TC-AUTH-04 Negative

Missing required header

Verify request validation when a required header is missing

Specification · xlsx

Steps

Send the request without the required header

Expected result

HTTP 400 or 401; error message

Endpoints

POST /iam/api/v1/auth/tokenGET /order/api/v1/merchant-integration/outbound-orders/statuses

Run

API_URL: https://api.qa2.ananastest.com

Change parameters

A dry run builds every request without sending it; responses come from a local stub.

Test code

mirrors tests/TokenTest.php::tc_auth_04()

47// Verify request validation when a required header is missing

48public function tc_auth_04(): void

49{

50 $response = $this->ananas->getToken(false);

✗51 $this->assertEquals(400, $response['statusCode']);

52}

web/app/Scenarios/TokenScenarios.php · line numbers refer to this file

Assertions

	Line	Assertion	Expected	Actual
✗	51	`assertEquals`	`400`	`504`

The run stopped at the first failed assertion, as PHPUnit does.

HTTP exchanges 1

1 POST /iam/api/v1/auth/token 504 Gateway Time-out 10.01 s

Request

POST https://api.qa2.ananastest.com/iam/api/v1/auth/token

Content-Length: 186
User-Agent: GuzzleHttp/7
Content-Type: application/json
Host: api.qa2.ananastest.com

JSON · 186 B

{
    "clientId": "5iliufdg44q6ett7gk79h2m8e9",
    "clientSecret": "h0pf3bfAC7WI23ImSRr1k92S6oNQr9KXmhr1toafO2igUDUlqhZM7U8TpCmYC+yoOPBshC4WlNtoo94/2wibOiUofQo=",
    "scope": "public_api/full_access"
}

Response

504 Gateway Time-out 10.01 s

Server: awselb/2.0
Date: Wed, 11 Nov 2026 13:21:48 GMT
Content-Type: text/html
Content-Length: 132
Connection: keep-alive

Text · 132 B

<html>
<head><title>504 Gateway Time-out</title></head>
<body>
<center><h1>504 Gateway Time-out</h1></center>
</body>
</html>

cURL

curl -X POST 'https://api.qa2.ananastest.com/iam/api/v1/auth/token' \
  -H 'Content-Type: application/json' \
  --data-raw '{"clientId":"5iliufdg44q6ett7gk79h2m8e9","clientSecret":"h0pf3bfAC7WI23ImSRr1k92S6oNQr9KXmhr1toafO2igUDUlqhZM7U8TpCmYC+yoOPBshC4WlNtoo94\/2wibOiUofQo=","scope":"public_api\/full_access"}'