A single check within a run, such as "HTTP status is 2xx" or "Cache-Control: no-store is present". It records
the expected and actual values. A run passes only if every assertion passes.
Audience (aud)
The claim in a JWT that names who the token is for. Targets must refuse tokens addressed to someone else.
Credential
How a service account proves its identity: a client secret, or an OIDC
workload identity trust.
Environment
A named workspace inside a tenant that holds tests and their Test Log. See Environments.
Expected outcome
Whether a test expects the target to accept (success) or refuse (rejection) Helena's requests.
Rejection tests are how you check that a target refuses bad input.
Fingerprint
How secrets and tokens appear in the Test Log, e.g. [redacted 64 chars sha256:9c1e…]. It shows the length and a
hash prefix, so you can compare values without seeing them.
Issuer (iss)
The identity provider that signed a token. For OIDC WIF Client tests, each test has its own Helena-hosted
issuer at https://app.helena.dev/oidc/wif/{test-uuid}.
JWKS
JSON Web Key Set, the public keys an issuer publishes so others can verify its signatures.
kid
Key ID, the JWT header field that says which JWKS key signed the token.
An informational finding in a run, such as a minor specification deviation. Notes never fail a run.
Owner
The one member of a tenant who can manage billing, transfer ownership and delete the tenant.
Run
One execution of a test, triggered manually, by schedule or through the api. It ends passed, failed
or error.
Scope
A service account's permission level: read, write or admin.
Service account
A non-human identity used by pipelines and scripts to call the Helena API.
Specification checks
An option on every test that adds assertions for the specification's MUST-level details, beyond the core
behaviour.
Step
One action within a run, typically one HTTP request and its response.
STS
Security token service, a service that exchanges one credential (such as a workload's ID token) for another.
Subject (sub)
The claim in a JWT that identifies who the token is about. Trust policies usually match it exactly.
Target
The external system a test checks: your token endpoint, SCIM API or log API.
Tenant
Your organisation's account in Helena. It owns all members, environments, tests, service accounts and billing.
Test
A saved configuration that checks one target in one way. See Tests overview.
Test Log
The per-environment history of every run. See Test Logs.
Token variant
In OIDC WIF Client tests, a deliberate defect in the minted token (expired, wrong audience, forged signature, …)
used to check that the target refuses it.
Workload identity federation (WIF)
Letting a workload authenticate with an ID token from its own platform, such as GitHub Actions or Kubernetes,
instead of a stored secret.