’s cookies. When it stops working, you get one alert and the environment says why.
  • BetterThe real browser runs apart from Journey Lanes, checks every address a login page asks for, never approves a consent page, and gets your 2FA codes rather than your TOTP secret.

AI requests per plan

  • NewEach plan includes a number of AI requests a month (drawing a flow with AI, Help me and Explain this failure): Personal 100, Team 500, Business 2,000. Plan and usage shows how many are left.
  • BetterOnce they’re used up, or when AI is busy, flows are drawn and steps explained by rules instead, with a note saying why. Nothing stops working.

GraphQL mutations on the mock, and Angular frontends

  • NewThe mock answers GraphQL mutations: createCompany, updateCompany and deleteCompany (and add…, edit…, remove…) change its records like the REST calls they stand for, with the same scopes, limits and access decisions. Fragments work in queries and mutations.
  • NewAngular frontends are read for pages: the routes given to the router, lazy components and lazy route files, and the API calls each page makes through HttpClient and the services it uses.

gRPC

  • NewJourney Lanes reads your .proto files: every gRPC method is in the endpoints menu, your messages become the mock’s records, and routes a gRPC-JSON gateway serves for them are listed too.
  • NewA step can call a gRPC method on your environment: write the message as JSON, with references to earlier steps. The reply is shown and checked as JSON, and a gRPC error counts as its HTTP status (NOT_FOUND as 404), so “should be refused” steps work the same way.
  • NewOn the mock, Get, List, Create, Update and Delete methods are answered over the mock’s records, so a gRPC flow runs before you connect an environment.
  • BetterWith writes off, methods that only read (Get…, List…, Search…) still run and the others are skipped, like reads and writes over REST.

Passkeys, single sign-on and patient sign-ins

  • NewTest accounts can sign in with a passkey, instead of the password or after it. “Register a passkey” next to a role makes one for that account in your app; Journey Lanes keeps its key encrypted and signs your app’s challenge at every sign-in.
  • NewSingle sign-on through another identity provider: the login page sign-in follows SAML and other pages that pass the browser on by themselves, across sites. Name the provider to use with “Sign in with” (the link or button) or with login page parameters like kc_idp_hint, connection or domain_hint.
  • BetterSign-ins wait out “too many requests” (429, or 503 with Retry-After), up to twice and 30 seconds in all, and say so, instead of failing a monitor run.

Explain this failure

  • NewA failed step now has “Explain this failure”. It reads that run and your project’s code, says why the step failed and whether the cause is in the flow, the code or the environment, and points at the lines that show it.
  • NewWhen the flow is the cause, it proposes a change to the step that you apply with one click (and undo). When the code is, it says what to change, with a snippet to copy. Journey Lanes never changes your code.
  • BetterIt only looks at your own project and only answers why that step failed; there is nothing to type. Without AI on the installation, it reads the reply and what the code declares.

Uploads, GraphQL, magic links, clean-up steps and waiting for background work

  • NewA write step can send a form with files (multipart): text fields plus a generated test file, a real PNG, PDF or CSV, or random bytes of a size you choose. Run history shows the file’s name, type and size, never its contents, and the mock accepts uploads too.
  • NewA step can send a GraphQL query with variables. A reply with errors fails the step unless a check looks at them, and with writes off queries still run while mutations are skipped. The mock answers simple queries over its records.
  • New“Repeat until its checks pass”: a read step can call again every few seconds, for up to five minutes, until a background job, a webhook’s effect or a payment has finished.
  • NewClean-up steps run at the end of a run, also when earlier steps failed, to remove what the run made. They skip themselves when what they would remove was never made.
  • New“This step signs the role in”: a call that opens a magic link or exchanges a one-time code signs the role in with the token or session cookies it hands out. The token is masked in run history.
  • NewSteps can send headers of their own, like a device id or app version, with references. Sign-in headers stay with the environment.
  • BetterWhen an API answers “too many requests” (429, or 503 with Retry-After), a run waits as long as it asks, up to twice and 30 seconds in all, and says so on the step. Load tests don’t wait, so they still show the limit.

Sign in to Auth0, Entra ID, Supabase, Firebase and Cognito

  • NewNew presets in Manage environments: Auth0, Microsoft Entra ID, Azure AD B2C, Supabase, Firebase Authentication and AWS Cognito, each with a line on what to fill in.
  • NewEnvironments can send extra headers with sign-ins, requests or both, such as an API gateway’s key, a device id or an app version. Mark a value secret and it is stored encrypted and never shown again.
  • NewOAuth sign-ins take extra token fields, like the audience Auth0 needs to hand out a token for your API.
  • NewTwo-factor codes can now be read from a Twilio test number, or be a fixed code your staging environment accepts.
  • BetterLogin requests can send nested fields and headers of their own, for APIs like AWS Cognito.
  • BetterWhen Journey Lanes can’t reach your server (a firewall, a VPN or an internal address), the message says so and what to do about it.

Flows as files, API changes, and comparing environments

  • NewExport a flow from its overview as a flow file, to keep in your repository and import again (Flows → Import flow), here or in another project. Roles that are the project’s own use its test accounts.
  • NewExport a flow as a Postman collection or a Playwright test, to run it outside Journey Lanes or in CI. Neither file holds test accounts or tokens: both read them from variables you set.
  • NewYour code and APIs are scanned again every day. What changed shows in the sidebar, with the steps that now call an endpoint that is gone, and when a monitored flow has such a step, your alert channels hear about it once. Switch the daily scan off under Monitoring alerts.
  • NewCompare a run with the newest run of the same flow on another environment: “Compare with…” in the run’s export bar shows, step by step, status, time, status code, failed checks and fields that differ.
  • NewAdd the same repository more than once, on different branches, and point each environment’s services at its branch.
  • BetterDescriptions can be three times as long, and Claude has room to draw journeys of a couple of hundred steps. A journey that is still too long says so, instead of quietly being drawn by rules.
  • BetterThe rule parser now reads German too: signing in, seeing, creating, changing and deleting, what a role may not do, and “sieht nur seine Firmen”.

Reads more kinds of code and API descriptions

  • NewScanning reads Rails, Spring Boot (Java and Kotlin), ASP.NET Core, Go (gin, echo, fiber, chi, gorilla/mux and net/http) and Django with Django REST framework: their routes, the roles their code checks, and their models.
  • NewGraphQL schemas: every query and mutation shows up as an endpoint of its own. Added to a flow, it sends a ready-made query.
  • NewNext.js and Vue Router frontends: their pages, with the API calls each page makes, name the screens of your flows. Next.js API routes count as endpoints.
  • BetterLaravel: resource routes, route groups with a prefix, and the /api prefix of routes/api.php. NestJS: the app's global prefix and versions, and the roles in @Roles.
  • BetterOpenAPI documents split over several files are put back together, in a repository and at a URL. An uploaded file tells you which references it couldn't read.
  • FixedOpenAPI 3.1 documents that write a type as a list ("string or null") no longer fail to import.

Pick repositories from GitHub, GitLab and Bitbucket

  • NewOrganization owners and admins connect GitHub, GitLab.com or Bitbucket Cloud once, under Organization → Code hosts. Everyone who adds code to a project then picks a repository from a list instead of pasting a token. Journey Lanes only reads code.
  • NewOn GitHub you install the Journey Lanes app and choose which repositories it may read; change that choice on GitHub at any time.
  • BetterAdding a repository with a token still works: choose “Use a token instead”.

