Wednesday, August 20, 2025

๐Ÿš€ Boosting API Testing with Pre-request and Post-response Scripts in Postman

As I’ve been working on API development and testing, I recently explored how to use Pre-request and Post-response scripts in Postman to automate and streamline my workflow. Here’s what I learned and how you can apply it too!


๐Ÿ”ง Pre-request Script: Dynamic Timestamping

I needed to send a request with a timestamp that was exactly 5 hours before the current time. Here’s the script I used:

let now = new Date();
let hour = 60 * 60 * 1000;
let multiplyer = 5;

let time_iso = new Date(now.getTime() - multiplyer * hour);
pm.environment.set("time_iso", time_iso.toISOString());

✅ This script calculates the time offset and stores it in an environment variable time_iso, which I then used in the request body like this:

{
  "timestamp": "{{time_iso}}"
}


๐Ÿ” Authorization Setup

To authenticate the request, I used a Bearer Token in the Authorization tab:

  • Type: Bearer Token
  • Token: {{auth_token}} (stored in environment variables)

Alternatively, you can add it manually in the Headers tab:

Key: Authorization
Value: Bearer {{auth_token}}

๐Ÿงช Post-response Script: Status Check and Token Extraction

After the request, I wanted to validate the response and extract a token for future use. Here’s the script I used:

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

let responseData = pm.response.json();

if (responseData.token) {
    pm.environment.set("auth_token", responseData.token);
    console.log("Token saved to environment:", responseData.token);
} else {
    console.warn("Token not found in response");
}

✅ This script checks if the response was successful and saves the token to an environment variable for reuse.


๐Ÿ’ก Final Thoughts

Using these scripts has made my API testing more dynamic and efficient. I can now automate timestamp generation, handle authentication seamlessly, and extract data from responses without manual effort.

If you're working with APIs in Postman, I highly recommend exploring these scripting features—they’re simple to implement and incredibly powerful!


Monday, August 11, 2025

Oracle Forms “Failed to validate certificate” in UiPath RPA apps — why it happens and how to fix it

UiPath RPA workflow launches an Oracle Forms application (Java Web Start / Oracle Forms applet) and you intermittently get the pop‑up:

“Application Blocked for Security
Failed to validate certificate.
The application will not be executed.
Name: oracle.forms.engine.Main
Location: https://<server>:<port>”

you’re hitting a certificate revocation check problem in the Java client used by Oracle Forms. The issue appears randomly because Java’s Online Certificate Status Protocol (OCSP) checks can time out or fail intermittently against Oracle’s responders, which leads Java to treat the code-signing or TLS certificate as unvalidated and block execution.

Why this affects UiPath

  • UiPath typically automates Oracle Forms via a desktop/browser session that loads the Java plugin or JNLP client.

  • The robot inherits the same Java security settings as the user session. When OCSP validation is enabled, sporadic network hiccups or responder issues can fail the revocation check, stopping the Oracle client before your workflow starts.

  • Because the error occurs before the UI is fully initialized, retries don’t help; the Java runtime blocks the applet/JNLP outright.

Root cause in plain terms

  • Java tries to confirm that the certificate used to sign Oracle Forms code (and/or the site’s TLS certificate) hasn’t been revoked.

  • When “OCSP” is selected, Java queries an online OCSP responder. If that responder is slow, unreachable, or returns an unexpected response, Java refuses to run the application.

  • The result: intermittent “Failed to validate certificate” even when your certificates are valid.

The reliable fix: switch revocation checks to CRL only
Changing Java’s certificate revocation strategy from OCSP (or OCSP+CRL) to CRL only removes the flaky dependency on Oracle’s OCSP responders while still performing revocation checks via downloadable Certificate Revocation Lists.

What to change
Open the Java Control Panel on the robot and set the following under the Advanced tab, Security section.

  1. Check for signed code certificate revocation using:

  • Select “Certificate Revocation Lists (CRLs)”

  • Do not select OCSP or “Both CRLs and OCSP”

  1. Perform TLS certificate revocation checks on:

  • Choose “All certificates in the chain of trust” (recommended for completeness)

  • “Server certificate only” also works if your environment requires it

  • Avoid “Do not check”

  1. Check for TLS certificate revocation using:

  • Select “Certificate Revocation Lists (CRLs)”

  • Do not select OCSP or “Both CRLs and OCSP”

Apply and restart the browser/Oracle Forms client. In unattended robots, restart the robot session or machine so the setting is picked up.

Why CRL works better here

  • CRLs are cached and refreshed on schedule, so a transient network glitch doesn’t immediately block execution.

  • OCSP requires a live responder call during startup; if that call fails or times out, Java blocks the app. That’s the randomness you see.

Operational considerations for RPA teams

  • Standardize the Java security settings on all robots via group policy, configuration management, or golden image.

