Scripts

Scripts & Assertions

Pre-Request Scripts (< {% %})

Run before the HTTP request is sent. Used to compute variables, log, or perform side effects.

Syntax

Single-line:

< {% request.variables.set("ts", tostring(os.time())) %}

Multi-line:

< {%
  local token = "Bearer " .. request.variables.get("auth_token")
  request.variables.set("auth_header", token)
  client.log("Set auth header")
%}

External file:

< ./scripts/preprocess.lua

Script Sandbox API

Object	API	Description
request.variables	.set(name, value)	Inject @name = value into request
request.variables	.get(name)	Read request-level variable value
request.headers	.set(name, value)	Set request header
request.headers	.get(name)	Get request header
request.body	(string)	Request body content
client.global	.set(name, value)	Persist variable across requests
client.global	.get(name)	Read persisted variable
client.log	(msg)	Log message (visible in Script tab)
env	(name)	Read environment variable
variables	(name)	Read resolved variable
md5	.sum(str)	Compute MD5 hash

Example: Compute HMAC-style signature

< {%
  local ts = tostring(os.time())
  request.variables.set("timestamp", ts)
  local sig = md5.sum("secret-key-" .. ts)
  request.variables.set("signature", sig)
%}
POST https://api.example.com/data
X-Timestamp: {{timestamp}}
X-Signature: {{signature}}

{"key": "value"}

Example: Chain multiple variables

< {%
  local name = request.variables.get("username")
  request.variables.set("greeting", "Hello, " .. name .. "!")
  request.headers.set("X-Greeting", "Hello, " .. name .. "!")
  client.log("Processing user: " .. name)
%}

Post-Request Assertions (> {% %})

Run after the HTTP response is received. Used to validate response status, body, headers.

Syntax

Single-line:

> {% client.test("ok", function() client.assert(response.status == 200) end) %}

Multi-line:

> {%
  client.test("Status is 200", function()
    client.assert(response.status == 200, "Expected 200, got " .. response.status)
  end)
  client.test("Has data", function()
    client.assert(#response.body > 0, "Body is empty")
  end)
%}

External file:

> ./scripts/verify.lua

Assertion Sandbox API

Object	API	Description
response	.status	HTTP status code (number)
response	.body	Response body (string or table for JSON)
response	.headers	Response headers (table)
response	.content_type	Content-Type header value
response	.latency_ms	Response time in milliseconds
response	.url	Final URL after redirects
client	.test(name, fn)	Register a named test
client	.assert(cond, msg)	Assert condition (throws on failure)
client	.log(msg)	Log message
client.global	.set(name, value)	Persist variable across requests
client.global	.get(name)	Read persisted variable
request.variables	.get(name)	Read request variable
env	(name)	Read environment variable
variables	(name)	Read resolved variable
md5	.sum(str)	Compute MD5 hash
assert	(cond, msg)	Standard Lua assert

Example: Validate JSON response

POST https://api.example.com/users
Content-Type: application/json

{"name": "Alice", "email": "alice@example.com"}

> {%
  client.test("Created", function()
    client.assert(response.status == 201, "Expected 201")
  end)
  client.test("Has ID", function()
    client.assert(response.body.id ~= nil, "Missing id field")
  end)
  client.test("Email matches", function()
    client.assert(response.body.email == "alice@example.com", "Email mismatch")
  end)
  client.log("User created with ID: " .. response.body.id)
%}

Example: Chain from response

> {%
  client.test("Auth success", function()
    client.assert(response.status == 200, "Auth failed")
  end)
  if response.status == 200 then
    client.global.set("token", response.body.access_token)
    client.global.set("refresh", response.body.refresh_token)
  end
%}

Results Display

Assertion results appear in the Assertions tab of the response buffer:

✓ 3 passed, 0 failed

A Status is 200: ✓
A Has data: ✓
A Email matches: ✓

Pre-script logs appear in the Script tab. Assertion failures show the error message inline.