Security fixes from a penetration test

  • BetterAn email address added to an alert channel gets a link to confirm it first. Alerts go only to confirmed addresses; people with an account in your organization are confirmed straight away, and addresses already on a channel stay as they are.
  • BetterWhen an environment starts signing in at another address, its stored passwords and secrets are removed, so they're never sent there. Enter them again after the change.
  • FixedFailed sign-in attempts by someone else can no longer lock you out: a browser you signed in with before still gets in with your password.
  • FixedFollowing an invite link joins only the organization that sent it. Invitations from other organizations wait for you to accept or decline them.
  • FixedDeploy checks count towards your plan’s flow runs, like other runs.
  • FixedFlow requests show a project only to people who are in it, and people below owner see extra login fields of an environment without their values.

Privacy: encrypted backups and a fuller account download

  • BetterDatabase backups are now encrypted the moment they’re made, with a key that isn’t kept on our servers.
  • BetterDownloading your account data (account menu → Your data) now includes the billing details of organizations you own and the invitations waiting for you.
  • BetterError reports leave out email addresses, and the privacy policy and data processing agreement now name where the email you send us is kept, and the code hosts you can connect (GitHub, GitLab, Bitbucket).

Reply to our emails

  • BetterReplying to an invoice, invitation or alert from Journey Lanes now reaches a person instead of bouncing. Questions about invoices, privacy and plans each have their own address, shown on the invoice and in the privacy policy.

Pay with Apple Pay, Google Pay and your own country’s bank

  • NewThe checkout has Other ways to pay, which opens Mollie’s payment page with Apple Pay, Google Pay and every other way Mollie offers there.
  • BetterThe ways to pay follow the country in your billing details, so you see your own country’s banks.

Paying is safe from double clicks

  • FixedChoosing a plan, resuming or paying twice at once, or a payment that went wrong halfway and was tried again, can no longer start a second subscription that charges you twice.

A guided first sign-in

  • NewThe first time you sign in, Journey Lanes shows what it does, then sets up your organization, shows its plan and free trial, and starts your first project in the way you choose: connecting a repository, adding an OpenAPI document, or describing a flow first.

Everything that removes something asks first

  • BetterRemoving a step, a check, a role, someone from a project, an invitation or a flow’s starting data now asks first, like deleting a flow does. So do forgetting stored sign-ins and declining or withdrawing a flow request.

Downgrades say what to remove first

  • BetterA smaller plan can be chosen once everything fits in it. Billing and invoices lists the projects, people and monitored flows over its limits, by name, and nothing is removed or paused for you.
  • BetterWhile a downgrade waits for the renewal, nothing can be added that the smaller plan wouldn’t fit.
  • NewProject owners can delete a project with the bin next to the project picker.

Deleting your account waits a month

  • BetterDeleting your account now waits 30 days, so you can change your mind: until then you can sign in as usual, and Keep my account (in the banner or under Your data) cancels it and starts stopped subscriptions again.
  • BetterYou no longer have to hand over or empty your organizations first. Organizations only you own are deleted on the day, with their projects, connected repositories and stored access tokens; everyone in them is emailed when you ask, so they can ask you to make them owner.
  • BetterSubscriptions of those organizations stop when you ask, and payments still being processed are settled before anything is deleted.

Questions in the app’s own window

  • BetterBefore deleting, removing, cancelling or withdrawing, the app asks in its own window instead of the browser’s pop-up. The button names what happens, and Escape or Cancel backs out.

Buy as a business or as a private person

  • NewBilling details ask who pays: a business (company name and its KvK or VAT number) or a private person (name and address).
  • NewPrivate persons pay the VAT of their own EU country and can withdraw within 14 days of first paying for a plan: Withdraw under Billing and invoices ends the plan and pays back the price minus the days used, with a credit note.
  • BetterThe pricing page shows prices for businesses (without VAT) or for private persons (with VAT).

A new look for the website’s menu and home page

  • BetterThe website’s menu floats over the page and shows where you are; on a phone it opens as a sheet that says where each link goes.
  • BetterThe home page opens with what’s new, and says which code hosts and API descriptions Journey Lanes reads.

