A backend before yours is ready, scoped like yours should be

Sign-in

• Keycloak-shaped OIDC: password and refresh-token grants, user info and discovery.
• Every role in your flows is a login, and tokens carry the role’s permissions and, for scoped roles, the records they may see.
• “Who am I” paths such as /me and /users/me answer with the signed-in user.

REST over your records

List, get, create, update and delete over generated records shaped by your entities, plus nested routes (/companies/:id/users) and assignments (POST /users/:id/products). A company admin only gets their own companies; anything outside the role’s scope answers 403.

GraphQL

Queries are answered at any path ending in /graphql, scoped like REST, with only the selected fields. Mutations named createX, updateX and deleteX run as the REST write they stand for, through the same handler, so scopes, record limits and deny rules apply exactly as to REST. Fragments, aliases, directives and variables are read; subscriptions aren’t answered.

gRPC

gRPC steps are answered over the mock’s records by method name: Get, List, Create, Update and Delete. A server-streaming List… or Watch… streams the records. Other methods, and methods that stream to the server, need a live environment.

The access policy

Decisions from the access audit, and what a role’s code refuses in a tour, become the project’s access policy. The mock enforces its deny rules, so it behaves like the backend you intend rather than the one you have.

Mock data per flow

A flow can have records of its own, apart from the project’s shared mock, optionally reset before every run. The current records can become the starting data a reset returns to, and every collection opens in a table to view, add, edit and delete records.

Limits and traffic

Records live in Postgres, so load tests against the mock exercise a real database. Anyone who knows a mock’s address can call it, so it is bounded: 10,000 records per mock, 64 KB per record and 600 requests a minute per address. All traffic streams to the mock traffic console in the project.