Sources and scanning
Read the API you have, in the form you have it
Journey Lanes builds a catalog of endpoints, records, roles and pages from source. It reads files; it adds nothing to your repositories, and it keeps what it found, not the files.
Code hosts
An organization’s owners and admins connect a code host once, under Organization → Code hosts; everyone who adds code to its projects then picks a repository from a list. Each code host is available where the installation has registered its app.
- GitHub is a GitHub App with read-only access to contents and metadata. Your organization installs it on its GitHub account and chooses the repositories there. Journey Lanes keeps the installation id, never a token: each read uses an installation token that GitHub expires within an hour. An installation is only accepted after the person who connects it signs in with GitHub and it turns out to be one their account can see.
- GitLab.com (OAuth with PKCE, scopes
read_repositoryandread_api) and Bitbucket Cloud (OAuth, read-only) keep their tokens AES-GCM encrypted and renew them when they expire. - A token instead: paste
owner/nameor the repository’s URL with a GitHub fine-grained token (contents: read), a GitLab access token, or a Bitbucket repository access token. This is also how self-managed GitLab and Bitbucket Server or Data Center are read. - Disconnecting deletes the connection; GitLab’s token is revoked there. Repositories added from it stay, without access.
What the scanners read
| Kind | Read from |
|---|---|
| Endpoints | OpenAPI and Swagger; GraphQL schemas; gRPC .proto files; route code in Express, Elysia, Hono, Fastify, NestJS (with global prefixes and URI versioning), Next.js route handlers, Symfony and API Platform, Laravel (resources, groups and the /api prefix), FastAPI, Django and Django REST framework routers, Rails, Spring Boot (Java and Kotlin), ASP.NET Core (controllers and minimal APIs) and Go routers (gin, echo, fiber, chi, gorilla/mux, net/http patterns) |
| Records | Prisma, Doctrine, Eloquent, TypeScript interfaces, OpenAPI and GraphQL schemas, Django models, Rails db/schema.rb, JPA entities, C# model classes, Go structs with json tags, protobuf messages |
| Roles and sign-in | Keycloak realm and client settings and realm exports; role checks such as IsGranted, hasRole, @Roles, @PreAuthorize, @Secured, @RolesAllowed and [Authorize(Roles = …)]; Laravel role middleware; Symfony role hierarchies |
| Validation | Symfony and API Platform constraints, Elysia and zod schemas, class-validator DTOs |
| Pages | React Router, Vue Router, Angular and Next.js, each page with the API calls it makes (fetch, axios and similar clients, SWR, Angular’s HttpClient) |
Stacks are read from source with patterns, not with a parser per language, so nothing needs to build or run. A frontend and its API can be separate repositories in one project; a page’s call finds its endpoint even when parameter names differ or the frontend leaves out a prefix its HTTP client adds.
OpenAPI, GraphQL and gRPC
- OpenAPI 3.0 and 3.1, Swagger 2.0, in JSON or YAML, from a URL (up to 8 MB, optionally with a bearer token) or uploaded (up to 3 MB). Documents split over files are put back together: a
$refto another file is resolved like a URL, fetched from the document’s own origin only. OpenAPI 3.1’stype: ["string", "null"]reads as the type it allows. Paths get the document’s prefix (basePath, or the first server’s path), andsecuritySchemessuggest the sign-in. - GraphQL schemas in
.graphqlfiles orgqlstrings: every query and mutation is an endpoint of its own, with a ready query document and its variables. - gRPC from
.protofiles, resolved across files the way protoc does, or from a running server through reflection (grpc://orgrpcs://), for services whose .proto files aren’t in a repository you scan. Every rpc is an endpoint, with its streaming kind. - A WordPress REST index (
/wp-json/) is converted into endpoints as well.
Services and branches
A project can hold one repository per service, and the same repository once per branch, so an environment’s services can point at the branch deployed there. Each service on an environment gets its own address, and a step goes to the service whose code defines its endpoint.
API changes
Every source that can be read again is scanned once a day and compared with the scan before: endpoints added and removed, and the steps that called an endpoint that is now gone. An endpoint that only moved under a new prefix counts as neither, and steps on it follow it.
Changes are kept for 180 days and show in the project until someone marks them as seen. When steps of monitored flows lost their endpoint, the alert channels get one alert for that change. Owners can switch the daily scan off.
What is kept
From a repository, Journey Lanes keeps what it found (endpoints, records, roles, pages), not the files. “Help me” and “Explain this failure” read the code behind one endpoint from the code host when you use them. An OpenAPI document you upload or point at is stored, so it can be read again and refreshed.
Steps whose endpoint isn’t in any scanned source are named in the inspector and the run console, so a flow can’t quietly pass against made-up endpoints.
Start from the code you have
Connect a repository or add an OpenAPI document; the catalog and the mock backend are ready when the scan is.