Credit notes, safer sign-in, and history that's cleaned up

  • NewRefunds and chargebacks get a credit note, in the same numbering as invoices, emailed with its PDF. A plan payment refunded in full ends the period it paid for.
  • BetterFailed logins are limited per account and per address, guesses at your own password when changing or deleting it are limited too, and a session ends 30 days after signing in.
  • BetterRun history against the mock is kept 90 days; load tests, audits on the mock, alert history and deploy checks 180 days. Failed monitor runs are never thinned out early.
  • FixedA repository's configuration or a login page can no longer slow the servers down, and very large answers from your servers are refused instead of read whole.

See what was found, paste with sign-in, and the app on a phone

  • NewClick a repository or API under Code and APIs to see what Journey Lanes found in it: how it signs in, its roles, every endpoint with who may call it, the entities and their fields, frontend pages and notes.
  • BetterSteps pasted into another flow bring their role’s sign-in along, so they don’t run without a token.
  • BetterLanes no longer overlap: a step dragged up or down stays in its own role’s lane, and a new lane goes above the mock backend’s.
  • BetterCheckouts left on Mollie’s page show as not completed once Mollie expires them, instead of staying open.
  • BetterOn a phone or a narrow window the canvas fills the screen; the sidebar and the details open over it, and the top bar scrolls sideways.

Fixes from a full test of every feature

  • FixedEnvironments saved with the environment dialog work again in runs, load tests and audits, and opening the dialog no longer shows an empty page.
  • FixedAn upgrade can’t be paid twice while a bank payment is still on its way, and one that arrives after the plan already changed is refunded.
  • FixedA frontend on another address can call the mock directly from the browser (CORS).
  • FixedThe mock answers endpoints under an API’s own prefix (/lib/books, /shop/v2/pets), and roles that see only their own company keep finding their records after other flows are added.
  • FixedA GitHub token that GitHub rejects shows the error instead of signing you out.
  • NewLeave an organization from the Organization dialog. The last owner can’t leave; they hand over first or delete it.
  • NewA hidden getting-started checklist comes back with “Show getting started” in the account menu.
  • BetterDescriptions understand “cannot see …”, Dutch sentences such as “kan een bedrijf aanmaken”, and refused steps are recorded in the access policy so the mock refuses them too. Sentences that aren’t a journey no longer become roles, and parts that weren’t turned into steps are listed.
  • BetterWhen a prefix disappears from your API again, steps follow their endpoints back.
  • BetterDeleting an environment stops the monitors on it, instead of moving them to the mock; its runs still show they ran on a live environment.
  • BetterAt a plan limit, the message says how to get more room, the new-project dialog keeps what you typed, and monitor intervals your plan doesn’t include can’t be picked.
  • BetterPlans set by the people running Journey Lanes are confirmed first and announced to the organization’s owners by email.
  • BetterClearer messages when an API description can’t be fetched, a confirmation before removing a source or redrawing a flow, and the load test says which environment it runs against.

WordPress sign-in, self-hosted Bitbucket, and steps that follow their endpoints

  • NewSign in to WordPress through its login page, for sites where application passwords are off: Journey Lanes signs in like a person does and sends WordPress’s REST nonce with every request.
  • NewRepositories on your own Bitbucket Server or Data Center: paste the repository’s URL and add an HTTP access token.
  • BetterWhen a rescan or refresh puts your endpoints under a prefix (/rest/V1/products instead of /products), steps on the old paths move along, and you’re told how many.

Bring in an API without GitHub

  • NewAdd an OpenAPI or Swagger document (JSON or YAML) instead of code: by URL, or as a file. Endpoints, entities and how it signs in come from the document. “Refresh” in the sidebar fetches it again.
  • NewWordPress sites work by their REST index (https://your-site/wp-json/), and Magento shops by their schema (https://your-shop/rest/all/schema?services=all).
  • NewRepositories on GitLab (gitlab.com or your own) and Bitbucket, next to GitHub. Paste the repository’s address; a private one takes an access token of its own, stored encrypted.
  • BetterEndpoints from an OpenAPI document include its server path or base path (/v2/companies, not /companies), and endpoints the document marks as open to anyone are treated as public.

