Available APIs

Example: Log Request Details

// Log request information for debugging
console.log('Method:', at.request.method);
console.log('URL:', at.request.url);
console.log('Headers:', JSON.stringify(at.request.headers, null, 2));

if (at.request.body) {
  console.log('Body:', at.request.body);
}

Example: Modify Request Dynamically

// Add a dynamic header
at.request.setHeader('X-Request-Id', crypto.randomUUID());

// Inject token from environment
const token = at.environment.get('auth_token');
if (token) {
  at.request.setHeader('Authorization', 'Bearer ' + token);
}

// Modify the URL dynamically
const baseUrl = at.environment.get('base_url');
if (baseUrl) {
  at.request.url = baseUrl + '/api/v2/users';
}

// Remove a header
at.request.removeHeader('X-Debug');

Example: Validate Request Before Sending

// Check if required headers are present
if (!at.request.headers['Authorization']) {
  console.warn('Warning: No Authorization header set');
}

// Validate JSON body structure
if (at.request.body) {
  try {
    const body = JSON.parse(at.request.body);
    if (!body.name) {
      console.error('Error: name field is required');
    }
  } catch (e) {
    console.error('Body is not valid JSON');
  }
}

Example: Fetch a Token Before the Request (async/await)

Scripts run inside an async wrapper, so you can use top-level await directly. The injected fetch is routed through Atrahasis's backend, so it is not affected by browser CORS restrictions.

// Exchange credentials for a short-lived token, then attach it
const tokenUrl = at.environment.get('token_url');
const clientId = at.environment.get('client_id');
const clientSecret = at.environment.get('client_secret');

const res = await fetch(tokenUrl, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ clientId, clientSecret }),
});

const data = await res.json();
at.environment.set('access_token', data.token);
at.request.setHeader('Authorization', 'Bearer ' + data.token);

Execution Limits

• 30-second timeout — Scripts are aborted after 30 seconds of wall-clock time. This protects the app against infinite loops or a hung fetch. A script that exceeds the limit fails with the error Script timeout: exceeded 30 seconds.
• 1000-character log buffer — The total console output collected during a script run is capped at 1000 characters. When the cap is reached, Atrahasis appends a [WARN] Log limit reached (1000 chars) line and silently drops any further output. Keep log calls short when iterating over large payloads.

Using Variables from Inside Scripts

The {{varName}} substitution syntax only runs on URL, header, body, and param fields — it is not processed inside script source code. If you accidentally write {{foo}} inside a pre-script, Atrahasis detects it at runtime and prints a helpful hint in the script output telling you to use at.environment.get("foo") instead. Always use the at.environment API to read and write environment variables from scripts.

Available APIs

Example: Inspect Response

// Log response information for debugging
console.log('Status:', at.response.status, at.response.statusText);
console.log('Headers:', JSON.stringify(at.response.headers, null, 2));

// Parse JSON body using the built-in json() helper
const data = at.response.json();
console.log('Response data:', data);

Example: Save Values to Environment

// Extract token from login response and save for subsequent requests
if (at.response.status === 200) {
  const data = at.response.json();
  at.environment.set('auth_token', data.access_token);
  at.environment.set('user_id', String(data.user.id));
  console.log('Token saved to environment');
}

Example: Validate Response Structure

// Validate the response matches expected structure
if (at.response.status === 200) {
  const data = at.response.json();

  if (!data.id) {
    console.error('Missing required field: id');
  }

  if (!Array.isArray(data.items)) {
    console.error('items should be an array');
  } else {
    console.log('Found', data.items.length, 'items');
  }
}

Example: Log Timing Information

// Analyze request performance
const timing = at.response.timing;

console.log('Total time:', timing.total, 'ms');
console.log('DNS lookup:', timing.dns, 'ms');
console.log('TLS handshake:', timing.tls, 'ms');
console.log('Time to first byte:', timing.ttfb, 'ms');

Example: Forward the Response to Another Endpoint (async/await)

Post-scripts run inside an async wrapper, so you can use top-level await. The injected fetch is routed through Atrahasis's backend and is not affected by browser CORS restrictions.

// Mirror a successful response to a webhook for auditing
if (at.response.status === 200) {
  const data = at.response.json();
  const webhookUrl = at.environment.get('audit_webhook');

  await fetch(webhookUrl, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      at: Date.now(),
      path: at.request.url,
      id: data.id,
    }),
  });

  console.log('Audit event forwarded');
}

Execution Limits

Post-scripts run under the same sandbox constraints as pre-scripts:

• 30-second timeout — Scripts are aborted after 30 seconds of wall-clock time, protecting the app against infinite loops or a hung fetch. Exceeding the limit fails with Script timeout: exceeded 30 seconds.
• 1000-character log buffer — Total console output during a single run is capped at 1000 characters. When the cap is reached, Atrahasis appends [WARN] Log limit reached (1000 chars) and drops further output.

Using Variables from Inside Scripts

The {{varName}} substitution syntax does not run inside script source code. If you accidentally write {{foo}} inside a post-script, Atrahasis detects it at runtime and prints a helpful hint in the script output telling you to use at.environment.get("foo") instead. Always use the at.environment API to read and write environment variables from scripts.

Assertion Structure

Each assertion row consists of up to five parts:

Enabling and Disabling Assertions

Assertions can be toggled at two independent levels:

• Per-assertion checkbox — each row has its own Enabled toggle. Disabled rows are skipped on send but stay in the tab and on the saved request, so you can re-enable them later.
• Master toggle — the Assertions sub-tab has a single switch that turns every assertion on or off at once. When the master toggle is off, no assertion runs regardless of its individual checkbox. This is handy when you want to send a request without any validation noise in the results, then flip validation back on without re-enabling each row one by one.

Variables in Expected Values

Expected values support the same substitution syntax as the rest of the request. Right before each assertion runs, Atrahasis resolves environment variables and random variables inside the Expected field, so you can reuse the value your request just produced or pin an assertion to an env-specific constant:

Substitution happens only for string-typed Expected values, so numeric comparisons like Status Code equals 200 are unaffected.

Summary Bar

At the bottom of the assertions panel, a summary shows the total count: "Results: X passed, Y failed". This appears only after a request has been sent.