Multi-tenant API integration workbench
UAT-Ops onboards customers onto real APIs. Every request in this trace actually left the building, carried credentials injected server-side, and landed in an audit log. The one that stopped, stopped because policy said so.
assertAutonomyAllowed() denied · operation class destructive is not delegated for this tenant. Waiting for an operator.
The constraint
There are no local API implementations here. Every provider is somebody else's live sandbox, so a stubbed response would be a lie about whether the integration works — which is the only question the tool exists to answer.
Holding that line has consequences. Real calls need real credentials, so credentials are decrypted and injected at the server boundary and never reach the browser. Real calls produce real evidence, so every execution is logged and failures open issues on their own. And once the assistant is allowed to make those calls unattended, "be careful" stops being a strategy — it needs a gate that the build itself can prove you went through.
The workbench
Drop in OpenAPI, a Postman collection, an Insomnia export, or plain markdown. The format is detected rather than declared. Parsing and committing are deliberately two steps, so you review the diff before anything is written.
Steps run in order, and each one can pull {{variables}} out of
any earlier response. When a step fails you decide whether the run stops
or carries on without it — per step, not per flow.
Requests, responses, timings and correlation IDs are recorded as they happen. A 4xx or 5xx opens an issue without anyone filing it. Raw bodies age out on a retention clock; the trail they leave behind does not.
Autonomy is off until a tenant admin turns it on, and what gets turned on is specific: which operation classes, which providers, what rate and budget, which hours. Anything outside that, the assistant asks instead of assuming. Pause takes effect at the next call, not the next deploy.
How it holds
Every tenant — including each reseller's own customers — is provisioned
into a dedicated Postgres schema. Isolation sits at the schema boundary,
so forgetting a WHERE clause cannot spill one tenant into
another. Routes resolve their database handle through a helper that throws
rather than quietly falling back to the shared schema.
schema tenant_<slug>
All autonomous execution funnels through a single gate. That isn't a convention people remember — a guard walks the require graph at build time and fails if any path from autonomous code reaches the executor without passing through it. Authority lives in the tenant's own schema too: a global policy file would let one admin change another tenant's limits.
gate assertAutonomyAllowed()
The browser never talks to a provider. It posts an intent, and the server
builds the request, decrypts and injects the right credentials, follows
redirects under SSRF checks, and returns what actually came back. Token
endpoints are the interesting exception — inject a stale bearer into
/oauth/token and the provider rejects it, so those are marked
to receive nothing.
route POST /api/execute
Scale
Tests are mutation-checked rather than trusted: a tool flips one token at a time in the source and reports anything the suite failed to notice. It exists because a vacuous test — one that passes whatever the code does — reviews exactly like a good one.