Sign in to Laravel, Django and other session apps

  • NewLive environments can sign in to apps that protect their login with a CSRF token, such as Laravel Sanctum and Django: Journey Lanes fetches the token first, sends it with the login, and sends it again on every write.
  • FixedA login that sets more than one cookie now keeps them all and sends them on every request, so apps that need a session cookie and another one no longer answer 401 after signing in.
  • NewNew presets with a short explanation each: Laravel Sanctum (SPA session), Django session, WordPress (application password) and Magento customer token.

Get started with a checklist

  • NewA new project now opens on a short checklist: connect your code or API, draw your first flow, run it against the mock, add your test environment, run it there, and turn on monitoring with an alert channel. Each step ticks itself off as you do it, and its button takes you straight there. Hide it whenever you like.
  • NewWhen a step calls an endpoint that isn’t in your connected code or API, such as one Journey Lanes made up because no code is connected yet, the step, the flow and the run say so. A pass on a made-up endpoint doesn’t test your real API, so you now see when that’s the case.
  • BetterMessages meant for the people who run Journey Lanes, like server settings, no longer show up in your screens.

Invitations you accept, and fixes from a full review

  • NewBeing added to an organization or project is now an invitation: you get an email and accept or decline it in the app. Until then the organization only sees the address it typed. Organization admins can re-send or withdraw open invitations.
  • BetterDescribing a flow without AI understands more: any role (“An accountant…”), steps that must be refused (“should not be able to delete”), “but”, and Dutch. What it can’t turn into a step is named, not dropped.
  • FixedRenaming a step or changing its path in the inspector now shows on the canvas straight away.
  • FixedLive runs: what the run history leaves out (cookies, personal data in replies) is also left out of the live view, and sign-in details no longer follow a redirect to another site.
  • BetterPlatform admins without a project of their own reach the installation menus from the first screen.
  • BetterAlert channels: at most 10 email addresses per channel and 10 test alerts an hour per project.

Request a flow

  • NewRather have us build your flows? Open the account menu → Request a flow, describe the journeys you want tested, and we send you a quote. An owner or admin of your organization accepts or declines it in the app, and you can follow the work there.

Limits on the mock backend

  • BetterA project’s mock holds up to 10,000 records of at most 64 KB each, and takes up to 600 requests a minute from one address. Your own runs, load tests and audits don’t count towards that limit.

Security and privacy: a penetration test, legal pages, and your own data

  • BetterWe had Journey Lanes penetration tested and fixed what was found, from access checks and isolation between organizations to payments and how requests to your environments are built.
  • NewThe site has a privacy policy, terms of service, a cookie policy and a data processing agreement.
  • NewDownload your account data, or delete your account, under the account menu → Your data.
  • BetterFonts now come from Journey Lanes itself, so visiting the site or the app no longer contacts Google.
  • BetterSign-in links in emails no longer put their code in the web address, and you stay signed in more safely: you’ll be asked to sign in once more after this release.

Pay a missed renewal from the app

  • NewWhen a renewal doesn’t go through, such as a declined card, Billing and invoices shows what’s due and until when, with “Pay now”. Pay with the same or another card or account; it then pays the next renewals too.
  • BetterYour plan keeps running for 7 days after a failed renewal. If it stays unpaid, the subscription ends and you’re told by email; everything stays readable.
  • FixedA payment that clears after cancelling, such as a bank debit, now still gives the upgrade or the period it paid for.

Checkout inside Journey Lanes

  • NewChoosing a plan opens a checkout in the app: what you pay today and after, your billing details, and how to pay. Card details are entered right there, in fields secured by Mollie.
  • NewUpgrade in one click with the card or account you already pay with.
  • BetteriDEAL and Bancontact are chosen in the app and take you straight to your bank, then back.

