Choose how external services behave in a test
Mock payments, capture messages, or use a sandbox. A policy for each host lets your application run complete flows inside a controlled environment.
Your application still calls its integrations in a test environment. A signup sends email, a subscription flow calls a payment API, and a background worker posts a webhook.
Each integration needs an intentional response. Antifailure lets you set a policy per host, so one run can capture email, simulate payments, and block unknown destinations.
Seven modes for different jobs
- BLOCK. Refuse the request and record the gateway decision. This is the default for unlisted hosts.
- ALLOW. Permit explicitly configured calls with a rate limit.
- SANDBOX. Use test credentials and reject a live key detected on the way out.
- CAPTURE. Store email or SMS in a searchable test inbox. An agent can retrieve a magic link and complete a sign-in flow.
- MOCK. Return configured responses. The built-in Stripe pack maintains state across supported payment and subscription flows.
- EMULATE. Route calls to a service such as LocalStack or Azurite running inside the environment, without changing the application's endpoint.
- SYNTH. Generate a response with a model. Checks that depend on a synthesized response remain unverified.
Use stateful mocks for a complete flow
A single response fixture is useful for testing one API call. A subscription lifecycle needs more: creating, changing, renewing, and cancelling must affect what later requests return.
The Stripe pack supports checkout, subscriptions, renewals, and cancellations with signed webhooks. This lets a test exercise the application code that handles those events without reaching a live payment processor.
Keep the policy at the network boundary
The running application shares a network namespace with a gateway sidecar. Outbound traffic must pass through the gateway, including calls from libraries that ignore proxy environment variables.
When a new integration introduces an unlisted host, the gateway blocks the request. Configure the appropriate mode before testing that flow again. A denied request is recorded; it does not by itself mean every check in the run failed.
Inspect what happened
Use the gateway log to see which requests were allowed, captured, mocked, or refused. Direct connections stopped by network isolation never reach the gateway and do not appear as gateway log entries.
Read the egress policy guide for configuration and examples.