security/oauth2

Step	Summary
security/oauth2/client_credentials	Obtain a token as the client itself — the machine-to-machine grant.
security/oauth2/password	Obtain a token on behalf of a resource owner by username and password.
security/oauth2/refresh_token	Exchange a refresh token for a fresh access token.

security/oauth2/client_credentials

Obtain a token as the client itself — the machine-to-machine grant.

The token request with the client_credentials grant pinned: the client id and secret are the whole credential, no resource owner is involved.

Inputs

Parameter	Type	Required	Default	Also accepts	Description
headers	object	no	{}	—	Extra HTTP headers merged into the request.
timeout	number	no	None	—	Request timeout in seconds; the test's default is used when omitted.
token_url	string	yes	—	—	Token endpoint URL of the authorization server, e.g. 'https://idp.example/realms/CX/protocol/openid-connect/token'.
client_id	string	no	''	—	OAuth2 client identifier.
client_secret	string	no	''	—	OAuth2 client secret; omit for a public client.
client_auth	post | basic	no	'post'	—	How the client authenticates: 'post' sends client_id/client_secret as form fields, 'basic' sends them in an HTTP Basic Authorization header.
scope	string	no	''	—	Space-separated scopes to request; omitted from the request when empty.
extra_fields	object	no	{}	—	Additional form fields merged into the token request, e.g. 'audience' or 'resource'.

Output — the value assertions and returns: read

A token endpoint's response, per RFC 6749 §5.1.

Field	Type	Description
access_token	string	The bearer token to present to protected services.
token_type	string	Type of the issued token, normally 'Bearer'.
expires_in	integer	Lifetime of the access token in seconds.
scope	string	Scopes the server actually granted.
refresh_token	string	Refresh token, when the server issues one.

Additional keys sent by the counterpart are passed through unchanged.

security/oauth2/password

Obtain a token on behalf of a resource owner by username and password.

The token request with the password grant pinned; username and password are required inputs.

Inputs

Parameter	Type	Required	Default	Also accepts	Description
headers	object	no	{}	—	Extra HTTP headers merged into the request.
timeout	number	no	None	—	Request timeout in seconds; the test's default is used when omitted.
token_url	string	yes	—	—	Token endpoint URL of the authorization server, e.g. 'https://idp.example/realms/CX/protocol/openid-connect/token'.
client_id	string	no	''	—	OAuth2 client identifier.
client_secret	string	no	''	—	OAuth2 client secret; omit for a public client.
client_auth	post | basic	no	'post'	—	How the client authenticates: 'post' sends client_id/client_secret as form fields, 'basic' sends them in an HTTP Basic Authorization header.
scope	string	no	''	—	Space-separated scopes to request; omitted from the request when empty.
extra_fields	object	no	{}	—	Additional form fields merged into the token request, e.g. 'audience' or 'resource'.
username	string	yes	—	—	Resource-owner username.
password	string	yes	—	—	Resource-owner password.

Output — the value assertions and returns: read

A token endpoint's response, per RFC 6749 §5.1.

Field	Type	Description
access_token	string	The bearer token to present to protected services.
token_type	string	Type of the issued token, normally 'Bearer'.
expires_in	integer	Lifetime of the access token in seconds.
scope	string	Scopes the server actually granted.
refresh_token	string	Refresh token, when the server issues one.

Additional keys sent by the counterpart are passed through unchanged.

security/oauth2/refresh_token

Exchange a refresh token for a fresh access token.

The token request with the refresh_token grant pinned; refresh_token is a required input.

Inputs

Parameter	Type	Required	Default	Also accepts	Description
headers	object	no	{}	—	Extra HTTP headers merged into the request.
timeout	number	no	None	—	Request timeout in seconds; the test's default is used when omitted.
token_url	string	yes	—	—	Token endpoint URL of the authorization server, e.g. 'https://idp.example/realms/CX/protocol/openid-connect/token'.
client_id	string	no	''	—	OAuth2 client identifier.
client_secret	string	no	''	—	OAuth2 client secret; omit for a public client.
client_auth	post | basic	no	'post'	—	How the client authenticates: 'post' sends client_id/client_secret as form fields, 'basic' sends them in an HTTP Basic Authorization header.
scope	string	no	''	—	Space-separated scopes to request; omitted from the request when empty.
extra_fields	object	no	{}	—	Additional form fields merged into the token request, e.g. 'audience' or 'resource'.
refresh_token	string	yes	—	—	Refresh token to exchange for a fresh access token.

Output — the value assertions and returns: read

A token endpoint's response, per RFC 6749 §5.1.

Field	Type	Description
access_token	string	The bearer token to present to protected services.
token_type	string	Type of the issued token, normally 'Bearer'.
expires_in	integer	Lifetime of the access token in seconds.
scope	string	Scopes the server actually granted.
refresh_token	string	Refresh token, when the server issues one.

Additional keys sent by the counterpart are passed through unchanged.