Billing details for customers anywhere, and a VAT check that waits for busy services

  • FixedSaving billing details no longer fails when a country’s VAT service is busy. The number is saved, checked again every hour, and VAT is reverse-charged from the next payment once it’s confirmed.
  • BetterBilling details work for customers anywhere: every country is in the list, and a tax ID from outside the EU is printed on invoices as you write it.
  • BetterAn EU VAT number can be entered without its country code; it’s added for you.

Billing and invoices, with payments through Mollie

  • NewOwners have a Billing and invoices page under Organization: the plan and how it’s paid, billing details, the payment method, and every invoice to download as PDF.
  • NewPay for a plan with iDEAL, a card or another method through Mollie, monthly or yearly. Every payment gets a VAT invoice by email.
  • NewBusinesses in another EU country can add their VAT number. It’s checked with the EU’s VIES, and their invoices have the VAT reverse-charged.
  • BetterUpgrades apply straight away: you pay the difference for the rest of the period. Downgrades and switching between monthly and yearly start at the next renewal.
  • BetterA cancelled subscription keeps its plan until the end of the period that was paid for, and can be resumed until then without paying again.

Truer scans of Elysia and Hono apps, and descriptions read more closely

  • NewA “Refused” check passes on 401, 403 or 404, however the app says no. Steps that should be refused use it, so the same flow passes against the mock and against a live app that hides what you may not see behind a 404.
  • FixedElysia routers with a prefix (new Elysia({ prefix: '/me' })), Hono base paths and route groups now scan at their real paths, such as /me/notifications instead of /notifications. Scan your repository again to pick it up.
  • BetterDescriptions: “sees the notifications and the communities” makes a step for each, “opens a community” opens one item instead of the list, “sees its occurrences” uses the endpoint under that item, and “searches” uses the search endpoint.
  • BetterHelp me finds the right route when two routers in a file declare the same path under different prefixes.
  • FixedOn an installation without a mail server, email alerts and their test now say they weren’t sent, instead of reporting them as emailed.
  • FixedA step about the item the flow just opened, such as its dates under another route, now uses that item instead of looking one up again from a list that may be empty.
  • FixedThe mock answers the signed-in user’s own routes, such as /me/notifications or /me/communities/:id/occurrences, with the records below them instead of “not found”.
  • FixedA plan agreed with us stays in place when Stripe delivers an old event late, or when a subscription that already ended is cancelled.
  • FixedThe status page no longer reports Monitoring as failing when an organization has more monitored flows than its plan covers.

Feedback from the app, and cases on the website

  • BetterRoles get lane colours from the Journey Lanes palette, starting with violet, sky and pink. They no longer look like the amber of a running step or the green of a passed one. Existing flows switch over too.
  • BetterThe app has the new logo, “Delete flow” moved next to the flow’s name, and long lists of mock collections are folded.
  • NewCases on the website: seven problems Journey Lanes catches, such as broken onboarding after a deploy or one company opening another’s orders, each set up step by step.
  • NewSend an idea, a request, a problem or a question from the account menu, with the project and flow you have open if you like. You see its status and the answer in the same place, and get the answer by email.

Flow Creator is now Journey Lanes

  • NewA new name and logo: Journey Lanes, after what it draws, a journey with a lane for every role. Your account, projects, flows and environments stay exactly as they were.
  • BetterNew domains are verified with a _journey-lanes TXT record or a journey-lanes-verification.txt file. Domains verified with the old Flow Creator names stay verified.
  • BetterDeploy checks report to GitHub as “Journey Lanes / <environment>”. If a branch rule requires the old “Flow Creator / …” status, choose the new one there.

