API workflows, finally under control.

One versioned source of truth for every request your team runs — tested in CI, debugged in production, and trusted by your agents.

The problem

API workflows are critical, but they're scattered.

They live in request collections, test scripts, QA docs, support runbooks, mocks, CI jobs, issue comments, and people's heads. Six tools, three workspaces, no source of truth.

Which workflow is current?

Versioned templates that import from the spec your service actually ships.

Which requirement is covered?

Acceptance criteria mapped to executable journeys, with coverage written back to the tracker.

Which runbook is safe to use?

Runbooks declare intent, inputs, safety class, and approved templates — for humans and agents.

Which mock reflects reality?

Mocks generated from real endpoints and templates, not hand-maintained copies.

Which config produced this failure?

Composable environment YAML resolved at runtime, captured with every run.

What's blocking release today?

One coverage dashboard. Failing, stale, unmapped — visible before merge, not after.

01 / Coverage

Prove what is covered before it ships.

Sync requirements from Jira, Linear, GitHub Issues, or Azure DevOps. Map acceptance criteria to the journeys, checks, and runbooks that validate them. Write summaries back to the tracker so product and engineering see the same number.

  • Acceptance criteria parsed from the issue body, not duplicated by hand.
  • Coverage states: valid, partial, invalid, and missing.
  • Write-back keeps PMs out of the test runner.

REQ-2418 / Idempotent retries

Jira

Covered

11/13

Failing

1

Unmapped

2

Stale

0

AC-01

Duplicate POST returns original charge id

Valid

AC-04

Idempotency key required for mutating calls

Valid

AC-07

Concurrent retries collapse to a single side effect

Failing

AC-09

Key TTL is honored at 24h

Unmapped

AC-12

Replay after key expiry creates a new charge

Valid

Debug run / charge.retry

env: staging / branch: idempotency-spike / 1.4s

Failed
+000POST/v1/customers201 / 86ms
+086POST/v1/payment_methods/attach200 / 142ms
+228POST/v1/charges (retry #2)409 / 318ms
assertionexpect.statusCode === 200 / received 409idempotency_key9c1f2d...retry / reused after 250ms backofflinked ACREQ-2418 / AC-07

02 / Debug

Find the failure with the whole workflow attached.

Debug mode captures the scenario, inputs, environment, variables, requests, responses, timings, assertions, scripts, and AI step outputs. Failures stop being screenshots in Slack and start being evidence.

03 / Runbooks for humans and agents

Workflows AI can run, the same way a human would.

Reqflo runbooks declare intent, required inputs, preconditions, safety boundaries, expected outputs, and the request templates that execute them.

Refund a stuck charge

support / mutating / requires approval

intent
Refund a charge stuck in pending_capture after gateway timeout.
inputs
charge_id, operator, optional reason_code
safety
Mutating / requires approval if amount is greater than $500.
1Verify charge statecharges.retrieve / expect status = pending_capture
2Confirm with operatorcheckpoint / require human approval
3Issue refundrefunds.create / amount = charge.amount
4Log to incident channelintegrations.slack.post / ops-incidents

04 / Composable runtime

Bring your real environment model. Mock from real endpoints.

Config and mocks are where workflow tools lose teams. Reqflo keeps both source-controlled and composable, so your test environment is your real environment.

Environments

Composable YAML, resolved at runtime.

Import shared modules, overlay branch variants, and keep config in the repo where reviews already happen.

name: staging.payments
extends:
  - ../shared/base.yml
  - ../shared/observability.yml

overlays:
  - when: scenario.retries
    load: ./retries.overlay.yml

vars:
  base_url: "https://staging.api.acme.dev"
  api_key: !secret vault://payments/staging#api_key

Mocks

Mock from the workflows you already trust.

Turn endpoints and templates into mocks for local dev, demos, QA, and third-party dependency testing.

POST

/v1/charges

200 / seeded from charges.golden.json

42ms
POST

/v1/charges

402 / scenario: card_declined

38ms
GET

/v1/charges/{id}

200 / resolved from db.connector

12ms
GET

/v1/balance

200 / static fixture

3ms

05 / Built into execution

Sharable workflows, without sharing the keys.

Reqflo classifies workflows by safety, resolves secrets at runtime, and writes every execution to an audit trail. Sharing a journey does not share what runs it.

Runtime secret resolution

Secrets stay secret. Values are resolved by the runner and never returned by the UI.

Read-only by default

Workflows declare their safety class. Mutating runs and production targets gate behind explicit roles and approvals.

Audit history

See who launched each cloud run, what context it used, and which protected resources were involved.

Workflow-level signals

Emit pass/fail results, assertion failures, environment readiness, and release validation status — not just raw API latency.

Stop rebuilding the same API workflow across six tools.

Reqflo is in private preview with engineering, platform, QA, and support teams shipping API-heavy products.