  • Ensure robots have access to CRL distribution points (often HTTP/LDAP URLs embedded in the certs). Allowlist those endpoints if you use egress filtering.

  • Monitor certificate expirations and keep Java up to date to avoid unrelated security prompts.

  • Document the setting so new robot machines match the same configuration.

FAQ

Does switching to CRL reduce security?

  • You still perform revocation checks, just via CRL instead of OCSP. Many enterprises standardize on CRL for determinism and caching. If your security policy mandates OCSP, consider deploying an internal OCSP responder or OCSP stapling; otherwise CRL is a practical, reliable choice.

Why does the error mention oracle.forms.engine.Main?

  • That’s the main class of the Oracle Forms client. Java blocks it before launch when it can’t validate certificates.

Why is the error intermittent?

  • OCSP lookups depend on remote responders. Latency, packet loss, DNS issues, or responder rate limits can cause sporadic failures.

UiPath workflow tip

  • Add an environment validation step at the start of your process that checks a sentinel Forms URL and fails fast with a clear exception if Java security settings are incorrect. This saves robot time and simplifies troubleshooting.

Summary

  • Symptom: “Failed to validate certificate” popup when launching Oracle Forms in a UiPath‑automated session.

  • Cause: Unreliable OCSP revocation checks in Java for Oracle Forms certificates.

  • Fix: In Java Control Panel > Advanced > Security, set revocation checks to CRL only for both signed code and TLS, then restart.

Monday, August 4, 2025

UiPath Job Monitoring & Auto-Prioritization Framework – Developer Guide


 

Objective: To enable APP RPA developers to integrate their processes into the Job Monitoring Automation, which ensures critical pending jobs are prioritized by automatically stopping lower priority running jobs.

1️⃣ Overview

The Job Monitoring Process continuously scans the Orchestrator for pending jobs, compares their priority with currently running jobs, and if needed, stops lower-priority jobs to free up execution slots. This helps ensure that business-critical jobs are executed with minimum delay, maintaining SLAs and operational efficiency.

2️⃣ High-Level Flow

Start → Read Config & Assets → Get Pending Jobs via HTTP → Check Running Jobs → Compare Priorities → If pending > running → Send Stop Signal → Notify via Email Group → End

3️⃣ Developer Responsibilities

To enable job prioritization for your automation, you need to manage/update three assets in the default modern folder:




• JobMonitor_MachineName – List of machine names where job monitor applies (comma-separated text)
• JobMonitor_FolderName – Name of the modern folder/sub folder containing the jobs
• JobMonitor_AlertGroup – Email group to receive job interruption alerts

⚠️ Developers should make sure they prioritize the triggers or the processes in their modern folders before integrating them into the job monitoring process.

 

4️⃣ Process Details

Step-by-step Logic:
1. Read Assets: Machine Names, Folder Name, Email Alert Group
2. Query Pending Jobs via Orchestrator HTTP API
3. Check for Critical Pending Jobs
4. Compare with Running Jobs
5. If a pending job's priority > running job's priority:
   a. Send Stop Signal to running job
   b. Trigger Email Notification to the Alert Group

5️⃣ Priority Comparison Logic

Job Status        | Key Fields Used
------------------|-----------------
Pending           | Process Name, Host Machine, Job Priority
Running           | Same fields as above
Logic             | Stop running job only if pending job priority is higher

6️⃣ Email Notification Format



7️⃣ Best Practices

• Keep your JobMonitor assets clean (ascending order) and check with fellow developers if a machine is being shared.
• Avoid assigning the same priority to all jobs—leverage numeric values or predefined importance.
• Schedule the Job Monitoring Process to run at reasonable intervals (e.g., every 5 minutes).
• Handle edge cases like orphan jobs, concurrent stops, or conflicting asset values.

8️⃣ Example Use Case: Automated Invoice Processing with Priority-Based Scheduling

Scenario:
In the Accounts Payable automation environment, there are two types of invoice-related bots running on the same machine:

1. Invoice Entry Bot
- Triggered ad hoc based on technician inputs via ABBYY OCR
- Assigned Medium priority
- Can run anytime throughout the day

2. Payment Manager Bot
- Scheduled to run at 10:30 AM and 1:00 PM
- Handles critical end-of-day payment approvals
- Assigned Critical priority

Problem:
If the Invoice Entry Bot is already running at 10:30 AM, the Payment Manager Bot is placed in a pending state in Orchestrator.

Resolution:
The Job Monitoring Process detects this situation:
- Finds a Critical-priority job (Payment Manager Bot) in Pending state
- Compares it with the currently running Medium-priority job (Invoice Entry Bot)
- Sends a Stop Signal to the Invoice Entry job
- Notifies the configured alert email group
- Frees the machine so the Payment Manager Bot can run on schedule without delay

This ensures that time-sensitive automation takes precedence over lower-priority background tasks.