Home/Field Guide/Practice & reference
LAB 02
Exercise the generated API
Obtain an access token, create a record, and verify the response as two identities.
Before you begin
Complete Lab 01. Use Bash with curl and a test OAuth application on a disposable Liferay instance. Use TLS for a remote instance. Register a confidential app with the supported client-credentials flow and configure the minimum app scopes and effective identity permissions needed by your target for the test. Enter credentials privately and place the returned token in a shell variable without exposing it in shell history.
1. Request a token
Set BASE to your server origin, such as http://localhost:8080 for a local lab. Inspect your OAuth configuration first. This example prompts for the client secret through curl’s HTTP authentication prompt.
curl --fail-with-body --request POST "$BASE/o/oauth2/token" \
--user "$CLIENT_ID" \
--data-urlencode "grant_type=client_credentials"
Set ACCESS_TOKEN to the returned access_token. Treat the response as a secret. Use the client authentication method configured by the server.
2. Create and retrieve the entry
Set COLLECTION to the path from API Explorer, including its leading slash, for example /o/c/partnerrequests. Execute the request once and note the returned entry id.
curl --fail-with-body --request POST "$BASE$COLLECTION" \
--header "Authorization: Bearer $ACCESS_TOKEN" \
--header "Content-Type: application/json" \
--data '{"summary":"Replace damaged scanner","details":"Scanner 04 stops after startup","externalReferenceCode":"LAB-REQ-1042"}'
Read the entry using the generated GET-by-ID endpoint. Try the ERC endpoint if your build exposes it. Then use an otherwise valid identity with no entry access and confirm that the read is blocked or the resource is concealed by the target. A successful token exchange alone does not prove authorization.
3. Inspect an expected failure
Try a create with the required summary omitted. Record the exact status and response for your build. For a 403 on the permitted case, inspect the scope, effective identity, and resource permission separately. Retain the contract evidence with the build number, clear the token from your shell, and remove the test application when done.