API request

Runs an HTTP request right inside the scenario — e.g. to log in via API, hit the backend, or prepare data. The request goes through the test browser, so cookies and the session are shared: an API login is visible to the page and vice versa. It spends no AI tokens/money.
The parameter is JSON with fields:

• method — GET/POST/PUT/PATCH/DELETE;
• url — address (http/https only; internal/private IPs are blocked);
• headers — headers (object);
• body — request body (an object is sent as JSON; for forms add the header Content-Type: application/x-www-form-urlencoded);
• save — what to extract from the response into a slot: {"slot_1":"body.access_token"}. Paths: status, text, body.field, body.items[0].id, headers.Name;
• assert — response checks: {"path":"status","op":"=","value":"200"}. Operators: = != > < >= <= IN "NOT IN" LIKE. If a check fails, the test fails.

Reusing a token: save it to a slot (save), then in later steps write rmb:slot_1 — the worker substitutes the value. For example, in the same step under headers: {"Authorization":"Bearer rmb:slot_1"}, or hand the token to the browser with the “Set headers” step (Authorization: Bearer rmb:slot_1). See the detailed case study on authorizing and fetching a list via API.

Run an HTTP request right inside the scenario. The request goes through the test browser — cookies and the session are shared with the regular steps. The parameter is JSON. The step spends no AI tokens/money.

Simple GET with a response check:

{
  "method": "GET",
  "url": "https://api.site.com/health",
  "assert": [ { "path": "status", "op": "=", "value": "200" } ]
}

POST with a body (an object body is sent as JSON):

{
  "method": "POST",
  "url": "https://api.site.com/login",
  "headers": { "Content-Type": "application/json" },
  "body": { "login": "user@site.com", "password": "secret" },
  "save": { "slot_1": "body.access_token" },
  "assert": [ { "path": "status", "op": "=", "value": "200" } ]
}

JSON fields:

• method — GET / POST / PUT / PATCH / DELETE.
• url — http/https only. Internal/private IPs are blocked.
• headers — headers (object).
• body — body. An object is sent as JSON. For forms add the header Content-Type: application/x-www-form-urlencoded.
• save — what to extract from the response into a slot. Path: status, text, body.field, body.items[0].id, headers.Name.
• assert — checks. Operators: = != > < >= <= IN "NOT IN" LIKE. Any failing check → the test fails.

Reusing a value from the response (token, id): save it into a slot via save → in any later step write rmb:slot_1 and the worker substitutes the value. For example, hand the token to the browser:

1. API request — POST /login, save: slot_1 = body.access_token
2. Set HTTP headers — Authorization: Bearer rmb:slot_1
3. Go to page — open a page behind authorization

Or reuse the token within the API itself — in a second request:

{
  "method": "GET",
  "url": "https://api.site.com/objects?limit=50",
  "headers": { "Authorization": "Bearer rmb:slot_1" },
  "save": { "slot_2": "body.items[0].id" },
  "assert": [ { "path": "status", "op": "=", "value": "200" } ]
}