Automation Script

When you get an access token, ReadyAPI displays the login, consent, and other screens. Each screen is a page that you interact with to grant permissions on behalf of the resource owner. You can create automation scripts in ReadyAPI to simulate the needed actions and grant permissions in unattended mode.

How to create automation scripts

Create automation scripts in the Automation editor that you can open either in the Auth Manager or in the Auth panel:

Auth Manager

  1. Open the Auth Manager.

  2. In the Auth Manager dialog, select the OAuth 2.0 profile for which you want to enable automation.

  3. Open the Automation scripts tab.

Auth Panel

  1. Open a request.

  2. Open the Auth panel.

  3. From the Authorization dropdown, select the OAuth 2.0 profile and click Get Access Token.

  4. In the Get access token from the authorization server dialog, click Automation.

In general, an automation script creation consists of the following steps:

  1. Inspect a web page (a screen).

  2. Create an automation script to emulate user actions on this page.

  3. Repeat these steps for all the pages involved in the process.

Inspect web pages

Use developer tools in any external browser to inspect the web pages involved in the authorization process and identify the objects to interact with.

Create automation scripts

In the Automation editor, specify JavaScript commands that simulate the actions needed for granting permission - entering the login and password, clicking the needed buttons, and so on. For example, to simulate getting an access token from the authorization page, use the following commands:

JavaScript
document.getElementById("UserName").value = "john_smith";
document.getElementById("IPRUserPwd").value = "password";
document.getElementById("btnSubmit").click();

How automation works

The Automation editor runs automation scripts in a background instance of the internal browser. For each screen, you create a separate script in the Automation editor. When you get an access token, ReadyAPI displays the screens in the internal browser and runs scripts one by one. The URL change signals ReadyAPI to run the next script.

For example, an entering-valid-credentials page may have a second page on which the authorization server asks whether you grant permission to the client application. The automation script in this case may look like this:

The Auth Manager dialog in ReadyAPI showing the Automation scripts tab with two script pages: Page 1 containing a login screen script that sets the username to john_smith, enters a password, and clicks the submit button, and Page 2 containing a consent sc

Important

Background redirects may cause the rest of the next script to run while the page has not yet changed. An authorization server may change the authorization process by adding or skipping pages. When you get an access token for the first time, ReadyAPI asks you to log in, while the next time it remembers your account and asks only for a password. We recommend adding a log-in script to your script to ensure the script runs on the correct page. ReadyAPI does not detect which page is currently shown.

Automation samples

Follow these links to see the examples of how to configure automation:

Forced token update

By default, ReadyAPI requests a new token only when the old one expires. You can also use scripts to force ReadyAPI to update the token, whether or not it has expired.

To do this, you can use the requestAccessCode method of the OltuOAuth2ClientFacade class that assigns a new access token to the specified authorization profile. See the following script as an example:

Groovy
// Import the required classesimport com.eviware.soapui.impl.rest.actions.oauth.OltuOAuth2ClientFacade;
import com.eviware.soapui.support.editor.inspectors.auth.TokenType;
import com.eviware.soapui.model.support.ModelSupport;

// Get a projectdef project = ModelSupport.getModelItemProject(context.getModelItem());

// Get the needed authorization profiledef authProfile = project.getAuthRepository().getEntry("Ora Bannet");

//Create a facade objectdef tokenType = TokenType.ACCESS;
def oAuthFacade = new OltuOAuth2ClientFacade(tokenType);

// Request an access token in headless mode and assign it to the authorization profile we got earlier
oAuthFacade.requestAccessToken(authProfile, true, true);

// Access token retrieval may take time, so we need to pause the execution for 3 seconds to finish it. You may increase this value if needed.
sleep(3000);

// Posts a new token to the script log
log.info("Set new token: " + authProfile.getAccessToken());

Important

If you are using OAuth 2.0 Azure authorization, replace the OltuOAuth2ClientFacade class in the script with the OltuOAuth2AzureClientFacade class.

On headless machines

On headless machines where the browser window is inaccessible, you can use the same approach as described above. However, there are some things you must do first:

  1. Install and run any X Server.

  2. Specify the display number for your X Server (see your X Server's documentation).

  3. Open the testrunner.sh file in a text editor and add the following line:

    export DISPLAY=<ip>:<index>

    ip

    The IP address of the X Server.

    index

    The display number you have specified.

Troubleshooting

Retrieval process exceeds timeout

The default timeout for accessing a new access token is 5 seconds. Usually, it is enough to get a new access token. If your retrieval process takes more time, the automation fails, and the ReadyAPI log contains the following messages:

WARN: OAuth2 access token retrieval timed out after 5000 ms.
ERROR: Exception in request: java.lang.RuntimeException: Unable to refresh expired access token.

To increase the timeout, use the oauth2.access.token.retrieval.timeout JVM option. See Modifying JVM Settings to learn how to do it.

Browser Error

The browser displays all the errors returned by the authorization server.

Validation Error

If a script cannot be validated for some reason, you will get an error message.

See Also

In this section:
© 2026
Publication date: