``` The following assert will check the value of the `data-visible` attribute: ```hurl GET https://example.org/home HTTP 200 [Asserts] xpath "string(//article/@data-visible)" == "true" ``` In this case, the XPath query `string(//article/@data-visible)` returns a string, so the predicate value must be a string. The predicate function `==` can be used with string, numbers or booleans; `startWith` and `contains` can only be used with strings and bytes, while `matches` only works on string. If a query returns a number, using a `matches` predicate will cause a runner error. ```hurl # A really well tested web page... GET https://example.org/home HTTP 200 [Asserts] header "Content-Type" contains "text/html" header "Last-Modified" == "Wed, 21 Oct 2015 07:28:00 GMT" xpath "//h1" exists # Check we've at least one h1 xpath "normalize-space(//h1)" contains "Welcome" xpath "//h2" count == 13 xpath "string(//article/@data-id)" startsWith "electric" ``` ### Status assert Check the received HTTP response status code. Status assert consists of the keyword `status` followed by a predicate function and value. ```hurl GET https://example.org HTTP * [Asserts] status < 300 ``` ### Version assert Check the received HTTP version. Version assert consists of the keyword `version` followed by a predicate function and value. The value returns by `version` is a string: ```hurl GET https://example.org HTTP * [Asserts] version == "2" ``` ### Header assert Check the value of a received HTTP response header. Header assert consists of the keyword `header` followed by the value of the header, a predicate function and a predicate value. Like [headers implicit asserts], the check is case-insensitive for the name: comparing a `Content-Type` header is equivalent to a `content-type` one. ```hurl GET https://example.org HTTP 302 [Asserts] header "Location" contains "www.example.net" header "Last-Modified" matches /\d{2} [a-z-A-Z]{3} \d{4}/ ``` If there are multiple headers with the same name, the header assert returns a collection, so `count`, `contains` can be used in this case to test the header list. Let's say we have this request and response: ``` > GET /hello HTTP/1.1 > Host: example.org > Accept: */* > User-Agent: hurl/2.0.0-SNAPSHOT > * Response: (received 12 bytes in 11 ms) * < HTTP/1.0 200 OK < Vary: Content-Type < Vary: User-Agent < Content-Type: text/html; charset=utf-8 < Content-Length: 12 < Server: Flask Server < Date: Fri, 07 Oct 2022 20:53:35 GMT ``` One can use explicit header asserts: ```hurl GET https://example.org/hello HTTP 200 [Asserts] header "Vary" count == 2 header "Vary" contains "User-Agent" header "Vary" contains "Content-Type" ``` Or implicit header asserts: ```hurl GET https://example.org/hello HTTP 200 Vary: User-Agent Vary: Content-Type ``` ### Cookie assert Check value or attributes of a [`Set-Cookie`] response header. Cookie assert consists of the keyword `cookie`, followed by the cookie name (and optionally a cookie attribute), a predicate function and value. Cookie attributes value can be checked by using the following format:`[cookie-attribute]`. The following attributes are supported: `Value`, `Expires`, `Max-Age`, `Domain`, `Path`, `Secure`, `HttpOnly` and `SameSite`. ```hurl GET http://localhost:8000/cookies/set HTTP 200 # Explicit check of Set-Cookie header value. If the attributes are # not in this exact order, this assert will fail. Set-Cookie: LSID=DQAAAKEaem_vYg; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Secure; HttpOnly; Path=/accounts; SameSite=Lax; Set-Cookie: HSID=AYQEVnDKrdst; Domain=localhost; Expires=Wed, 13 Jan 2021 22:23:01 GMT; HttpOnly; Path=/ Set-Cookie: SSID=Ap4PGTEq; Domain=localhost; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Secure; HttpOnly; Path=/ # Using cookie assert, one can check cookie value and various attributes. [Asserts] cookie "LSID" == "DQAAAKEaem_vYg" cookie "LSID[Value]" == "DQAAAKEaem_vYg" cookie "LSID[Expires]" exists cookie "LSID[Expires]" contains "Wed, 13 Jan 2021" cookie "LSID[Max-Age]" not exists cookie "LSID[Domain]" not exists cookie "LSID[Path]" == "/accounts" cookie "LSID[Secure]" exists cookie "LSID[HttpOnly]" exists cookie "LSID[SameSite]" == "Lax" ``` > `Secure` and `HttpOnly` attributes can only be tested with `exists` or `not exists` predicates > to reflect the [Set-Cookie header] semantics (in other words, queries `[HttpOnly]` > and `[Secure]` don't return boolean). ### Body assert Check the value of the received HTTP response body when decoded as a string. Body assert consists of the keyword `body` followed by a predicate function and value. ```hurl GET https://example.org HTTP 200 [Asserts] body contains "

Welcome!

" ``` The encoding used to decode the response body bytes to a string is based on the `charset` value in the `Content-Type` header response. ```hurl # Our HTML response is encoded with GB 2312 (see https://en.wikipedia.org/wiki/GB_2312) GET https://example.org/cn HTTP 200 [Asserts] header "Content-Type" == "text/html; charset=gb2312" # bytes of the response, without any text decoding: bytes contains hex,c4e3bac3cac0bde7; # 你好世界 encoded in GB 2312 # text of the response, decoded with GB 2312: body contains "你好世界" ``` If the `Content-Type` response header doesn't include any encoding hint, a [`decode` filter] can be used to explicitly decode the response body bytes. ```hurl # Our HTML response is encoded using GB 2312. # But, the 'Content-Type' HTTP response header doesn't precise any charset, # so we decode explicitly the bytes. GET https://example.org/cn HTTP 200 [Asserts] header "Content-Type" == "text/html" bytes contains hex,c4e3bac3cac0bde7; # 你好世界 encoded in GB2312 bytes charsetDecode "gb2312" contains "你好世界" ``` Body asserts are automatically decompressed based on the value of `Content-Encoding` response header. So, whatever is the response compression (`gzip`, `brotli`) etc... asserts values don't depend on the content encoding. ```hurl # Request a gzipped reponse, the `body` asserts works with ungzipped response GET https://example.org Accept-Encoding: gzip HTTP 200 [Asserts] header "Content-Encoding" == "gzip" body contains "

Welcome!

" # Without content encoding, asserts remains identical GET https://example.org HTTP 200 [Asserts] header "Content-Encoding" not exists body contains "

Welcome!

" ``` ### Bytes assert Check the value of the received HTTP response body as a bytestream. Body assert consists of the keyword `bytes` followed by a predicate function and value. ```hurl GET https://example.org/data.bin HTTP 200 [Asserts] bytes startsWith hex,efbbbf; bytes count == 12424 header "Content-Length" == "12424" ``` Like `body` assert, `bytes` assert works _after_ content encoding decompression (so the predicates values are not affected by `Content-Encoding` response header value). ### RawBytes assert Check the value of the received HTTP response body as a raw bytestream. RawBytes assert consists of the keyword `rawbytes` followed by a predicate function and value. ```hurl GET https://example.org/data.bin HTTP 200 Content-Encoding: gzip [Asserts] header "Content-Length" == "32" rawbytes count == 32 # matches Content-Length (compressed size) bytes count == 100 # decompressed size is larger rawbytes startsWith hex,1f8b; # gzip magic bytes bytes startsWith hex,48656c6c6f; # decompressed content starts with "Hello" ``` Unlike `bytes` assert, `rawbytes` returns the raw bytes _before_ any content decoding. For uncompressed responses, `rawbytes` and `bytes` return the same data. ### XPath assert Check the value of a [XPath] query on the received HTTP body decoded as a string (using the `charset` value in the `Content-Type` header response). Currently, only XPath 1.0 expression can be used. Body assert consists of the keyword `xpath` followed by a predicate function and value. Values can be string, boolean or number depending on the XPath query. Let's say we want to check this HTML response: ```plain $ curl -v https://example.org < HTTP/1.1 200 OK < Content-Type: text/html; charset=UTF-8 ... Example Domain ...

Example

This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission.

More information...

``` With Hurl, we can write multiple XPath asserts describing the DOM content: ```hurl GET https://example.org HTTP 200 Content-Type: text/html; charset=UTF-8 [Asserts] xpath "string(/html/head/title)" contains "Example" # Check title xpath "count(//p)" == 2 # Check the number of

xpath "//p" count == 2 # Similar assert for

xpath "boolean(count(//h2))" == false # Check there is no

xpath "//h2" not exists # Similar assert for

``` XML Namespaces are also supported. Let's say you want to check this XML response: ```xml Cheaper by the Dozen 1568491379 ``` This XML response can be tested with the following Hurl file: ```hurl GET http://localhost:8000/assert-xpath HTTP 200 [Asserts] xpath "string(//bk:book/bk:title)" == "Cheaper by the Dozen" xpath "string(//[name()='bk:book']/[name()='bk:title'])" == "Cheaper by the Dozen" xpath "string(//[local-name()='book']/[local-name()='title'])" == "Cheaper by the Dozen" xpath "string(//bk:book/isbn:number)" == "1568491379" xpath "string(//[name()='bk:book']/[name()='isbn:number'])" == "1568491379" xpath "string(//[local-name()='book']/[local-name()='number'])" == "1568491379" ``` The XPath expressions `string(//bk:book/bk:title)` and `string(//bk:book/isbn:number)` are written with `bk` and `isbn` namespaces. > For convenience, the first default namespace can be used with `_` ### JSONPath assert Check the value of a [JSONPath] query on the received HTTP body decoded as a JSON document. JSONPath assert consists of the keyword `jsonpath` followed by a predicate function and value. Let's say we want to check this JSON response: ```plain curl -v http://httpbin.org/json < HTTP/1.1 200 OK < Content-Type: application/json ... { "slideshow": { "author": "Yours Truly", "date": "date of publication", "slides": [ { "title": "Wake up to WonderWidgets!", "type": "all" }, ... ], "title": "Sample Slide Show" } } ``` With Hurl, we can write multiple JSONPath asserts describing the DOM content: ```hurl GET http://httpbin.org/json HTTP 200 [Asserts] jsonpath "$.slideshow.author" == "Yours Truly" jsonpath "$.slideshow.slides[0].title" contains "Wonder" jsonpath "$.slideshow.slides" count == 2 jsonpath "$.slideshow.date" != null jsonpath "$.slideshow.slides[].title" contains "Mind Blowing!" ``` > Explain that the value selected by the JSONPath is coerced to a string when only > one node is selected. In `matches` predicates, metacharacters beginning with a backslash (like `\d`, `\s`) must be escaped. Alternatively, `matches` predicate support [JavaScript-like Regular expression syntax] to enhance the readability: ```hurl GET https://example.org/hello HTTP 200 [Asserts] # Predicate value with matches predicate: jsonpath "$.date" matches "^\\d{4}-\\d{2}-\\d{2}$" jsonpath "$.name" matches "Hello [a-zA-Z]+!" # Equivalent syntax: jsonpath "$.date" matches /^\d{4}-\d{2}-\d{2}$/ jsonpath "$.name" matches /Hello [a-zA-Z]+!/ ``` ### Regex assert Check that the HTTP received body, decoded as text, matches a regex pattern. ```hurl GET https://example.org/hello HTTP 200 [Asserts] regex "^(\\d{4}-\\d{2}-\\d{2})$" == "2018-12-31" # Same assert as previous using regex literals regex /^(\d{4}-\d{2}-\d{2})$/ == "2018-12-31" ``` The regex pattern must have at least one capture group, otherwise the assert will fail. The assertion is done on the captured group value. When the regex pattern is a double-quoted string, metacharacters beginning with a backslash in the pattern (like `\d`, `\s`) must be escaped; literal pattern enclosed by `/` can also be used to avoid metacharacters escaping. The regex syntax is documented at . For instance, once can use [flags](https://docs.rs/regex/latest/regex/#grouping-and-flags) to enable case-insensitive match: ```hurl GET https://example.org/hello HTTP 200 [Asserts] regex /(?i)hello (\w+)!/ == "World" ``` ### SHA-256 assert Check response body [SHA-256] hash. ```hurl GET https://example.org/data.tar.gz HTTP 200 [Asserts] sha256 == hex,039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81; ``` Like `body` assert, `sha256` assert works _after_ content encoding decompression (so the predicates values are not affected by `Content-Encoding` response header). For instance, if we have a resource `a.txt` on a server with a given hash `abcdef`, `sha256` value is not affected by `Content-Encoding`: ```hurl # Without content encoding compression: GET https://example.org/a.txt HTTP 200 [Asserts] sha256 == hex,abcdef; # With content encoding compression: GET https://example.org/a.txt Accept-Encoding: brotli HTTP 200 [Asserts] header "Content-Encoding" == "brotli" sha256 == hex,abcdef; ``` ### MD5 assert Check response body [MD5] hash. ```hurl GET https://example.org/data.tar.gz HTTP 200 [Asserts] md5 == hex,ed076287532e86365e841e92bfc50d8c; ``` Like `sha256` asserts, `md5` assert works _after_ content encoding decompression (so the predicates values are not affected by `Content-Encoding` response header) ### URL assert Check the last fetched URL. This is most meaningful if you have told Hurl to follow redirection (see [`[Options]`section][options] or [`--location` option]). URL assert consists of the keyword `url` followed by a predicate function and value. ```hurl GET https://example.org/redirecting [Options] location: true HTTP 200 [Asserts] url == "https://example.org/redirected" ``` ### Redirects assert Check each step of redirection. This is most meaningful if you have told Hurl to follow redirection (see [`[Options]`section][options] or [`--location` option]). Redirects assert consists of the keyword `redirects` followed by a predicate function and value. The `redirects` query returns a collection of redirections that can be tested with a [`location` filter]: ```hurl GET https://example.org/redirecting/1 [Options] location: true HTTP 200 [Asserts] redirects count == 3 redirects nth 0 location == "https://example.org/redirecting/2" redirects nth 1 location == "https://example.org/redirecting/3" redirects nth 2 location == "https://example.org/redirected" ``` ### IP address assert Check the IP address of the last connection. The value of the `ip` query is a string. > Predicates `isIpv4` and `isIpv6` are available to check if a particular string matches an IPv4 or IPv6 address and > can use with `ip` queries. ```hurl GET https://example.org/hello HTTP 200 [Asserts] ip isIpv4 ip not isIpv6 ip == "172.16.45.87" ``` ### Variable assert ```hurl # Test that the XML endpoint return 200 pets GET https://example.org/api/pets HTTP 200 [Captures] pets: xpath "//pets" [Asserts] variable "pets" count == 200 ``` ### Duration assert Check the total duration (sending plus receiving time) of the HTTP transaction. ```hurl GET https://example.org/helloworld HTTP 200 [Asserts] duration < 1000 # Check that response time is less than one second ``` ### SSL certificate assert Check the SSL certificate properties. Certificate assert consists of the keyword `certificate`, followed by the certificate attribute value. The following attributes are supported: `Subject`, `Issuer`, `Start-Date`, `Expire-Date`, `Serial-Number`, `Subject-Alt-Name` and `Value`. ```hurl GET https://example.org HTTP 200 [Asserts] certificate "Subject" == "CN=example.org" certificate "Issuer" == "C=US, O=Let's Encrypt, CN=R3" certificate "Expire-Date" daysAfterNow > 15 certificate "Serial-Number" matches "[0-9af]+" certificate "Subject-Alt-Name" contains "DNS:example.org" certificate "Subject-Alt-Name" split "," count == 2 certificate "Value" startsWith "-----BEGIN CERTIFICATE-----" ``` [predicates]: #predicates [header assert]: #header-assert [captures]: /docs/capturing-response.md#query [data attributes]: https://developer.mozilla.org/en-US/docs/Learn/HTML/Howto/Use_data_attributes [`Set-Cookie`]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie [Set-Cookie header]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie [XPath]: https://en.wikipedia.org/wiki/XPath [JSONPath]: https://goessner.net/articles/JsonPath/ [body asserts]: #body-assert [JSON]: https://www.json.org [XML]: https://en.wikipedia.org/wiki/XML [Base64]: https://en.wikipedia.org/wiki/Base64 [`--file-root` option]: /docs/manual.md#file-root [JavaScript-like Regular expression syntax]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions [MD5]: https://en.wikipedia.org/wiki/MD5 [SHA-256]: https://en.wikipedia.org/wiki/SHA-2 [options]: /docs/request.md#options [`--location` option]: /docs/manual.md#location [multiline string body]: #multiline-string-body [filters]: /docs/filters.md [count]: /docs/filters.md#count [`decode` filter]: /docs/filters.md#decode [headers implicit asserts]: #headers [RFC 3339]: https://www.rfc-editor.org/rfc/rfc3339 [content-encoding]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding [`Content-Type` header]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type [`body` assert]: #body-assert [`location` filter]: /docs/filters.md#location [UUID v4]: https://en.wikipedia.org/wiki/Universally_unique_identifier --- ### Capturing Response (`docs/capturing-response.md`) # Capturing Response ## Captures Captures are optional values that are extracted from the HTTP response and stored in a named variable. These captures may be the response status code, part of or the entire the body, and response headers. Captured variables can be accessed through a run session; each new value of a given variable overrides the last value. Captures can be useful for using data from one request in another request, such as when working with [CSRF tokens]. Variables in a Hurl file can be created from captures or [injected into the session]. ```hurl # An example to show how to pass a CSRF token # from one request to another: # First GET request to get CSRF token value: GET https://example.org HTTP 200 # Capture the CSRF token value from html body. [Captures] csrf_token: xpath "normalize-space(//meta[@name='_csrf_token']/@content)" # Do the login ! POST https://acmecorp.net/login?user=toto&password=1234 X-CSRF-TOKEN: {{csrf_token}} HTTP 302 ``` Body responses can be encoded by server (see [`Content-Encoding` HTTP header][content-encoding]) but captures in Hurl files are not affected by this content compression. All body captures (`body`, `bytes`, `sha256` etc...) except `rawbytes` work _after_ content decoding. Finally, body text captures (`body`, `jsonpath`, `xpath` etc...) are also decoded to strings based on [`Content-Type` header] so these queries can be captures as usual strings. Structure of a capture:

my_varvariable : xpath "string(//h1)"query

A capture consists of a variable name, followed by `:` and a query. Captures section starts with `[Captures]`. ### Query Queries are used to extract data from an HTTP response. A query can extract data from - status line: - [`status`](#status-capture) - [`version`](#version-capture) - headers: - [`header`](#header-capture) - [`cookie`](#cookie-capture) - body: - [`body`](#body-capture) - [`bytes`](#bytes-capture) - [`rawbytes`](#bytes-capture) - [`xpath`](#xpath-capture) - [`jsonpath`](#jsonpath-capture) - [`regex`](#regex-capture) - [`sha256`](#sha-256-capture) - [`md5`](#md5-capture) - others: - [`url`](#url-capture) - [`redirects`](#redirects-capture) - [`ip`](#ip-address-capture) - [`variable`](#variable-capture) - [`duration`](#duration-capture) - [`certificate`](#ssl-certificate-capture) Extracted data can then be further refined using [filters]. ### Status capture Capture the received HTTP response status code. Status capture consists of a variable name, followed by a `:`, and the keyword `status`. ```hurl GET https://example.org HTTP 200 [Captures] my_status: status ``` ### Version capture Capture the received HTTP version. Version capture consists of a variable name, followed by a `:`, and the keyword `version`. The value captured is a string: ```hurl GET https://example.org HTTP 200 [Captures] http_version: version ``` ### Header capture Capture a header from the received HTTP response headers. Header capture consists of a variable name, followed by a `:`, then the keyword `header` and a header name. ```hurl POST https://example.org/login [Form] user: toto password: 12345678 HTTP 302 [Captures] next_url: header "Location" ``` ### Cookie capture Capture a [`Set-Cookie`] header from the received HTTP response headers. Cookie capture consists of a variable name, followed by a `:`, then the keyword `cookie` and a cookie name. ```hurl GET https://example.org/cookies/set HTTP 200 [Captures] session-id: cookie "LSID" ``` Cookie attributes value can also be captured by using the following format: `[cookie-attribute]`. The following attributes are supported: `Value`, `Expires`, `Max-Age`, `Domain`, `Path`, `Secure`, `HttpOnly` and `SameSite`. ```hurl GET https://example.org/cookies/set HTTP 200 [Captures] value1: cookie "LSID" value2: cookie "LSID[Value]" # Equivalent to the previous capture expires: cookie "LSID[Expires]" max-age: cookie "LSID[Max-Age]" domain: cookie "LSID[Domain]" path: cookie "LSID[Path]" secure: cookie "LSID[Secure]" http-only: cookie "LSID[HttpOnly]" same-site: cookie "LSID[SameSite]" ``` ### Body capture Capture the entire body (decoded as text) from the received HTTP response. The encoding used to decode the body is based on the `charset` value in the `Content-Type` header response. ```hurl GET https://example.org/home HTTP 200 [Captures] my_body: body ``` If the `Content-Type` doesn't include any encoding hint, a [`decode` filter] can be used to explicitly decode the body response bytes. ```hurl # Our HTML response is encoded using GB 2312. # But, the 'Content-Type' HTTP response header doesn't precise any charset, # so we decode explicitly the bytes. GET https://example.org/cn HTTP 200 [Captures] my_body: bytes charsetDecode "gb2312" ``` `body` capture works _after_ content encoding decompression (so the captured value is not affected by `Content-Encoding` response header). ### Bytes capture Capture the entire body (as a raw bytestream) from the received HTTP response ```hurl GET https://example.org/data.bin HTTP 200 [Captures] my_data: bytes ``` Like `body` capture, `bytes` capture works _after_ content encoding decompression (so the captured value is not affected by `Content-Encoding` response header). ### RawBytes capture Capture the entire body as a raw bytestream from the received HTTP response, _before_ any content decoding. ```hurl GET https://example.org/data.bin HTTP 200 [Captures] raw_data: rawbytes ``` Unlike `bytes` capture, `rawbytes` returns the raw bytes before content encoding decompression. For uncompressed responses, `rawbytes` and `bytes` capture the same data. ### XPath capture Capture a [XPath] query from the received HTTP body decoded as a string. Currently, only XPath 1.0 expression can be used. ```hurl GET https://example.org/home # Capture the identifier from the dom node
5646eaf23
Explain that the value selected by the JSONPath is coerced to a string when only one node is selected. As with [XPath captures], JSONPath captures can be anything from string, number, to object and collections. For instance, if we have a JSON endpoint that returns the following JSON: ``` { "a_null": null, "an_object": { "id": "123" }, "a_list": [ 1, 2, 3 ], "an_integer": 1, "a float": 1.1, "a_bool": true, "a_string": "hello" } ``` We can capture the following paths: ```hurl GET https://example.org/captures-json HTTP 200 [Captures] an_object: jsonpath "$['an_object']" a_list: jsonpath "$['a_list']" a_null: jsonpath "$['a_null']" an_integer: jsonpath "$['an_integer']" a_float: jsonpath "$['a_float']" a_bool: jsonpath "$['a_bool']" a_string: jsonpath "$['a_string']" all: jsonpath "$" ``` ### Regex capture Capture a regex pattern from the HTTP received body, decoded as text. ```hurl GET https://example.org/helloworld HTTP 200 [Captures] id_a: regex "id_a:([0-9]+)" id_b: regex "id_b:(\\d+)" # pattern using double quote id_c: regex /id_c:(\d+)/ # pattern using forward slash name: regex "Hello ([a-zA-Z]+)" ``` The regex pattern must have at least one capture group, otherwise the capture will fail. When the pattern is a double-quoted string, metacharacters beginning with a backslash in the pattern (like `\d`, `\s`) must be escaped; literal pattern enclosed by `/` can also be used to avoid metacharacters escaping. The regex syntax is documented at . For instance, one can use [flags](https://docs.rs/regex/latest/regex/#grouping-and-flags) to enable case-insensitive match: ```hurl GET https://example.org/hello HTTP 200 [Captures] word: regex /(?i)hello (\w+)!/ ``` ### SHA-256 capture Capture the [SHA-256] hash of the response body. ```hurl GET https://example.org/data.tar.gz HTTP 200 [Captures] my_hash: sha256 ``` Like `body` assert, `sha256` capture works _after_ content encoding decompression (so the captured value is not affected by `Content-Encoding` response header). ### MD5 capture Capture the [MD5] hash of the response body. ```hurl GET https://example.org/data.tar.gz HTTP 200 [Captures] my_hash: md5 ``` Like `sha256` asserts, `md5` assert works _after_ content encoding decompression (so the predicates values are not affected by `Content-Encoding` response header) ### URL capture Capture the last fetched URL. This is most meaningful if you have told Hurl to follow redirection (see [`[Options]` section][options] or [`--location` option]). URL capture consists of a variable name, followed by a `:`, and the keyword `url`. ```hurl GET https://example.org/redirecting [Options] location: true HTTP 200 [Captures] landing_url: url ``` ### Redirects capture Capture each step of redirection. This is most meaningful if you have told Hurl to follow redirection (see [`[Options]`section][options] or [`--location` option]). Redirects capture consists of a variable name, followed by a `:`, and the keyword `redirects`. Redirects query returns a collection so each step of the redirection can be capture. ```hurl GET https://example.org/redirecting/1 [Options] location: true HTTP 200 [Asserts] redirects count == 3 [Captures] step1: redirects nth 0 location step2: redirects nth 1 location step3: redirects nth 2 location ``` ### IP address capture Capture the IP address of the last connection. The value of the `ip` query is a string. ```hurl GET https://example.org/hello HTTP 200 [Captures] server_ip: ip ``` ### Variable capture Capture the value of a variable into another. ```hurl GET https://example.org/helloworld HTTP 200 [Captures] in: body name: variable "in" ``` ### Duration capture Capture the response time of the request in ms. ```hurl GET https://example.org/helloworld HTTP 200 [Captures] duration_in_ms: duration ``` ### SSL certificate capture Capture the SSL certificate properties. Certificate capture consists of the keyword `certificate`, followed by the certificate attribute value. The following attributes are supported: `Subject`, `Issuer`, `Start-Date`, `Expire-Date`, `Serial-Number`, `Subject-Alt-Name` and `Value`. ```hurl GET https://example.org HTTP 200 [Captures] cert_subject: certificate "Subject" cert_issuer: certificate "Issuer" cert_expire_date: certificate "Expire-Date" cert_serial_number: certificate "Serial-Number" san: certificate "Serial-Number" value: certificate "Value" ``` ## Redacting Secrets When capturing data, you may need to hide captured values from logs and report. To do this, captures can use secrets which are redacted from logs and reports, using [`--secret` option]: ```shell $ hurl --secret pass=sesame-ouvre-toi file.hurl ``` If the secret value to be redacted is dynamic, or not known before execution, a capture can become a secret using `redact` at the end of the query's capture: ```hurl GET https://foo.com HTTP 200 [Captures] pass: header "token" redact ``` [CSRF tokens]: https://en.wikipedia.org/wiki/Cross-site_request_forgery [injected into the session]: /docs/templates.md#injecting-variables [`Set-Cookie`]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie [XPath]: https://en.wikipedia.org/wiki/XPath [JSONPath]: https://goessner.net/articles/JsonPath/ [XPath captures]: #xpath-capture [JavaScript-like Regular expression syntax]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions [options]: /docs/request.md#options [`--location` option]: /docs/manual.md#location [filters]: /docs/filters.md [`xpath` filter]: /docs/filters.md#xpath [`decode` filter]: /docs/filters.md#decode [`--secret` option]: /docs/templates.md#secrets [MD5]: https://en.wikipedia.org/wiki/MD5 [SHA-256]: https://en.wikipedia.org/wiki/SHA-2 [content-encoding]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding [`Content-Type` header]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type --- ### Entry (`docs/entry.md`) # Entry ## Definition A Hurl file is a list of entries, each entry being a mandatory [request], optionally followed by a [response]. Responses are not mandatory, a Hurl file consisting only of requests is perfectly valid. To sum up, responses can be used to [capture values] to perform subsequent requests, or [add asserts to HTTP responses]. ## Example ```hurl # First, test home title. GET https://acmecorp.net HTTP 200 [Asserts] xpath "normalize-space(//head/title)" == "Hello world!" # Get some news, response description is optional GET https://acmecorp.net/news # Do a POST request without CSRF token and check # that status code is Forbidden 403 POST https://acmecorp.net/contact [Form] default: false email: john.doe@rookie.org number: 33611223344 HTTP 403 ``` ## Description ### Options [Options] specified on the command line apply to every entry in an Hurl file. For instance, with [`--location` option], every entry of a given file will follow redirection: ```shell $ hurl --location foo.hurl ``` You can use an [`[Options]` section][options] to set option only for a specified request. For instance, in this Hurl file, the second entry will follow location (so we can test the status code to be 200 instead of 301). ```hurl GET https://google.fr HTTP 301 GET https://google.fr [Options] location: true HTTP 200 GET https://google.fr HTTP 301 ``` You can use the `[Options]` section to log a specific entry: ```hurl # ... previous entries GET https://api.example.org [Options] very-verbose: true HTTP 200 # ... next entries ``` ### Cookie storage By default, requests in the same Hurl file share cookie storage, enabling session-based scenario. The shared cookie store can be disabled with [`--no-cookie-store`] option. ### Redirects By default, Hurl doesn't follow redirection. To effectively run a redirection, entries should describe each step of the redirection, allowing insertion of asserts in each response. ```hurl # First entry, test the redirection (status code and 'Location' header) GET https://example.org HTTP 301 Location: https://www.example.org # Second entry, the 200 OK response GET https://www.example.org HTTP 200 ``` Alternatively, one can use [`--location`] / [`--location-trusted`] options to force redirection to be followed. In this case, asserts are executed on the last received response. Optionally, the number of redirections can be limited with [`--max-redirs`]. ```hurl # Running hurl --location foo.hurl GET https://example.org HTTP 200 ``` Finally, you can force redirection on a particular request with an [`[Options]` section][options] and the [`--location`] / [`--location-trusted`] options: ```hurl GET https://example.org [Options] location-trusted: true HTTP 200 ``` Redirections can be tested either by: - running and asserting each step of redirection: ```hurl GET https://example.org/step1 HTTP 301 [Asserts] header "Location" == "https://example.org/step2" GET https://example.org/step2 HTTP 301 [Asserts] header "Location" == "https://example.org/step3" GET https://example.org/step3 HTTP 200 ``` - using [`--location`] / [`--location-trusted`], testing each step with [`redirects` query]: ```hurl GET https://example.org/step1 [Options] location: true HTTP 200 [Asserts] redirects count == 2 redirects nth 0 location == "https://example.org/step2" redirects nth 1 location == "https://example.org/step3" ``` [`url` query] can also be used to get the final effective URL: ```hurl GET https://example.org/step1 [Options] location: true HTTP 200 [Asserts] url == "https://example.org/step3" ``` ### Retry Every entry can be retried upon asserts, captures or runtime errors. Retries allow polling scenarios and effective runs under flaky conditions. Asserts can be explicit (with an [`[Asserts]` section][asserts]), or implicit (like [headers] or [status code]). Retries can be set globally for every request (see [`--retry`] and [`--retry-interval`]), or activated on a particular request with an [`[Options]` section][options]. For example, in this Hurl file, first we create a new job then we poll the new job until it's completed: ```hurl # Create a new job POST http://api.example.org/jobs HTTP 201 [Captures] job_id: jsonpath "$.id" [Asserts] jsonpath "$.state" == "RUNNING" # Pull job status until it is completed GET http://api.example.org/jobs/{{job_id}} [Options] retry: 10 # maximum number of retry, -1 for unlimited retry-interval: 300ms HTTP 200 [Asserts] jsonpath "$.state" == "COMPLETED" ``` ### Control flow In `[Options]` section, `skip` and `repeat` can be used to control flow of execution: - `skip: true/false` skip this request and execute the next one unconditionally, - `repeat: N` loop the request N times. If there are assert or runtime errors, the requests execution is stopped. ```hurl # This request will be played exactly 3 times GET https://example.org/foo [Options] repeat: 3 HTTP 200 # This request is skipped GET https://example.org/foo [Options] skip: true HTTP 200 ``` Additionally, a `delay` can be inserted between requests, to add a delay before execution of a request (aka sleep). ```hurl # A 5 seconds delayed request GET https://example.org/foo [Options] delay: 5s HTTP 200 ``` [`delay`] and [`repeat`] can also be used globally as command line options: ```shell $ hurl --delay 500ms --repeat 3 foo.hurl ``` For complete reference, below is a diagram for the executed entries.

[request]: /docs/request.md [response]: /docs/response.md [capture values]: /docs/capturing-response.md [add asserts to HTTP responses]: /docs/asserting-response.md [`--location`]: /docs/manual.md#location [`--location` option]: /docs/manual.md#location [`--location-trusted`]: /docs/manual.md#location-trusted [`--max-redirs`]: /docs/manual.md#max-redirs [Options]: /docs/manual.md#options [options]: /docs/request.md#options [headers]: /docs/response.md#headers [status code]: /docs/response.md#version-status [asserts]: /docs/response.md#asserts [Asserts]: /docs/response.md#asserts [`--retry`]: /docs/manual.md#retry [`--retry-interval`]: /docs/manual.md#retry-interval [`delay`]: /docs/manual.md#retry [`repeat`]: /docs/manual.md#repeat [`redirects` query]: /docs/asserting-response.md#redirects-assert [`url` query]: /docs/asserting-response.md#url-assert [`--no-coookie-store`]: /docs/manual.md#no-cookie-store --- ### Filters (`docs/filters.md`) # Filters ## Definition [Captures] and [asserts] share a common structure: query. A query is used to extract data from an HTTP response; this data can come from the HTTP response body, the HTTP response headers or from the HTTP meta-information (like `duration` for instance)... In this example, the query `jsonpath "$.books[0].name"` is used in a capture to save data and in an assert to test the HTTP response body. Capture:

namevariable : jsonpath "$.books[0].name"query

Assert:

jsonpath "$.books[0].name"query == "Dune"predicate

In both case, the query is exactly the same: queries are the core structure of asserts and captures. Sometimes, you want to process data extracted by queries: that's the purpose of filters. Filters are used to transform value extracted by a query and can be used in asserts and captures to refine data. Filters can be chained, allowing for fine-grained data extraction.

jsonpath "$.name"query split "," nth 02 filters == "Herbert"predicate

## Example ```hurl GET https://example.org/api HTTP 200 [Captures] name: jsonpath "$.user.id" replaceRegex /\d/ "x" [Asserts] header "x-servers" split "," count == 2 header "x-servers" split "," nth 0 == "rec1" header "x-servers" split "," nth 1 == "rec3" jsonpath "$.books" count == 12 ``` ## Description | Filter | Description | Input | Output | |---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------|--------| | [base64Decode](#base64decode) | Decodes a [Base64 encoded string] into bytes. | string | bytes | | [base64Encode](#base64encode) | Encodes bytes into [Base64 encoded string]. | bytes | string | | [base64UrlSafeDecode](#base64urlsafedecode) | Decodes a Base64 encoded string into bytes (using [Base64 URL safe encoding]). | string | bytes | | [base64UrlSafeEncode](#base64urlsafeencode) | Encodes bytes into Base64 encoded string (using [Base64 URL safe encoding]). | bytes | string | | [charsetDecode](#charsetdecode) | Decodes bytes to string using a charset encoding. | bytes | string | | [count](#count) | Counts the number of items in a collection. | collection | number | | [dateFormat](#dateformat) | Formats a date to a string given [a specification format]. | date | string | | [daysAfterNow](#daysafternow) | Returns the number of days between now and a date in the future. | date | number | | [daysBeforeNow](#daysbeforenow) | Returns the number of days between now and a date in the past. | date | number | | [first](#first) | Returns the first element from a collection. | collection | any | | [htmlEscape](#htmlescape) | Converts the characters `&`, `<` and `>` to HTML-safe sequence. | string | string | | [htmlUnescape](#htmlunescape) | Converts all named and numeric character references (e.g. `>`, `>`, `>`) to the corresponding Unicode characters. | string | string | | [jsonpath](#jsonpath) | Evaluates a [JSONPath] expression. | string | any | | [last](#last) | Returns the last element from a collection. | collection | any | | [location](#location) | Returns the target location URL of a redirection. | response | string | | [nth](#nth) | Returns the element from a collection at a zero-based index, accepts negative indices for indexing from the end of the collection. | collection | any | | [regex](#regex) | Extracts regex capture group. Pattern must have at least one capture group. | string | string | | [replace](#replace) | Replaces all occurrences of old string with new string. | string | string | | [replaceRegex](#replaceregex) | Replaces all occurrences of a pattern with new string. | string | string | | [split](#split) | Splits to a list of strings around occurrences of the specified delimiter. | string | string | | [toDate](#toDate) | Converts a string to a date given [a specification format]. | string | date | | [toFloat](#tofloat) | Converts value to float number. | string \| number | number | | [toHex](#tohex) | Converts bytes to hexadecimal string. | bytes | string | | [toInt](#toint) | Converts value to integer number. | string \| number | number | | [toString](#tostring) | Converts value to string. | any | string | | [urlDecode](#urldecode) | Replaces %xx escapes with their single-character equivalent. | string | string | | [urlEncode](#urlencode) | Percent-encodes all the characters which are not included in unreserved chars (see [RFC3986]) with the exception of forward slash (/). | string | string | | [urlQueryParam](#urlqueryparam) | Returns the value of a query parameter in a URL. | string | string | | [utf8Decode](#utf8Decode) | Decodes bytes to string using UTF-8 encoding. | bytes | string | | [utf8Encode](#utf8Encode) | Encodes a string to bytes using UTF-8 encoding. | string | bytes | | [xpath](#xpath) | Evaluates a [XPath] expression. | string | string | ### base64Decode Decodes a [Base64 encoded string] into bytes. ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.token" base64Decode == hex,3c3c3f3f3f3e3e; ``` ### base64Encode Encodes bytes into [Base64 encoded string]. ```hurl GET https://example.org/api HTTP 200 [Asserts] bytes base64Encode == "PDw/Pz8+Pg==" ``` ### base64UrlSafeDecode Decodes a Base64 encoded string into bytes (using [Base64 URL safe encoding]). ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.token" base64UrlSafeDecode == hex,3c3c3f3f3f3e3e; ``` ### base64UrlSafeEncode Encodes bytes into Base64 encoded string (using [Base64 URL safe encoding]). ```hurl GET https://example.org/api HTTP 200 [Asserts] bytes base64UrlSafeEncode == "PDw_Pz8-Pg" ``` ### charsetDecode Formerly known as `decode`, which is deprecated and will be removed in a future major version.* Decodes bytes to string using a charset encoding. Encoding labels are defined in [Encoding Standard]. ```hurl # The 'Content-Type' HTTP response header does not precise the charset 'gb2312' # so body must be decoded explicitly by Hurl before processing any text based assert GET https://example.org/hello_china HTTP 200 [Asserts] header "Content-Type" == "text/html" # Content-Type has no encoding clue, we must decode ourselves the body response. bytes charsetDecode "gb2312" xpath "string(//body)" == "你好世界" ``` When the encoding is UTF-8 (i.e. `charsetDecode "utf-8"`), [an `utf8Decode` filter] can be used instead. ### count Counts the number of items in a collection. ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.books" count == 12 ``` ### dateFormat Formerly known as `format`, which is deprecated and will be removed in a future major version. Formats a date to a string given [a specification format]. ```hurl GET https://example.org HTTP 200 [Asserts] cookie "LSID[Expires]" dateFormat "%a, %d %b %Y %H:%M:%S" == "Wed, 13 Jan 2021 22:23:01" ``` ### daysAfterNow Returns the number of days between now and a date in the future. ```hurl GET https://example.org HTTP 200 [Asserts] certificate "Expire-Date" daysAfterNow > 15 ``` ### daysBeforeNow Returns the number of days between now and a date in the past. ```hurl GET https://example.org HTTP 200 [Asserts] certificate "Start-Date" daysBeforeNow < 100 ``` ### first Returns the first element from a collection. ```hurl GET https://example.org HTTP 200 [Asserts] jsonpath "$.books" first == "Dune" ``` ### htmlEscape Converts the characters `&`, `<` and `>` to HTML-safe sequence. ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.text" htmlEscape == "a > b" ``` ### htmlUnescape Converts all named and numeric character references (e.g. `>`, `>`, `>`) to the corresponding Unicode characters. ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.escaped_html[1]" htmlUnescape == "Foo © bar 𝌆" ``` ### jsonpath Evaluates a [JSONPath] expression. ```hurl GET https://example.org/api HTTP 200 [Captures] books: xpath "string(//body/@data-books)" [Asserts] variable "books" jsonpath "$[0].name" == "Dune" variable "books" jsonpath "$[0].author" == "Franck Herbert" ``` ### last Returns the last element from a collection. ```hurl GET https://example.org HTTP 200 [Asserts] jsonpath "$.books" last == "Les Misérables" ``` ### location Returns the target URL location of a redirection; the returned URL is always absolute, contrary to the `Location` header from which it's originated that can be absolute or relative. ```hurl GET https://example.org/step1 [Options] location: true HTTP 200 [Asserts] redirects count == 2 redirects nth 0 location == "https://example.org/step2" redirects nth 1 location == "https://example.org/step3" ``` ### nth Returns the element from a collection at a zero-based index, accepts negative indices for indexing from the end of the collection. ```hurl GET https://example.org/api HTTP 200 [Asserts] jsonpath "$.books" nth 2 == "Children of Dune" ``` ### regex Extracts regex capture group. Pattern must have at least one capture group. ```hurl GET https://example.org/foo HTTP 200 [Captures] param1: header "header1" param2: header "header2" regex "Hello (.)!" param3: header "header2" regex /Hello (.)!/ param3: header "header2" regex /(?i)Hello (.)!/ ``` The regex syntax is documented at . ### replace Replaces all occurrences of old string with new string. ```hurl GET https://example.org/foo HTTP 200 [Captures] url: jsonpath "$.url" replace "http://" "https://" [Asserts] jsonpath "$.ips" replace ", " "|" == "192.168.2.1|10.0.0.20|10.0.0.10" ``` ### replaceRegex Replaces all occurrences of a pattern with new string. ```hurl GET https://example.org/foo HTTP 200 [Captures] url: jsonpath "$.id" replaceRegex /\d/ "x" [Asserts] jsonpath "$.message" replaceRegex "B[aoi]b" "Dude" == "Welcome Dude!" ``` ### split Splits to a list of strings around occurrences of the specified delimiter. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.ips" split ", " count == 3 ``` ### toDate Converts a string to a date given [a specification format]. ```hurl GET https:///example.org HTTP 200 [Asserts] header "Expires" toDate "%a, %d %b %Y %H:%M:%S GMT" daysBeforeNow > 1000 ``` ISO 8601 / RFC 3339 date and time format have shorthand format `%+`: ```hurl GET https://example.org/api/books HTTP 200 [Asserts] jsonpath "$.published" == "2023-01-23T18:25:43.511Z" jsonpath "$.published" toDate "%Y-%m-%dT%H:%M:%S%.fZ" dateFormat "%A" == "Monday" jsonpath "$.published" toDate "%+" dateFormat "%A" == "Monday" # %+ can be used to parse ISO 8601 / RFC 3339 ``` ### toFloat Converts value to float number. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.pi" toFloat == 3.14 ``` ### toHex Converts bytes to hexadecimal string. ```hurl GET https://example.org/foo HTTP 200 [Asserts] bytes toHex == "d188d0b5d0bbd0bbd18b" ``` ### toInt Converts value to integer number. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.id" toInt == 123 ``` ### toString Converts value to string. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.count" toString == "42" ``` ### urlDecode Replaces %xx escapes with their single-character equivalent. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.encoded_url" urlDecode == "https://mozilla.org/?x=шеллы" ``` ### urlEncode Percent-encodes all the characters which are not included in unreserved chars (see [RFC3986]) except forward slash (/). ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.url" urlEncode == "https%3A//mozilla.org/%3Fx%3D%D1%88%D0%B5%D0%BB%D0%BB%D1%8B" ``` ### urlQueryParam Returns the value of a query parameter in a URL. ```hurl GET https://example.org/foo HTTP 200 [Asserts] jsonpath "$.url" urlQueryParam "x" == "шеллы" ``` ### utf8Decode Decodes bytes to string using UTF-8 encoding. ```hurl GET https://example.org/messages HTTP 200 [Asserts] # From a Base64 string to UTF-8 bytes to final string jsonpath "$.bytesInBase64" base64Decode utf8Decode == "Hello World" ``` ### utf8Encode Encodes a string to bytes using UTF-8 encoding. ```hurl GET https://example.org/drinks HTTP 200 [Asserts] jsonpath "$.beverage" utf8Encode toHex == "636166C3A9" ``` ### xpath Evaluates a [XPath] expression. ```hurl GET https://example.org/hello_gb2312 HTTP 200 [Asserts] bytes charsetDecode "gb2312" xpath "string(//body)" == "你好世界" ``` [Captures]: /docs/capturing-response.md [asserts]: /docs/asserting-response.md [RFC3986]: https://www.rfc-editor.org/rfc/rfc3986 [a specification format]: https://docs.rs/chrono/latest/chrono/format/strftime/index.html [XPath]: https://en.wikipedia.org/wiki/XPath [JSONPath]: https://goessner.net/articles/JsonPath/ [Base64 encoded string]: https://datatracker.ietf.org/doc/html/rfc4648#section-4 [Base64 URL safe encoding]: https://datatracker.ietf.org/doc/html/rfc4648#section-5 [Encoding Standard]: https://encoding.spec.whatwg.org/#concept-encoding-get [an `utf8Decode` filter]: /docs/filters.md#utf8decode [an `utf8Encode` filter]: /docs/filters.md#utf8encode --- ### Frequently Asked Questions (`docs/frequently-asked-questions.md`) # Frequently Asked Questions ## General ### Why "Hurl"? The name Hurl is a tribute to the awesome [curl], with a focus on the HTTP protocol. While it may have an informal meaning not particularly elegant, [other eminent tools] have set a precedent in naming. ### Yet Another Tool, I already use X We think that Hurl has some advantages compared to similar tools. Hurl is foremost a command line tool and should be easy to use on a local computer, or in a CI/CD pipeline. Some tools in the same space as Hurl ([Postman] for instance), are GUI oriented, and we find it less attractive than CLI. As a command line tool, Hurl can be used to get HTTP data (like [curl]), but also as a test tool for HTTP sessions, or even as documentation. Having a text based [file format] is another advantage. The Hurl format is simple, focused on the HTTP domain, can serve as documentation and can be read or written by non-technical people. For instance putting JSON data with Hurl can be done with this simple file: ``` PUT http://localhost:3000/api/login { "username": "xyz", "password": "xyz" } ``` With [curl]: ``` curl --header "Content-Type: application/json" \ --request PUT \ --data '{"username": "xyz","password": "xyz"}' \ http://localhost:3000/api/login ``` [Karate], a tool combining API test automation, mocking, performance-testing, has similar features but offers also much more at a cost of an increased complexity. Comparing Karate file format: ``` Scenario: create and retrieve a cat Given url 'http://myhost.com/v1/cats' And request { name: 'Billie' } When method post Then status 201 And match response == { id: '#notnull', name: 'Billie } Given path response.id When method get Then status 200 ``` And Hurl: ``` # Scenario: create and retrieve a cat POST http://myhost.com/v1/cats { "name": "Billie" } HTTP 201 [Captures] cat_id: jsonpath "$.id" [Asserts] jsonpath "$.name" == "Billie" GET http://myshost.com/v1/cats/{{cat_id}} HTTP 200 ``` A key point of Hurl is to work on the HTTP domain. In particular, there is no JavaScript runtime, Hurl works on the raw HTTP requests/responses, and not on a DOM managed by a HTML engine. For security, this can be seen as a feature: let's say you want to test backend validation, you want to be able to bypass the browser or javascript validations and directly test a backend endpoint. Finally, with no headless browser and working on the raw HTTP data, Hurl is also really reliable with a very small probability of false positives. Integration tests with tools like [Selenium] can, in this regard, be challenging to maintain. Just use what is convenient for you. In our case, it's Hurl! ### Hurl is build on top of libcurl, but what is added? Hurl has two main functionalities on top of [curl]: 1. Chain several requests: With its [captures], it enables to inject data received from a response into following requests. [CSRF tokens] are typical examples in a standard web session. 2. Test HTTP responses: With its [asserts], responses can be easily tested. Hurl benefits from the features of the `libcurl` against it is linked. You can check `libcurl` version with `hurl --version`. For instance on macOS: ```shell $ hurl --version hurl 2.0.0 libcurl/7.79.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.11 nghttp2/1.45.1 Features (libcurl): alt-svc AsynchDNS HSTS HTTP2 IPv6 Largefile libz NTLM NTLM_WB SPNEGO SSL UnixSockets Features (built-in): brotli ``` You can also check which `libcurl` is used. On macOS: ```shell $ which hurl /opt/homebrew/bin/hurl $ otool -L /opt/homebrew/bin/hurl: /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0) /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1858.112.0) /usr/lib/libcurl.4.dylib (compatibility version 7.0.0, current version 9.0.0) /usr/lib/libiconv.2.dylib (compatibility version 7.0.0, current version 7.0.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1311.100.3) ``` On Linux: ```shell $ which hurl /root/.cargo/bin/hurl $ ldd /root/.cargo/bin/hurl ldd /root/.cargo/bin/hurl linux-vdso.so.1 (0x0000ffff8656a000) libxml2.so.2 => /usr/lib/aarch64-linux-gnu/libxml2.so.2 (0x0000ffff85fe8000) libcurl.so.4 => /usr/lib/aarch64-linux-gnu/libcurl.so.4 (0x0000ffff85f45000) libgcc_s.so.1 => /lib/aarch64-linux-gnu/libgcc_s.so.1 (0x0000ffff85f21000) ... libkeyutils.so.1 => /lib/aarch64-linux-gnu/libkeyutils.so.1 (0x0000ffff82ed5000) libffi.so.7 => /usr/lib/aarch64-linux-gnu/libffi.so.7 (0x0000ffff82ebc000) ``` Note that some Hurl features are dependent on `libcurl` capacities: for instance, if your `libcurl` doesn't support HTTP/2 Hurl won't be able to send HTTP/2 request. ### Why shouldn't I use Hurl? If you need a GUI. Currently, Hurl does not offer a GUI version (like [Postman]). While we think that it can be useful, we prefer to focus for the time-being on the core, keeping something simple and fast. Contributions to build a GUI are welcome. ### I have a large numbers of tests, how to run just specific tests? By convention, you can organize Hurl files into different folders or prefix them. For example, you can split your tests into two folders critical and additional. ``` critical/test1.hurl critical/test2.hurl additional/test1.hurl additional/test2.hurl ``` You can simply run your critical tests with ```shell $ hurl --test critical/.hurl ``` ### How can I use my Hurl files outside Hurl? Hurl file can be exported to a JSON file with `hurlfmt`. This JSON file can then be easily parsed for converting a different format, getting ad-hoc information,... For example, the Hurl file ```hurl GET https://example.org/api/users/1 User-Agent: Custom HTTP 200 [Asserts] jsonpath "$.name" == "Bob" ``` will be converted to JSON with the following command: ```shell $ hurlfmt test.hurl --out json | jq { "entries": [ { "request": { "method": "GET", "url": "https://example.org/api/users/1", "headers": [ { "name": "User-Agent", "value": "Custom" } ] }, "response": { "version": "HTTP", "status": 200, "asserts": [ { "query": { "type": "jsonpath", "expr": "$.name" }, "predicate": { "type": "==", "value": "Bob" } } ] } } ] } ``` ### Can I do calculation within a Hurl file? Currently, the templating is very simple, only accessing variables. Calculations can be done beforehand, before running the Hurl File. For example, with date calculations, variables `now` and `tomorrow` can be used as param or expected value. ```shell $ TODAY=$(date '+%y%m%d') $ TOMORROW=$(date '+%y%m%d' -d"+1days") $ hurl --variable "today=$TODAY" --variable "tomorrow=$TOMORROW" test.hurl ``` You can also use environment variables that begins with `HURL_VARIABLE_` to inject data in an Hurl file. For instance, to inject `today` and `tomorrow` variables: ```shell $ export HURL_VARIABLE_today=$(date '+%y%m%d') $ export HURL_VARIABLE_tomorrow=$(date '+%y%m%d' -d"+1days") $ hurl test.hurl ``` You can also use [filters] to process HTTP responses in asserts and captures. ## macOS ### How can I use a custom libcurl (from Homebrew by instance)? No matter how you've installed Hurl (using the precompiled binary for macOS or with [Homebrew]) Hurl is linked against the built-in system libcurl. If you want to use another libcurl (for instance, if you've installed curl with Homebrew and want Hurl to use Homebrew's libcurl), you can patch Hurl with the following command: ```shell $ sudo install_name_tool -change /usr/lib/libcurl.4.dylib PATH_TO_CUSTOM_LIBCURL PATH_TO_HURL_BIN ``` For instance: ```shell # /usr/local/opt/curl/lib/libcurl.4.dylib is installed by `brew install curl` $ sudo install_name_tool -change /usr/lib/libcurl.4.dylib /usr/local/opt/curl/lib/libcurl.4.dylib /usr/local/bin/hurl ``` [curl]: https://curl.haxx.se [other eminent tools]: https://git.wiki.kernel.org/index.php/GitFaq#Why_the_.27Git.27_name.3F [Postman]: https://www.postman.com [file format]: /docs/hurl-file.md [Karate]: https://github.com/intuit/karate [Selenium]: https://www.selenium.dev [captures]: /docs/capturing-response.md [CSRF tokens]: https://en.wikipedia.org/wiki/Cross-site_request_forgery [asserts]: /docs/asserting-response.md [Homebrew]: https://brew.sh [filters]: /docs/filters.md --- ### Grammar (`docs/grammar.md`) # Grammar ## Definitions Short description: - operator | denotes alternative, - operator * denotes iteration (zero or more), - operator + denotes iteration (one or more), ## Syntax Grammar
General
hurl-file
entry*
lt*

entry(used by hurl-file)
request
response?

request(used by entry)
lt*
method sp value-string lt
header*
request-section*
body?

response(used by entry)
lt*
version sp status lt
header*
response-section*
body?

method(used by request)
[A-Z]+

version(used by response)
HTTP/1.0
|HTTP/1.1
|HTTP/2
|HTTP

status(used by response)
[0-9]+

header(used by request, response)
lt*
key-value lt

body(used by request, response)
lt*
bytes lt

Sections
request-section(used by request)
basic-auth-section
|query-string-params-section
|form-params-section
|multipart-form-data-section
|cookies-section
|options-section

response-section(used by response)
captures-section
|asserts-section

query-string-params-section(used by request-section)
lt*
([QueryStringParams]|[Query]) lt
key-value*

form-params-section(used by request-section)
lt*
([FormParams]|[Form]) lt
key-value*

multipart-form-data-section(used by request-section)
lt*
([MultipartFormData]|[Multipart]) lt
multipart-form-data-param*

cookies-section(used by request-section)
lt*
[Cookies] lt
key-value*

captures-section(used by response-section)
lt*
[Captures] lt
capture*

asserts-section(used by response-section)
lt*
[Asserts] lt
assert*

basic-auth-section(used by request-section)
lt*
[BasicAuth] lt
key-value*

options-section(used by request-section)
lt*
[Options] lt
option*

key-value(used by header, query-string-params-section, form-params-section, cookies-section, basic-auth-section, multipart-form-data-param)
key-string : value-string

multipart-form-data-param(used by multipart-form-data-section)
filename-param|key-value

filename-param(used by multipart-form-data-param)
lt*
key-string : filename-value lt

filename-value(used by filename-param)
file, filename ; (filename-content-type)?

filename-content-type(used by filename-value)
value-string

capture(used by captures-section)
lt*
key-string : query (sp filter)* (sp redact)? lt

assert(used by asserts-section)
lt*
query (sp filter)* sp predicate lt

option(used by options-section)
lt*
(aws-sigv4-option|ca-certificate-option|client-certificate-option|client-key-option|compressed-option|connect-to-option|connect-timeout-option|delay-option|digest-option|fail-with-body-option|follow-redirect-option|follow-redirect-trusted-option|header-option|http10-option|http11-option|http2-option|http3-option|insecure-option|ipv4-option|ipv6-option|limit-rate-option|max-redirs-option|max-time-option|negotiate-option|netrc-option|netrc-file-option|netrc-optional-option|output-option|path-as-is-option|pinned-public-key-option|proxy-option|repeat-option|resolve-option|retry-option|retry-interval-option|skip-option|unix-socket-option|user-option|variable-option|variables-file-option|verbose-option|verbosity-option|very-verbose-option)

aws-sigv4-option(used by option)
aws-sigv4 : value-string lt

ca-certificate-option(used by option)
cacert : filename lt

client-certificate-option(used by option)
cert : filename-password lt

client-key-option(used by option)
key : value-string lt

compressed-option(used by option)
compressed : boolean-option lt

connect-to-option(used by option)
connect-to : value-string lt

connect-timeout-option(used by option)
connect-timeout : duration-option lt

delay-option(used by option)
delay : duration-option lt

digest-option(used by option)
digest : boolean-option lt

fail-with-body-option(used by option)
fail-with-body : boolean-option lt

follow-redirect-option(used by option)
location : boolean-option lt

follow-redirect-trusted-option(used by option)
location-trusted : boolean-option lt

header-option(used by option)
header : value-string lt

http10-option(used by option)
http1.0 : boolean-option lt

http11-option(used by option)
http1.1 : boolean-option lt

http2-option(used by option)
http2 : boolean-option lt

http3-option(used by option)
http3 : boolean-option lt

insecure-option(used by option)
insecure : boolean-option lt

ipv4-option(used by option)
ipv4 : boolean-option lt

ipv6-option(used by option)
ipv6 : boolean-option lt

limit-rate-option(used by option)
limit-rate : integer-option lt

max-redirs-option(used by option)
max-redirs : integer-option lt

max-time-option(used by option)
max-time : integer-option lt

negotiate-option(used by option)
negotiate : boolean-option lt

netrc-option(used by option)
netrc : boolean-option lt

netrc-file-option(used by option)
netrc-file : value-string lt

netrc-optional-option(used by option)
netrc-optional : boolean-option lt

output-option(used by option)
output : value-string lt

path-as-is-option(used by option)
path-as-is : boolean-option lt

pinned-public-key-option(used by option)
pinnedpubkey : value-string lt

proxy-option(used by option)
proxy : value-string lt

resolve-option(used by option)
resolve : value-string lt

repeat-option(used by option)
repeat : integer-option lt

retry-option(used by option)
retry : integer-option lt

retry-interval-option(used by option)
retry-interval : duration-option lt

skip-option(used by option)
skip : boolean-option lt

unix-socket-option(used by option)
unix-socket : value-string lt

user-option(used by option)
user : value-string lt

variable-option(used by option)
variable : variable-definition lt

variables-file-option(used by option)
variables-file : filename lt

verbose-option(used by option)
verbose : boolean-option lt

verbosity-option(used by option)
verbosity : (brief|verbose|debug)

very-verbose-option(used by option)
very-verbose : boolean-option lt

variable-definition(used by variable-option)
variable-name = variable-value

boolean-option(used by compressed-option, digest-option, fail-with-body-option, follow-redirect-option, follow-redirect-trusted-option, http10-option, http11-option, http2-option, http3-option, insecure-option, ipv4-option, ipv6-option, negotiate-option, netrc-option, netrc-optional-option, path-as-is-option, skip-option, verbose-option, very-verbose-option)
boolean|placeholder

integer-option(used by limit-rate-option, max-redirs-option, max-time-option, repeat-option, retry-option)
integer|placeholder

duration-option(used by connect-timeout-option, delay-option, retry-interval-option)
(integer duration-unit?)|placeholder

duration-unit(used by duration-option)
ms|s|m

variable-value(used by variable-definition)
null
|boolean
|integer
|float
|key-string
|quoted-string

Query
query(used by capture, assert)
status-query
|version-query
|url-query
|ip-query
|header-query
|certificate-query
|cookie-query
|body-query
|xpath-query
|jsonpath-query
|regex-query
|variable-query
|duration-query
|bytes-query
|sha256-query
|md5-query

status-query(used by query)
status

version-query(used by query)
version

url-query(used by query)
url

ip-query(used by query)
ip

header-query(used by query)
header sp quoted-string

certificate-query(used by query)
certificate sp (Subject|Issuer|Start-Date|Expire-Date|Serial-Number)

cookie-query(used by query)
cookie sp quoted-string

body-query(used by query)
body

xpath-query(used by query)
xpath sp quoted-string

jsonpath-query(used by query)
jsonpath sp quoted-string

regex-query(used by query)
regex sp (quoted-string|regex)

variable-query(used by query)
variable sp quoted-string

duration-query(used by query)
duration

sha256-query(used by query)
sha256

md5-query(used by query)
md5

bytes-query(used by query)
bytes

Predicates
predicate(used by assert)
(not sp)? predicate-func

predicate-func(used by predicate)
equal-predicate
|boolean-predicate
|contain-predicate
|end-with-predicate
|exist-predicate
|greater-or-equal-predicate
|greater-predicate
|include-predicate
|is-collection-predicate
|is-date-predicate
|is-float-predicate
|is-empty-predicate
|is-integer-predicate
|is-ipv4-predicate
|is-ipv6-predicate
|is-iso-date-predicate
|is-list
|is-object
|is-string-predicate
|is-uuid-predicate
|less-or-equal-predicate
|less-predicate
|match-predicate
|not-equal-predicate
|start-with-predicate

equal-predicate(used by predicate-func)
== sp predicate-value

boolean-predicate(used by predicate-func)
isBoolean

contain-predicate(used by predicate-func)
contains sp quoted-string

end-with-predicate(used by predicate-func)
endsWith sp (quoted-string|oneline-hex|oneline-base64)

exist-predicate(used by predicate-func)
exists

greater-or-equal-predicate(used by predicate-func)
>= sp (number|quoted-string|placeholder)

greater-predicate(used by predicate-func)
> sp (number|quoted-string|placeholder)

include-predicate(used by predicate-func)
includes sp predicate-value

is-collection-predicate(used by predicate-func)
isCollection

is-date-predicate(used by predicate-func)
isDate

is-empty-predicate(used by predicate-func)
isEmpty

is-float-predicate(used by predicate-func)
isFloat

is-integer-predicate(used by predicate-func)
isInteger

is-ipv4-predicate(used by predicate-func)
isIpv4

is-ipv6-predicate(used by predicate-func)
isIpv6

is-iso-date-predicate(used by predicate-func)
isIsoDate

is-list(used by predicate-func)
isList

is-object(used by predicate-func)
isObject

is-string-predicate(used by predicate-func)
isString

is-uuid-predicate(used by predicate-func)
isUuid

less-or-equal-predicate(used by predicate-func)
<= sp (number|quoted-string|placeholder)

less-predicate(used by predicate-func)
< sp (number|quoted-string|placeholder)

match-predicate(used by predicate-func)
matches sp (quoted-string|regex)

not-equal-predicate(used by predicate-func)
!= sp predicate-value

start-with-predicate(used by predicate-func)
startsWith sp (quoted-string|oneline-hex|oneline-base64)

predicate-value(used by equal-predicate, include-predicate, not-equal-predicate)
boolean
|multiline-string
|null
|number
|oneline-string
|oneline-base64
|oneline-file
|oneline-hex
|quoted-string
|placeholder

Bytes
bytes(used by body)
json-value
|xml
|multiline-string
|oneline-string
|oneline-base64
|oneline-file
|oneline-hex

xml(used by bytes)
< To Be Defined >

oneline-base64(used by end-with-predicate, start-with-predicate, predicate-value, bytes)
base64, [A-Z0-9+-= \n]+ ;

oneline-file(used by predicate-value, bytes)
file, filename ;

oneline-hex(used by end-with-predicate, start-with-predicate, predicate-value, bytes)
hex, hexdigit* ;

Strings
quoted-string(used by variable-value, header-query, cookie-query, xpath-query, jsonpath-query, regex-query, variable-query, contain-predicate, end-with-predicate, greater-or-equal-predicate, greater-predicate, less-or-equal-predicate, less-predicate, match-predicate, start-with-predicate, predicate-value, charset-decode-filter, date-format-filter, jsonpath-filter, regex-filter, replace-filter, replace-regex-filter, split-filter, to-date-filter, url-query-param-filter, xpath-filter)
" (quoted-string-content|placeholder)* "

quoted-string-content(used by quoted-string)
(quoted-string-text|quoted-string-escaped-char)*

quoted-string-text(used by quoted-string-content)
~["\\]+

quoted-string-escaped-char(used by quoted-string-content)
\ ("|\|\b|\f|\n|\r|\t|\u unicode-char)

key-string(used by key-value, filename-param, capture, variable-value)
(key-string-content|placeholder)+

key-string-content(used by key-string)
(key-string-text|key-string-escaped-char)*

key-string-text(used by key-string-content)
(alphanum|_|-|.|[|]|@|$)+

key-string-escaped-char(used by key-string-content)
\ (#|:|\|\b|\f|\n|\r|\t|\u unicode-char)

value-string(used by request, key-value, filename-content-type, aws-sigv4-option, client-key-option, connect-to-option, header-option, netrc-file-option, output-option, pinned-public-key-option, proxy-option, resolve-option, unix-socket-option, user-option)
(value-string-content|placeholder)*

value-string-content(used by value-string)
(value-string-text|value-string-escaped-char)*

value-string-text(used by value-string-content)
~[#\n\\]+

value-string-escaped-char(used by value-string-content)
\ (#|\|\b|\f|\n|\r|\t|\u unicode-char)

oneline-string(used by predicate-value, bytes)
` (oneline-string-content|placeholder)* `

oneline-string-content(used by oneline-string)
(oneline-string-text|oneline-string-escaped-char)*

oneline-string-text(used by oneline-string-content)
~[#\n\\] ~`

oneline-string-escaped-char(used by oneline-string-content)
\ (`|#|\|b|f|u unicode-char)

multiline-string(used by predicate-value, bytes)
``` multiline-string-type? lt
(multiline-string-content|placeholder)* lt
```

multiline-string-type(used by multiline-string)
base64
|hex
|json
|xml
|graphql
|raw

multiline-string-content(used by multiline-string)
(multiline-string-text|multiline-string-escaped-char)*

multiline-string-text(used by multiline-string-content)
~[\\]+ ~```

multiline-string-escaped-char(used by multiline-string-content)
\ (\|b|f|n|r|t|`|u unicode-char)

filename(used by filename-value, ca-certificate-option, variables-file-option, oneline-file)
(filename-content|placeholder)*

filename-content(used by filename)
(filename-text|filename-escaped-char)*

filename-text(used by filename-content)
~[#;{} \n\r\\]+

filename-escaped-char(used by filename-content)
\ (\|b|f|n|r|t|#|;| |{|}|u unicode-char)

filename-password(used by client-certificate-option)
(filename-password-content|placeholder)*

filename-password-content(used by filename-password)
(filename-password-text|filename-password-escaped-char)*

filename-password-text(used by filename-password-content)
~[#;{} \n\r\\]+

filename-password-escaped-char(used by filename-password-content)
\ (\|b|f|n|r|t|#|;| |{|}|:|u unicode-char)

unicode-char(used by quoted-string-escaped-char, key-string-escaped-char, value-string-escaped-char, oneline-string-escaped-char, multiline-string-escaped-char, filename-escaped-char, filename-password-escaped-char)
{ hexdigit+ }

JSON
json-value(used by bytes, json-key-value, json-array)
placeholder
|json-object
|json-array
|json-string
|json-number
|boolean
|null

json-object(used by json-value)
{ json-key-value (, json-key-value)* }

json-key-value(used by json-object)
json-string : json-value

json-array(used by json-value)
[ json-value (, json-value)* ]

json-string(used by json-value, json-key-value)
" (json-string-content|placeholder)* "

json-string-content(used by json-string)
json-string-text|json-string-escaped-char

json-string-text(used by json-string-content)
~["\\]

json-string-escaped-char(used by json-string-content)
\ ("|\|b|f|n|r|t|u hexdigit hexdigit hexdigit hexdigit)

json-number(used by json-value)
[-]? json-integer fraction? exponent?

json-integer(used by json-number)
0|[1-9] digit*

Expression
placeholder(used by boolean-option, integer-option, duration-option, greater-or-equal-predicate, greater-predicate, less-or-equal-predicate, less-predicate, predicate-value, quoted-string, key-string, value-string, oneline-string, multiline-string, filename, filename-password, json-value, json-string, nth-filter)
{{ expr }}

expr(used by placeholder)
(variable-name|function) (sp filter)*

variable-name(used by variable-definition, expr)
[A-Za-z] [A-Za-z_-0-9]*

Function
function(used by expr)
env-function
|now-function
|uuid-function

env-function(used by function)
getEnv

now-function(used by function)
newDate

uuid-function(used by function)
newUuid

Filter
filter(used by capture, assert, expr)
base64-decode-filter
|base64-encode-filter
|base64-url-safe-decode-filter
|base64-url-safe-encode-filter
|charset-decode-filter
|count-filter
|days-after-now-filter
|days-before-now-filter
|first-filter
|date-format-filter
|html-escape-filter
|html-unescape-filter
|jsonpath-filter
|last-filter
|location-filter
|nth-filter
|regex-filter
|replace-filter
|replace-regex-filter
|split-filter
|to-date-filter
|to-float-filter
|to-hex-filter
|to-int-filter
|to-string-filter
|url-decode-filter
|url-encode-filter
|url-query-param-filter
|utf8-decode-filter
|utf8-encode-filter
|xpath-filter

base64-decode-filter(used by filter)
base64Decode

base64-encode-filter(used by filter)
base64Encode

base64-url-safe-decode-filter(used by filter)
base64UrlSafeDecode

base64-url-safe-encode-filter(used by filter)
base64UrlSafeEncode

charset-decode-filter(used by filter)
charsetDecode sp quoted-string

count-filter(used by filter)
count

days-after-now-filter(used by filter)
daysAfterNow

days-before-now-filter(used by filter)
daysBeforeNow

first-filter(used by filter)
first

date-format-filter(used by filter)
dateFormat sp quoted-string

html-escape-filter(used by filter)
htmlEscape

html-unescape-filter(used by filter)
htmlUnescape

jsonpath-filter(used by filter)
jsonpath sp quoted-string

last-filter(used by filter)
last

location-filter(used by filter)
location

nth-filter(used by filter)
nth sp (integer|placeholder)

regex-filter(used by filter)
regex sp (quoted-string|regex)

replace-filter(used by filter)
replace sp quoted-string sp quoted-string

replace-regex-filter(used by filter)
replaceRegex sp (quoted-string|regex) sp quoted-string

split-filter(used by filter)
split sp quoted-string

to-date-filter(used by filter)
toDate sp quoted-string

to-float-filter(used by filter)
toFloat

to-hex-filter(used by filter)
toHex

to-int-filter(used by filter)
toInt

to-string-filter(used by filter)
toString

url-decode-filter(used by filter)
urlDecode

url-encode-filter(used by filter)
urlEncode

url-query-param-filter(used by filter)
urlQueryParam sp quoted-string

utf8-decode-filter(used by filter)
utf8Decode

utf8-encode-filter(used by filter)
utf8Encode

xpath-filter(used by filter)
xpath sp quoted-string

Lexical Grammar
boolean(used by boolean-option, variable-value, predicate-value, json-value)
true|false

null(used by variable-value, predicate-value, json-value)
null

alphanum(used by key-string-text)
[A-Za-z0-9]

integer(used by integer-option, duration-option, variable-value, nth-filter, float, number)
digit+

float(used by variable-value, number)
integer fraction

number(used by greater-or-equal-predicate, greater-predicate, less-or-equal-predicate, less-predicate, predicate-value)
integer|float

digit(used by json-integer, integer, fraction, exponent)
[0-9]

hexdigit(used by oneline-hex, unicode-char, json-string-escaped-char)
[0-9A-Fa-f]

fraction(used by json-number, float)
. digit+

exponent(used by json-number)
(e|E) (+|-)? digit+

sp(used by request, response, capture, assert, header-query, certificate-query, cookie-query, xpath-query, jsonpath-query, regex-query, variable-query, predicate, equal-predicate, contain-predicate, end-with-predicate, greater-or-equal-predicate, greater-predicate, include-predicate, less-or-equal-predicate, less-predicate, match-predicate, not-equal-predicate, start-with-predicate, expr, charset-decode-filter, date-format-filter, jsonpath-filter, nth-filter, regex-filter, replace-filter, replace-regex-filter, split-filter, to-date-filter, url-query-param-filter, xpath-filter, lt)
[ \t]

lt(used by hurl-file, request, response, header, body, query-string-params-section, form-params-section, multipart-form-data-section, cookies-section, captures-section, asserts-section, basic-auth-section, options-section, filename-param, capture, assert, option, aws-sigv4-option, ca-certificate-option, client-certificate-option, client-key-option, compressed-option, connect-to-option, connect-timeout-option, delay-option, digest-option, fail-with-body-option, follow-redirect-option, follow-redirect-trusted-option, header-option, http10-option, http11-option, http2-option, http3-option, insecure-option, ipv4-option, ipv6-option, limit-rate-option, max-redirs-option, max-time-option, negotiate-option, netrc-option, netrc-file-option, netrc-optional-option, output-option, path-as-is-option, pinned-public-key-option, proxy-option, resolve-option, repeat-option, retry-option, retry-interval-option, skip-option, unix-socket-option, user-option, variable-option, variables-file-option, verbose-option, very-verbose-option, multiline-string)
sp* comment? [\n]?

comment(used by lt)
# ~[\n]*

regex(used by regex-query, match-predicate, regex-filter, replace-regex-filter)
/ regex-content /

regex-content(used by regex)
(regex-text|regex-escaped-char)*

regex-text(used by regex-content)
~[\n\/]+

regex-escaped-char(used by regex-content)
\ ~[\n]

--- ### Home (`docs/home.md`)

# What's Hurl? Hurl is a command line tool that runs HTTP requests defined in a simple plain text format. It can chain requests, capture values and evaluate queries on headers and body response. Hurl is very versatile: it can be used for both fetching data and testing HTTP sessions. Hurl makes it easy to work with HTML content, REST / SOAP / GraphQL APIs, or any other XML / JSON based APIs. ```hurl # Go home and capture token GET https://example.org HTTP 200 [Captures] csrf_token: xpath "string(//meta[@name='_csrf_token']/@content)" # Do login! POST https://example.org/login [Form] user: toto password: 1234 token: {{csrf_token}} HTTP 302 ``` Chaining multiple requests is easy: ```hurl GET https://example.org/api/health GET https://example.org/api/step1 GET https://example.org/api/step2 GET https://example.org/api/step3 ``` # Also an HTTP Test Tool Hurl can run HTTP requests but can also be used to test HTTP responses. Different types of queries and predicates are supported, from [XPath] and [JSONPath] on body response, to assert on status code and response headers.
It is well adapted for REST / JSON APIs ```hurl POST https://example.org/api/tests { "id": "4568", "evaluate": true } HTTP 200 [Asserts] header "X-Frame-Options" == "SAMEORIGIN" jsonpath "$.status" == "RUNNING" # Check the status code jsonpath "$.tests" count == 25 # Check the number of items jsonpath "$.id" matches /\d{4}/ # Check the format of the id ``` HTML content ```hurl GET https://example.org HTTP 200 [Asserts] xpath "normalize-space(//head/title)" == "Hello world!" ``` GraphQL ~hurl POST https://example.org/graphql ```graphql { human(id: "1000") { name height(unit: FOOT) } } ``` HTTP 200 ~ and even SOAP APIs ```hurl POST https://example.org/InStock Content-Type: application/soap+xml; charset=utf-8 SOAPAction: "http://www.w3.org/2003/05/soap-envelope" GOOG HTTP 200 ``` Hurl can also be used to test the performance of HTTP endpoints ```hurl GET https://example.org/api/v1/pets HTTP 200 [Asserts] duration < 1000 # Duration in ms ``` And check response bytes ```hurl GET https://example.org/data.tar.gz HTTP 200 [Asserts] sha256 == hex,039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81; ``` Finally, Hurl is easy to integrate in CI/CD, with text, JUnit, TAP and HTML reports

# Why Hurl?

Text Format
For both devops and developers

Fast CLI
A command line for local dev and continuous integration

Single Binary
Easy to install, with no runtime required

# Powered by curl Hurl is a lightweight binary written in [Rust]. Under the hood, Hurl HTTP engine is powered by [libcurl], one of the most powerful and reliable file transfer libraries. With its text file format, Hurl adds syntactic sugar to run and test HTTP requests, but it's still the [curl] that we love: fast, efficient and IPv6 / HTTP/3 ready. # Feedbacks To support its development, [star Hurl on GitHub]! [Feedback, suggestion, bugs or improvements] are welcome. ```hurl POST https://hurl.dev/api/feedback { "name": "John Doe", "feedback": "Hurl is awesome!" } HTTP 200 ``` # Resources [License] [Blog] [Tutorial] [Documentation] (download [HTML], [PDF], [Markdown]) [GitHub] [XPath]: https://en.wikipedia.org/wiki/XPath [JSONPath]: https://goessner.net/articles/JsonPath/ [Rust]: https://www.rust-lang.org [curl]: https://curl.se [the installation section]: /docs/installation.md [Feedback, suggestion, bugs or improvements]: https://github.com/Orange-OpenSource/hurl/issues [License]: /docs/license.md [Tutorial]: /docs/tutorial/your-first-hurl-file.md [Documentation]: /docs/installation.md [Blog]: blog.md [GitHub]: https://github.com/Orange-OpenSource/hurl [libcurl]: https://curl.se/libcurl/ [star Hurl on GitHub]: https://github.com/Orange-OpenSource/hurl/stargazers [HTML]: /docs/standalone/hurl-8.0.0.html [PDF]: /docs/standalone/hurl-8.0.0.pdf [Markdown]: /docs/standalone/hurl-8.0.0.md --- ### Hurl File (`docs/hurl-file.md`) # Hurl File ## Character Encoding Hurl file should be encoded in UTF-8, without a byte order mark at the beginning (while Hurl ignores the presence of a byte order mark rather than treating it as an error) ## File Extension Hurl file extension is `.hurl` ## Comments Comments begin with `#` and continue until the end of line. Hurl file can serve as a documentation for HTTP based workflows so it can be useful to be very descriptive. ```hurl # A very simple Hurl file # with tasty comments... GET https://www.sample.net x-app: MY_APP # Add a dummy header HTTP 302 # Check that we have a redirection [Asserts] header "Location" exists header "Location" contains "login" # Check that we are redirected to the login page ``` ## Special Characters in Strings String can include the following special characters: - The escaped special characters \" (double quotation mark), \\ (backslash), \b (backspace), \f (form feed), \n (line feed), \r (carriage return), and \t (horizontal tab) - An arbitrary Unicode scalar value, written as \u{n}, where n is a 1–8 digit hexadecimal number ```hurl GET https://example.org/api HTTP 200 # The following assert are equivalent: [Asserts] jsonpath "$.slideshow.title" == "A beautiful ✈!" jsonpath "$.slideshow.title" == "A beautiful \u{2708}!" ``` In some case, (in headers value, etc..), you will also need to escape # to distinguish it from a comment. In the following example: ```hurl GET https://example.org/api x-token: BEEF \#STEAK # Some comment HTTP 200 ``` We're sending a header `x-token` with value `BEEF #STEAK` --- ### Installation (`docs/installation.md`) # Installation ## Binaries Installation ### Linux Precompiled binary (depending on libc >=2.35) is available at [Hurl latest GitHub release]: ```shell $ INSTALL_DIR=/tmp $ VERSION=8.0.1 $ curl --silent --location https://github.com/Orange-OpenSource/hurl/releases/download/$VERSION/hurl-$VERSION-x86_64-unknown-linux-gnu.tar.gz | tar xvz -C $INSTALL_DIR $ export PATH=$INSTALL_DIR/hurl-$VERSION-x86_64-unknown-linux-gnu/bin:$PATH ``` #### Debian / Ubuntu For Debian >=12 / Ubuntu 22.04 and 24.04, Hurl can be installed using a binary .deb file provided in each Hurl release. ```shell $ VERSION=8.0.1 $ curl --location --remote-name https://github.com/Orange-OpenSource/hurl/releases/download/$VERSION/hurl_${VERSION}_amd64.deb $ sudo apt update && sudo apt install ./hurl_${VERSION}_amd64.deb ``` For Ubuntu >=22.04, Hurl can be installed from `ppa:lepapareil/hurl` ```shell $ VERSION=8.0.1 $ sudo apt-add-repository -y ppa:lepapareil/hurl $ sudo apt install hurl="${VERSION}"* ``` #### Alpine Hurl is available on `testing` channel. ```shell $ apk add --repository http://dl-cdn.alpinelinux.org/alpine/edge/testing hurl ``` #### Arch Linux / Manjaro Hurl is available on [extra] channel. ```shell $ pacman -Sy hurl ``` #### NixOS / Nix [NixOS / Nix package] is available on stable channel. #### Guix ```shell $ guix install hurl ``` ### macOS Precompiled binaries for Intel and ARM CPUs are available at [Hurl latest GitHub release]. #### Homebrew ```shell $ brew install hurl ``` #### MacPorts ```shell $ sudo port install hurl ``` ### FreeBSD ```shell $ sudo pkg install hurl ``` ### Windows Windows requires the [Visual C++ Redistributable Package] to be installed manually, as this is not included in the installer. #### Zip File Hurl can be installed from a standalone zip file at [Hurl latest GitHub release]. You will need to update your `PATH` variable. #### Installer An executable installer is also available at [Hurl latest GitHub release]. #### Chocolatey ```shell $ choco install hurl ``` #### Scoop ```shell $ scoop install hurl ``` #### Windows Package Manager ```shell $ winget install hurl ``` ### Cargo If you're a Rust programmer, Hurl can be installed with cargo. ```shell $ cargo install --locked hurl ``` ### conda-forge ```shell $ conda install -c conda-forge hurl ``` Hurl can also be installed with [`conda-forge`] powered package manager like [`pixi`]. ### Docker ```shell $ docker pull ghcr.io/orange-opensource/hurl:latest ``` ### npm ```shell $ npm install --save-dev @orangeopensource/hurl ``` ## Building From Sources Hurl sources are available in [GitHub]. ### Build on Linux Hurl depends on libssl, libcurl and libxml2 native libraries. You will need their development files in your platform. #### Debian based distributions ```shell $ apt install build-essential pkg-config libssl-dev libcurl4-openssl-dev libxml2-dev libclang-dev ``` #### Fedora based distributions ```shell $ dnf install pkgconf-pkg-config gcc openssl-devel libxml2-devel clang-devel ``` #### Red Hat based distributions ```shell $ yum install pkg-config gcc openssl-devel libxml2-devel clang-devel ``` #### Arch based distributions ```shell $ pacman -S pkgconf gcc glibc openssl libxml2 clang ``` #### Alpine based distributions ```shell $ apk add curl-dev gcc libxml2-dev musl-dev openssl-dev clang-dev ``` ### Build on macOS ```shell $ xcode-select --install $ brew install pkg-config openssl ``` Hurl is written in [Rust]. You should [install] the latest stable release. ```shell $ curl https://sh.rustup.rs -sSf | sh -s -- -y $ source $HOME/.cargo/env $ rustc --version $ cargo --version ``` Then build hurl: ```shell $ git clone https://github.com/Orange-OpenSource/hurl $ cd hurl $ cargo build --release $ ./target/release/hurl --version ``` ### Build on Windows Please follow the [contrib on Windows section]. [GitHub]: https://github.com/Orange-OpenSource/hurl [Hurl latest GitHub release]: https://github.com/Orange-OpenSource/hurl/releases/latest [Visual C++ Redistributable Package]: https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170#latest-microsoft-visual-c-redistributable-version [install]: https://www.rust-lang.org/tools/install [Rust]: https://www.rust-lang.org [contrib on Windows section]: https://github.com/Orange-OpenSource/hurl/blob/master/contrib/windows/README.md [NixOS / Nix package]: https://search.nixos.org/packages?from=0&size=1&sort=relevance&type=packages&query=hurl [`conda-forge`]: https://conda-forge.org [`pixi`]: https://prefix.dev [extra]: https://archlinux.org/packages/extra/x86_64/hurl/ --- ### License (`docs/license.md`) # License ``` /* Detailed source-code truncated for AI context efficiency. / ``` --- ### Manual (`docs/manual.md`) # Manual ## Name hurl - run and test HTTP requests. ## Synopsis hurl [OPTIONS] [FILES...] hurl --test [OPTIONS] [FILES...] ## Description Hurl is a command line tool that runs HTTP requests defined in a simple plain text format. It can chain requests, capture values and evaluate queries on headers and body response. Hurl is very versatile, it can be used for fetching data and testing HTTP sessions: HTML content, REST / SOAP / GraphQL APIs, or any other XML / JSON based APIs. ```shell $ hurl session.hurl ``` If no input files are specified, input is read from stdin. ```shell $ echo GET http://httpbin.org/get | hurl { "args": {}, "headers": { "Accept": "/*", "Accept-Encoding": "gzip", "Content-Length": "0", "Host": "httpbin.org", "User-Agent": "hurl/0.99.10", "X-Amzn-Trace-Id": "Root=1-5eedf4c7-520814d64e2f9249ea44e0" }, "origin": "1.2.3.4", "url": "http://httpbin.org/get" } ``` Hurl can take files as input, or directories. In the latter case, Hurl will search files with `.hurl` extension recursively. Output goes to stdout by default. To have output go to a file, use the [`-o, --output`](#output) option: ```shell $ hurl -o output input.hurl ``` By default, Hurl executes all HTTP requests and outputs the response body of the last HTTP call. To have a test oriented output, you can use [`--test`](#test) option: ```shell $ hurl --test .hurl ``` ## Hurl File Format The Hurl file format is fully documented in [https://hurl.dev/docs/hurl-file.html](https://hurl.dev/docs/hurl-file.html) It consists of one or several HTTP requests ```hurl GET http://example.org/endpoint1 GET http://example.org/endpoint2 ``` ### Capturing values A value from an HTTP response can be-reused for successive HTTP requests. A typical example occurs with CSRF tokens. ```hurl GET https://example.org HTTP 200 # Capture the CSRF token value from html body. [Captures] csrf_token: xpath "normalize-space(//meta[@name='_csrf_token']/@content)" # Do the login ! POST https://example.org/login?user=toto&password=1234 X-CSRF-TOKEN: {{csrf_token}} ``` More information on captures can be found here [https://hurl.dev/docs/capturing-response.html](https://hurl.dev/docs/capturing-response.html) ### Asserts The HTTP response defined in the Hurl file are used to make asserts. Responses are optional. At the minimum, response includes assert on the HTTP status code. ```hurl GET http://example.org HTTP 301 ``` It can also include asserts on the response headers ```hurl GET http://example.org HTTP 301 Location: http://www.example.org ``` Explicit asserts can be included by combining a query and a predicate ```hurl GET http://example.org HTTP 301 [Asserts] xpath "string(//title)" == "301 Moved" ``` With the addition of asserts, Hurl can be used as a testing tool to run scenarios. More information on asserts can be found here [https://hurl.dev/docs/asserting-response.html](https://hurl.dev/docs/asserting-response.html) ## Configuration Options that exist in curl have exactly the same semantics. Options specified on the command line are defined for every Hurl file's entry, except if they are tagged as cli-only (can not be defined in the Hurl request `[Options]` entry) For instance: ```shell $ hurl --location foo.hurl ``` will follow redirection for each entry in `foo.hurl`. You can also define an option only for a particular entry with an `[Options]` section. For instance, this Hurl file: ```hurl GET https://example.org HTTP 301 GET https://example.org [Options] location: true HTTP 200 ``` will follow a redirection only for the second entry. Hurl looks also for a configuration file at the following places `$XDG_CONFIG_HOME/hurl/config` if `$XDG_CONFIG_HOME` exists, or `$HOME/.config/hurl/config`. The configuration file is a list of options added to each Hurl run. ```shell $ cat ~/.config/hurl/config # Hurl config file --header x-identifier:quux --verbose --delay=1s --fail-with-body ``` Most of the options can also be defined with environment variables (like `HURL_INSECURE` for [`--insecure`](#insecure)). So, in order to configure Hurl, there are four sources from the lowest priority (most easily overridden) to highest (overrides all others): - Configuration file (ex: `~/.config/hurl/config`) - Environment variables (ex: `export HURL_INSECURE=true`) - Command-line options (ex: `hurl --insecure`) - Options section options (ex: `insecure: true` in file) ## All Options ### HTTP options | Option | Description | |-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `--aws-sigv4 <PROVIDER1[:PROVIDER2[:REGION[:SERVICE]]]>` | Generate an `Authorization` header with an AWS SigV4 signature.

Use [`-u, --user`](#user) to specify Access Key Id (username) and Secret Key (password).

To use temporary session credentials (e.g. for an AWS IAM Role), add the `X-Amz-Security-Token` header containing the session token.
| | `--cacert <FILE>` | Specifies the certificate file for peer verification. The file may contain multiple CA certificates and must be in PEM format.
Normally Hurl is built to use a default file for this, so this option is typically used to alter that default file.
| | `-E, --cert <CERTIFICATE[:PASSWORD]>` | Client certificate file and password.

See also [`--key`](#key).
| | `--compressed` | Request a compressed response using one of the algorithms br, gzip, deflate and automatically decompress the content.

Environment variables: HURL_COMPRESSED
| | `--connect-timeout <SECONDS>` | Maximum time in seconds that you allow Hurl's connection to take.

You can specify time units in the connect timeout expression. Set Hurl to use a connect timeout of 20 seconds with `--connect-timeout 20s` or set it to 35,000 milliseconds with `--connect-timeout 35000ms`. No spaces allowed.

See also [`-m, --max-time`](#max-time).

Environment variables: HURL_CONNECT_TIMEOUT
| | `--connect-to <HOST1:PORT1:HOST2:PORT2>` | For a request to the given HOST1:PORT1 pair, connect to HOST2:PORT2 instead. This option can be used several times in a command line.

See also [`--resolve`](#resolve).
| | `--digest` | Tell Hurl to use HTTP Digest authentication
| | `-H, --header <NAME:VALUE>` | Add an extra header to include in information sent. Can be used several times in a command.

Do not add newlines or carriage returns.

Environment variables: HURL_HEADER='name1:value1|name2:value2' (headers are separated by |)
| | `-0, --http1.0` | Tells Hurl to use HTTP version 1.0 instead of using its internally preferred HTTP version.

Environment variables: HURL_HTTP10
| | `--http1.1` | Tells Hurl to use HTTP version 1.1.

Environment variables: HURL_HTTP11
| | `--http2` | Tells Hurl to use HTTP version 2.
For HTTPS, this means Hurl negotiates HTTP/2 in the TLS handshake. Hurl does this by default.
For HTTP, this means Hurl attempts to upgrade the request to HTTP/2 using the Upgrade: request header.

Environment variables: HURL_HTTP2
| | `--http2-prior-knowledge` | Tells Hurl to issue a non-TLS HTTP request using HTTP/2 directly without HTTP/1.1 Upgrade. It requires prior knowledge that the server supports HTTP/2 straight away. HTTPS requests still do HTTP/2 the standard way with negotiated protocol versions in the TLS handshake.

Environment variables: HURL_HTTP2_PRIOR_KNOWLEDGE
| | `--http3` | Tells Hurl to try HTTP version 3 to the host in the URL, but fallback to earlier HTTP versions if the HTTP/3 connection establishment fails. HTTP/3 is only available for HTTPS and not for HTTP URLs.

Environment variables: HURL_HTTP3
| | `-k, --insecure` | This option explicitly allows Hurl to perform "insecure" SSL connections and transfers.

Environment variables: HURL_INSECURE
| | `-4, --ipv4` | This option tells Hurl to use IPv4 addresses only when resolving host names, and not for example try IPv6.

Environment variables: HURL_IPV4
| | `-6, --ipv6` | This option tells Hurl to use IPv6 addresses only when resolving host names, and not for example try IPv4.

Environment variables: HURL_IPV6
| | `--key <KEY>` | Private key file name.
| | `--limit-rate <SPEED>` | Specify the maximum transfer rate you want Hurl to use, for both downloads and uploads. This feature is useful if you have a limited pipe and you would like your transfer not to use your entire bandwidth. To make it slower than it otherwise would be.
The given speed is measured in bytes/second.

Environment variables: HURL_LIMIT_RATE
| | `-L, --location` | Follow redirect. To limit the amount of redirects to follow use the [`--max-redirs`](#max-redirs) option

Environment variables: HURL_LOCATION
| | `--location-trusted` | Like [`-L, --location`](#location), but allows sending the name + password to all hosts that the site may redirect to.
This may or may not introduce a security breach if the site redirects you to a site to which you send your authentication info (which is plaintext in the case of HTTP Basic authentication).

Environment variables: HURL_LOCATION_TRUSTED
| | `--max-filesize <BYTES>` | Specify the maximum size in bytes of a file to download. If the file requested is larger than this value, the transfer does not start.

Environment variables: HURL_MAX_FILESIZE

This is a cli-only option.
| | `--max-redirs <NUM>` | Set maximum number of redirection-followings allowed

By default, the limit is set to 50 redirections. Set this option to -1 to make it unlimited.

Environment variables: HURL_MAX_REDIRS
| | `-m, --max-time <SECONDS>` | Maximum time in seconds that you allow a request/response to take. This is the standard timeout.

You can specify time units in the maximum time expression. Set Hurl to use a maximum time of 20 seconds with `--max-time 20s` or set it to 35,000 milliseconds with `--max-time 35000ms`. No spaces allowed.

See also [`--connect-timeout`](#connect-timeout).

Environment variables: HURL_MAX_TIME
| | `--negotiate` | Tell Hurl to use Negotiate (SPNEGO) authentication.
| | `--no-cookie-store` | Do not use cookie storage for requests/responses in a file. By default, requests in the same Hurl file share cookie storage, this option deactivates cookie engine.

Environment variables: HURL_NO_COOKIE_STORE

This is a cli-only option.
| | `--no-header <NAME>` | Remove a header from information sent. Can be used several times in a command.

Environment variables: HURL_NO_HEADER='name1|name2' (names are separated by |)
| | `--no-proxy <HOST(S)>` | Comma-separated list of hosts which do not use a proxy.

Environment variables: no_proxy
| | `--ntlm` | Tell Hurl to use NTLM authentication
| | `--path-as-is` | Tell Hurl to not handle sequences of /../ or /./ in the given URL path. Normally Hurl will squash or merge them according to standards but with this option set you tell it not to do that.
| | `--pinnedpubkey <HASHES>` | When negotiating a TLS or SSL connection, the server sends a certificate indicating its identity. A public key is extracted from this certificate and if it does not exactly match the public key provided to this option, Hurl aborts the connection before sending or receiving any data.
| | `-x, --proxy <[PROTOCOL://]HOST[:PORT]>` | Use the specified proxy.

Environment variables: http_proxy https_proxy all_proxy
| | `--proxy-header <HEADER>` | Extra header to include in the request when sending to a proxy. These headers are only applied when a proxy is involved; if Hurl connects directly to the target server, they are ignored.

Environment variables: HURL_PROXY_HEADER='name1:value1|name2:value2' (headers are separated by |)

This is a cli-only option.
| | `--resolve <HOST:PORT:ADDR>` | Provide a custom address for a specific host and port pair. Using this, you can make the Hurl requests(s) use a specified address and prevent the otherwise normally resolved address to be used. Consider it a sort of /etc/hosts alternative provided on the command line.
| | `--ssl-no-revoke` | (Windows) This option tells Hurl to disable certificate revocation checks. WARNING: this option loosens the SSL security, and by using this flag you ask for exactly that.

This is a cli-only option.
| | `--tls-max <VERSION>` | Set the maximum allowed TLS version. If the connection is done without TLS, this option has no effect. This includes QUIC-using (HTTP/3) transfers.

default Use up to the recommended TLS version.
1.0 Use up to TLSv1.0.
1.1 Use up to TLSv1.1.
1.2 Use up to TLSv1.2.
1.3 Use up to TLSv1.3.

Environment variables: HURL_TLS_MAX
| | `--unix-socket <PATH>` | (HTTP) Connect through this Unix domain socket, instead of using the network.
| | `-u, --user <USER:PASSWORD>` | Add basic Authentication header to each request.

Environment variables: HURL_USER
| | `-A, --user-agent <NAME>` | Specify the User-Agent string to send to the HTTP server.

Environment variables: HURL_USER_AGENT

This is a cli-only option.
| ### Output options | Option | Description | |------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `--color` | Colorize standard output and standard error.

By default, Hurl outputs a prettified and colorized response. When redirected through pipes, standard streams are not colorized and color can be forced with this option.

Environment variables: HURL_COLOR

This is a cli-only option.
| | `--curl <FILE>` | Export each request to a list of curl commands.

This is a cli-only option.
| | `--error-format <FORMAT>` | Control the format of error message (short by default or long). When using long, the response body is logged when there are errors.

Environment variables: HURL_ERROR_FORMAT

This is a cli-only option.
| | `--fail-with-body` | Output body response on standard output if there are any errors. By default, Hurl outputs the last body response on standard output only when a run is successful.

Environment variables: HURL_FAIL_WITH_BODY
| | `-i, --include` | Include the HTTP headers in the output

This is a cli-only option.
| | `--json` | Output each Hurl file result to JSON. The format is very closed to HAR format.

This is a cli-only option.
| | `--no-color` | Do not colorize standard output nor standard error.

Environment variables: HURL_NO_COLOR NO_COLOR

This is a cli-only option.
| | `--no-output` | Suppress output. By default, Hurl outputs the body of the last response.

Environment variables: HURL_NO_OUTPUT

This is a cli-only option.
| | `--no-pretty` | Do not prettify response output for supported content type (JSON only for the moment). By default, output is prettified if
standard output is a terminal.

Environment variables: HURL_NO_PRETTY

This is a cli-only option.
| | `-o, --output <FILE>` | Write output to FILE instead of stdout. Use '-' for stdout in [Options] sections.
| | `--pretty` | Prettify response output for supported content type (JSON only for the moment). By default, JSON response is prettified if standard output is a terminal, and colorized, see[`--no-color`](#no-color) to format without color.

Environment variables: HURL_PRETTY

This is a cli-only option.
| | `--progress-bar` | Display a progress bar in test mode. The progress bar is displayed only in interactive TTYs. This option forces the progress bar to be displayed even in non-interactive TTYs.

This is a cli-only option.
| | `-v, --verbose` | Turn on verbose output on standard error stream.
Useful for debugging.

A line starting with '>' means data sent by Hurl.
A line staring with '<' means data received by Hurl.
A line starting with '' means additional info provided by Hurl.

If you only want HTTP headers in the output, [`-i, --include`](#include) might be the option you're looking for.

Environment variables: HURL_VERBOSE
| | `--verbosity <LEVEL>` | Set the verbosity level for debug logs on standard error stream (brief, verbose or debug)

If you only want HTTP headers in the output, [`-i, --include`](#include) might be the option you're looking for.
[`-v, --verbose`](#verbose) is an alias for `--verbosity verbose`
[`--very-verbose`](#very-verbose) is an alias for `--verbosity debug`

Environment variables: HURL_VERBOSITY
| | `--very-verbose` | Turn on more verbose output on standard error stream.

In contrast to [`--verbose`](#verbose) option, this option outputs the full HTTP body request and response on standard error. In addition, lines starting with '**' are libcurl debug logs.

Environment variables: HURL_VERY_VERBOSE
| ### Run options | Option | Description | |------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `--continue-on-error` | Continue executing requests to the end of the Hurl file even when an assert error occurs. By default, Hurl exits after an assert error in the HTTP response.

Note that this option does not affect the behavior with multiple input Hurl files.

All the input files are executed independently. The result of one file does not affect the execution of the other Hurl files.

Environment variables: HURL_CONTINUE_ON_ERROR

This is a cli-only option.
| | `--delay <MILLISECONDS>` | Sets delay before each request (aka sleep). The delay is not applied to requests that have been retried because of [`--retry`](#retry). See [`--retry-interval`](#retry-interval) to space retried requests.

You can specify time units in the delay expression. Set Hurl to use a delay of 2 seconds with `--delay 2s` or set it to 500 milliseconds with `--delay 500ms`. Supported time units: ms, s, m, h. No spaces allowed.

Environment variables: HURL_DELAY
| | `--from-entry <ENTRY_NUMBER>` | Execute Hurl file from ENTRY_NUMBER (starting at 1).

This is a cli-only option.
| | `--jobs <NUM>` | Maximum number of parallel jobs in parallel mode. Default value corresponds (in most cases) to the current amount of CPUs. Set to 1 to disable parallel execution of files.

See also [`--parallel`](#parallel).

Environment variables: HURL_JOBS

This is a cli-only option.
| | `--no-assert` | Ignore all asserts defined in the Hurl file.

Environment variables: HURL_NO_ASSERT

This is a cli-only option.
| | `--no-jsonpath-coercion` | Disable JSONPath result coercion.

By default, when JSONPath coercion is enabled, empty JSONPath results are returned as no value and single JSONPath results are returned as a scalar value. With this option, JSONPath results are always returned as arrays.

Environment variables: HURL_NO_JSONPATH_COERCION
| | `--parallel` | Run files in parallel.

Each Hurl file is executed in its own worker thread, without sharing anything with the other workers. The default run mode is sequential. Parallel execution is by default in [`--test`](#test) mode.

See also [`--jobs`](#jobs).

This is a cli-only option.
| | `--repeat <NUM>` | Repeat the input files sequence NUM times, -1 for infinite loop. Given a.hurl, b.hurl, c.hurl as input, repeat two
times will run a.hurl, b.hurl, c.hurl, a.hurl, b.hurl, c.hurl.
| | `--retry <NUM>` | Maximum number of retries, 0 for no retries, -1 for unlimited retries. Retry happens if any error occurs (asserts, captures, runtimes etc...).

Environment variables: HURL_RETRY
| | `--retry-interval <MILLISECONDS>` | Duration in milliseconds between each retry. Default is 1000 ms.

You can specify time units in the retry interval expression. Set Hurl to use a retry interval of 2 seconds with `--retry-interval 2s` or set it to 500 milliseconds with `--retry-interval 500ms`. No spaces allowed.

Environment variables: HURL_RETRY_INTERVAL
| | `--secret <NAME=VALUE>` | Define secret value to be redacted from logs and report. When defined, secrets can be used as variable everywhere variables are used.

Environment variables: HURL_SECRET_name

This is a cli-only option.
| | `--secrets-file <FILE>` | Define a secrets file in which you define your secrets

Each secret is defined as name=value exactly as with [`--secret`](#secret) option.

Note that defining a secret twice produces an error.

This is a cli-only option.
| | `--test` | Activate test mode: with this, the HTTP response is not outputted anymore, progress is reported for each Hurl file tested, and a text summary is displayed when all files have been run.

In test mode, files are executed in parallel. To run test in a sequential way use `--jobs 1`.

See also [`--jobs`](#jobs).

Environment variables: HURL_TEST

This is a cli-only option.
| | `--to-entry <ENTRY_NUMBER>` | Execute Hurl file to ENTRY_NUMBER (starting at 1).
Ignore the remaining of the file. It is useful for debugging a session.

This is a cli-only option.
| | `--variable <NAME=VALUE>` | Define variable (name/value) to be used in Hurl templates.

Environment variables: HURL_VARIABLE_name
| | `--variables-file <FILE>` | Set properties file in which your define your variables.

Each variable is defined as name=value exactly as with [`--variable`](#variable) option.

Note that defining a variable twice produces an error.

This is a cli-only option.
| ### Report options | Option | Description | |----------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------| | `--report-html <DIR>` | Generate HTML report in DIR.

If the HTML report already exists, it will be updated with the new test results.

This is a cli-only option.
| | `--report-json <DIR>` | Generate JSON report in DIR.

If the JSON report already exists, it will be updated with the new test results.

This is a cli-only option.
| | `--report-junit <FILE>` | Generate JUnit File.

If the FILE report already exists, it will be updated with the new test results.

This is a cli-only option.
| | `--report-tap <FILE>` | Generate TAP report.

If the FILE report already exists, it will be updated with the new test results.

This is a cli-only option.
| ### Other options | Option | Description | |--------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `-b, --cookie <FILE>` | Read cookies from FILE (using the Netscape cookie file format).

Combined with [`-c, --cookie-jar`](#cookie-jar), you can simulate a cookie storage between successive Hurl runs.

This is a cli-only option.
| | `-c, --cookie-jar <FILE>` | Write cookies to FILE after running the session.
The file will be written using the Netscape cookie file format.

Combined with [`-b, --cookie`](#cookie), you can simulate a cookie storage between successive Hurl runs.

This is a cli-only option.
| | `--file-root <DIR>` | Set root directory to import files in Hurl. This is used for files in multipart form data, request body and response output.
When it is not explicitly defined, files are relative to the Hurl file's directory.

This is a cli-only option.
| | `--glob <GLOB>` | Specify input files that match the given glob pattern.

Multiple glob flags may be used. This flag supports common Unix glob patterns like *, ? and [].
However, to avoid your shell accidentally expanding glob patterns before Hurl handles them, you must use single quotes or double quotes around each pattern.

This is a cli-only option.
| | `-n, --netrc` | Scan the .netrc file in the user's home directory for the username and password.

See also [`--netrc-file`](#netrc-file) and [`--netrc-optional`](#netrc-optional).
| | `--netrc-file <FILE>` | Like [`--netrc`](#netrc), but provide the path to the netrc file.

See also [`--netrc-optional`](#netrc-optional).
| | `--netrc-optional` | Similar to [`--netrc`](#netrc), but make the .netrc usage optional.

See also [`--netrc-file`](#netrc-file).
| | `-h, --help` | Usage help. This lists all current command line options with a short description.
| | `-V, --version` | Prints version information
| ## Exit Codes | Value | Description | |-------|---------------------------------------------------------| | `0` | Success.
| | `1` | Failed to parse command-line options.
| | `2` | Input file parsing error.
| | `3` | Runtime error (such as failure to connect to host).
| | `4` | Assert error.
| ## WWW [https://hurl.dev](https://hurl.dev) ## See Also curl(1) hurlfmt(1) --- --- METRICS --- - Files Extracted: 38 - Estimated Token Budget: ~125375 tokens - Canonical Reference: https://codewiki.google/github.com/Orange-OpenSource/hurl

Emacs Hurl

Welcome!

Welcome!

Welcome!

Example

xpath "//h2" not exists # Similar assert for

General

Sections

Query

Predicates

Bytes

Strings

JSON

Expression

Function

Filter

Lexical Grammar

Text Format

Fast CLI

Single Binary