Monitoring OAuth 2.0-based APIs

The main goal of the first Get Token Task is to get an access token for the application to access the Service API. If successful, the access token can be retrieved from the Service API response and used in the subsequent API requests. Moreover, the task verifies exchanging an application authorization code for the access token. In the case of errors, the alert will be generated for the device.

To create a device, click New Device on the Device Manager page and select the HTTP/S Task.

URL

To set up the task, we need to generate the access token request to the Authorization Server. In the URL field, specify the URL of the API Authorization Server in the following format https://authorization-server.com/oauth/authorize. The exact URL depends on the service to which you are connecting.

SSL/Certificate Check

Enable SSL Certificate Checks.

Request Type and Post Data

The client authentication parameters (client id and client secret), redirect URI, and authorization code must be provided in the request to the Authorization Server. Let’s use POST method (the Request Type field) to send application details and code.

In the Post Data field, we need to specify the following request body attributes:

• client_id – your application identifier, issued upon your application’s first registration at the Authorization Server.
• client_secret– issued upon your application’s first registration at the Authorization Server.
• code – the authorization code received from the Authorization Server.
• grant_type – must be set to “authorization_code“.
• redirect_uri – the URL must match the redirect URL that you have previously registered with the application.

As a result of the task execution, we will receive a JSON response with the access token from the Authorization Server in the response body.

Content validation

To ensure that the server response returns access token and refresh token (is used if the access token expires), specify the following keywords:

• access_token
• refresh_token

To set up other task fields, if necessary, see Add/Edit an HTTP(S) Task.

Once setup has been finished, click Create Device and proceed with the next step to implement an API call using the access token.

When the API response with the access token is received as a result of the Get Token Task execution, we need to extract the token to call the Service API. For example, we want to retrieve the monitored service’s user list by requesting a /users endpoint.

First, create a script to extract the token from the Get Token Task response body to a variable. For example, the following script passes the token and token type from the basic authorization response into the TokenAuthorization variable:

string access_token;
string token_type;
string TokenAuthorization;

// get the authorization response from the first task
string json = (Tasks["Get Token"] as Http).body["//*"];

//convert response to the comma separated strings
string[] comas = json.Split(new Char[] { ',' });

// get the access token
int start1 = comas[0].IndexOf(":") + 2;
int length1 = comas[0].Length - start1 - 1;
access_token = comas[0].Substring(start1, length1); 

// get the token type
int start2 = comas[1].IndexOf(":") + 2;
int length2 = comas[1].Length - start2 - 1;
token_type = comas[1].Substring(start2, length2);

// set the TokenAuthorization variable to specify in the data request header 
TokenAuthorization = token_type + " " + access_token;

To add a new task to the API monitoring device configured at the first step:

1. On the Device Manager page, click the action button  in the device row.
2. On the action menu,  select Add Task.

URL

In the URL field, specify request URI of your service resource you need to extract data from.

SSL/Certificate Check

Enable SSL Certificate Checks.

Request Type

Select the GET request type.

OAuth 2.0 requires an access token and token type to be passed in the Authorization header of the HTTP GET request, but you can also provide it as a GET query string or POST body parameter.

Headers

Add header with the Authorization header name and the TokenAuthorization value. To convert the TokenAuthorization variable to dynamic, click the gear icon in the value field, and in the Edit Value dialog, select Dynamic.

The Dynamic value field will be marked with the brackets.

Prepare Script

Add the script to pass in the access token.

Content validation

To verify the data returned with the service response, you may also specify corresponding keywords. For example, several usernames you expected to retrieve from the service.

To set up other task fields, see Add/Edit an HTTP(S) Task.