Skip to content

AAuth Postman Collections

Postman collections for AAuth (draft-hardt-oauth-aauth-protocol-11): every access mode as a folder of requests you can send, from agent identity to federated authorization, with values passed from each response to the next request and checks on every response.

How It Works

  • Generated, not hand-written. The collections are generated by PIDL from the AAuth protocol document in agent-protocols, the same document behind its AAuth Explorer, so the requests, order and checks match the walkthrough step for step.
  • Postman plays the agent. The agent provider, resource, person server and access server are real servers: the AAuth sandbox from aauth-go runs them all, on a laptop, in Docker or on Kubernetes.
  • Signing happens outside Postman. Every AAuth request carries an HTTP message signature (RFC 9421). Requests go through the sandbox's signing helper, which signs them with the agent's key and forwards them.

What Is Included

Collection Environment What it runs
aauth sandbox The five access modes against the sandbox's demo resources: 21 requests, 98 assertions
petstore petstore Browsing the Petstore and placing an order that needs the person's approval: 10 requests, 47 assertions
aauth-mock mock The walkthrough's example responses, for a Postman mock server

The files are in collections/ and environments/.

Quick Start

With Docker and an aauth-go checkout at ../../aauth-dev/aauth-go:

docker compose up -d --build --wait             # the sandbox: every role and the signing helper
docker compose --profile test run --rm newman   # run every access mode with Newman

In Postman, import collections/aauth.postman_collection.json and environments/sandbox.postman_environment.json, select the environment, and run a folder. Postman talks only to the signing helper at http://127.0.0.1:8099, so no hosts entries or certificates are needed.

Guides

  • Running Against the Sandbox: Docker or a local sandbox, how signing works, mock mode, and regenerating the collections.
  • The Petstore Demos: the Petstore as an AAuth resource, played by Postman or by an AI agent, and a run shown beside the AAuth walkthrough.
  • Interop Testing: a runbook, for people and AI agents, for testing an agent, resource or server of your own against the sandbox.
  • aauth-go: the AAuth library and the sandbox.
  • agent-protocols: the AAuth protocol document and the AAuth Explorer.
  • pidl: the generator, and the viewer that shows a run beside the protocol.
  • omniagent: an AI agent that speaks AAuth.