Microservices, a mock database per flow, and new plans

  • NewNew plans: Personal (1 project, 1 person) at €9.99 a month, Team (3 projects, 5 people) at €49.99, Business (10 projects, 10 people) at €149.99, and Enterprise by agreement. Every plan can be paid yearly for ten months’ price.
  • NewA free month: every new organization has Personal for 30 days, no card needed.
  • NewMicroservices: give each repository its own address on an environment. Each step goes to the service whose code defines its endpoint, or to the one you pick on the step.
  • NewA mock database per flow: a flow can have its own mock data, apart from the project’s shared mock and other flows, at its own address.
  • NewStart fresh before every run, from data you keep as the flow’s starting data.
  • NewMock records in a table: view, add, edit and delete them per collection, and reset the data.
  • BetterLoad tests and audits on live environments check every service address is a verified domain.
  • NewRemove a role from a flow again: the bin next to it under Roles takes out its lane and reconnects the steps around it.
  • FixedAn organization moved to a plan by agreement no longer shows a free trial.

Help me, saved roles, and building flows by clicking

  • NewHelp me on a step: reads the code behind its endpoint and proposes a body that passes validation, the path keys, the pagination, filters and sorting it supports, and checks for the answer. Works with or without an Anthropic API key.
  • NewEndpoints menu in the sidebar: every scanned endpoint by collection, then GET, POST, PUT, PATCH and DELETE. A click adds it to the flow.
  • NewSaved roles: start a new flow with roles whose sign-in is already set up, or add one to an open flow. Test accounts apply as they are.
  • NewDuplicate a flow, and copy steps from one flow into another with ⌘C and ⌘V.
  • NewUndo and redo for every change to a flow.
  • NewRemove a step from the inspector; the steps around it are reconnected.
  • BetterClicking a step zooms in on it.
  • BetterA key such as :slug is filled from the list before it, or from what the flow just created.
  • BetterElysia, Express and Hono routes are read like Symfony ones: body and query schemas, statuses and errors.
  • BetterAPI Platform resources with a URI template on the resource scan at their real paths.
  • FixedBackspace no longer removes a step by accident.

Signing in through the login page, and flows that make their own data

  • NewA public website with product pages, pricing, log in and sign up.
  • NewLive environments can sign in through the identity provider’s login page (authorization code + PKCE), including Keycloakify themes and TOTP codes.
  • NewRun values ({{run.id}}, {{run.password}}) and references in request bodies, for names and accounts that are unique per run.
  • NewEmail steps read an email the app sent, such as an invitation, from a Mailpit or Mailtrap test inbox.
  • BetterThe mock answers “who am I” paths such as /auth/me with the signed-in user.
  • BetterSaving an environment shows what is wrong, and Enter saves it.
  • FixedA role called “Admin” no longer picks up super admin roles.
  • FixedThe run console no longer crashes on a live sign-in step.

Tours per role and frontend pages

  • NewTours: pick a role and get a flow of everything it may do, with checks that a few things it may not do are refused.
  • NewReact Router frontends are scanned: pages, their names, and the API calls each page makes.
  • BetterSymfony role hierarchies are followed, so a super admin inherits what an admin may do.

Organizations, plans and deploy checks

  • NewOrganizations with members and roles, holding the projects.
  • NewPlans and billing through Stripe, off unless an installation turns it on.
  • NewDeploy checks: call a hook from CI or Argo CD to run chosen flows after a deploy, with a GitHub commit status.
  • NewDomain verification before load tests and audits on live environments.
  • NewSymfony and API Platform scanning, with access rules and roles.
  • BetterRun history keeps only the shape of live replies unless you choose otherwise, with personal data masked.
  • BetterOnly public addresses are called from live environments.
  • BetterSeveral servers can run side by side.

First release

  • NewFlows from plain-language descriptions, with one lane per role, drawn from your repositories’ endpoints, records and roles.
  • NewA mock backend per project, with Keycloak-style tokens and data scoped per tenant.
  • NewRuns with step checks on status, response time and response fields.
  • NewLive environments with OAuth, login requests with two-factor codes, and static keys; saved sign-ins reused between runs.
  • NewMonitoring with alerts by email, Microsoft Teams, Slack and webhook.
  • NewLoad tests and access audits.
  • NewRun reports to download.

Try what’s new

Everything above is in Journey Lanes now.

Create an account See how it works