Mock Providers

Mock providers allow you to quickly test integrations and build proof-of-concepts without needing access to real security tool services or environments. They're perfect for creating proof-of-concepts, CI/CD pipelines, and customer demonstrations.

Mock providers are simulated versions of real security tool integrations that return realistic sample data. They use the exact same Synqly APIs and endpoints as production providers, making it seamless to switch between mock and real providers.

• Dataset size: Limited to 50 total records per mock provider
• Operations: Currently supports query/get operations only
• Data persistence: Create operations don't persist data

Mock providers use curated datasets pulled from real provider data, ensuring realistic responses for testing and development. Each mock provider includes a dataset version (currently basic_v0 for most providers).

Mock providers support the same filtering capabilities as their real counterparts.

Supported filters and operators are defined for each provider in the Synqly Documention connector guides. Here is an example of a filter and supported field guide:

• Assets Query Filters
• Assets Supported Fields

For general filtering syntax, see the Management API Filtering Guide.

• Mock providers are only available in test mode
• Test mode resources are isolated from production
• In the UI: Use the test mode toggle
• In the API: Set environment: "test" when creating accounts

Mock providers enable customers to quickly engage in proof-of-concepts and can be integrated into CI/CD automated testing pipelines without requiring access to real security tool accounts.

• Maximum of 50 total records per mock dataset
• Only query/get operations are supported (create operations don't persist data)

• UI: Use the test mode toggle switch
• API: Set environment: "test" when creating accounts

No, mock providers are only available in test mode/test environment to ensure proper separation from production data.

Some mock providers (currently cloud security and vulnerabilities) rewrite event timestamps so they fall within the time range you query. If your request includes GTE/LTE bounds on the timestamp field, returned events are spread across that range; otherwise, they fall within a rolling current-time window. Mocks that don't opt into this behavior still return the static timestamps baked into their fixtures.

Available mock providers are documented at Synqly Connector Guides.

Mock providers use the same Synqly APIs and endpoints as real providers. The only difference is the provider configuration, which specifies a mock provider type and dataset version (e.g., basic_v0).