Skip to content

Helena

Helena is a hosted test harness for the integrations between your systems and the identity, authentication and security services they rely on. You point Helena at your system, the target, and it plays the other side of the integration. That might be a workload presenting a federated identity token, an OAuth client, an identity provider provisioning users over SCIM, or a SIEM polling your log API. Helena then checks that the target behaves the way the relevant specifications say it must.

Every check runs from Helena's infrastructure against your public endpoints. Every request, response and assertion is recorded in a Test Log you can read in the browser or fetch from your CI pipeline.

What you can test

Category Test Helena plays… It checks that your target…
Authentication OIDC WIF Client A workload and its OIDC identity provider accepts a valid federated ID token and refuses expired, mis-addressed or forged ones (Google Cloud STS, Entra, AWS STS, Keycloak, …)
Authentication Client Id/Secret An OAuth 2.0 client issues tokens via the client credentials grant as RFC 6749 requires, and refuses revoked clients
Identity SCIM Client An identity provider such as Okta or Entra ID implements SCIM 2.0 user and group provisioning correctly
SIEM REST API Poll A SIEM or log collector serves log events over a REST API with working time windows, pagination and authentication

Each test can expect the target to succeed or to refuse. Negative tests are first-class, because a security integration that accepts everything is the most dangerous kind of broken.

Core concepts

flowchart LR
    T[Tenant] --> M[Members]
    T --> E1[Environment: Development]
    T --> E2[Environment: Production]
    T --> SA[Service accounts]
    E1 --> TD[Tests]
    TD --> R[Runs]
    R --> L[(Test Log)]
    SA -. API .-> TD
Tenant
Your organisation's account. It owns everything else, including members, billing and audit history. See Tenants and members.
Environment
A named workspace inside the tenant, such as Development or Production. Tests belong to exactly one environment, and you work in one environment at a time. See Environments.
Test
A saved configuration that describes one check against one target. See Tests overview.
Run
One execution of a test. A run is started manually, on a schedule, or through the API, and it finishes as passed, failed or error.
Test Log
The per-environment history of every run, with its steps and assertions. See Test Logs.
Service account
A non-human identity that CI/CD pipelines use to call the Helena API. It authenticates with a client secret or, with no secret at all, through OIDC workload identity federation. See Service accounts.

How a run works

  1. You create a test in the active environment and fill in the target details and the result you expect.
  2. A run is triggered by Run now, by the test's schedule, or by a pipeline calling the API.
  3. Helena sends the requests to your target over public HTTPS, records each step, and evaluates its assertions.
  4. The run is written to the Test Log as passed (every assertion held), failed (an assertion did not hold) or error (the run could not complete, for example because the target was unreachable).

Secrets you give Helena (client secrets, bearer tokens, API keys) are encrypted at rest and never shown again. They appear in the Test Log only as fingerprints such as [redacted 40 chars sha256:3f9a…].

Where to go next