- name: get-users
  type: http
  request:
    method: GET
    url: /users

config:
  http:
    base_url: https://api.example.com

steps:
  - name: health
    type: http
    request:
      method: GET
      url: /health          # → https://api.example.com/health

  - name: external
    type: http
    request:
      method: GET
      url: https://other.com/api   # absolute URL, ignores base_url

method: GET
method: POST
method: PUT
method: DELETE
method: PATCH

config:
  http:
    headers:
      Accept: application/json
      X-Client: replay

- name: auth
  type: http
  request:
    method: POST
    url: /admin
    headers:
      Authorization: Bearer {{ token }}    # per-step header
      X-Idempotency-Key: "{{ nowUnix }}"

request:
  method: POST
  url: /users
  body:
    name: Alice
    email: alice@example.com

request:
  method: POST
  url: /users
  body:
    name: "{{ user_name }}"
    email: "{{ email }}"

request:
  method: POST
  url: /webhook
  body: |
    {"event": "user.created", "userId": {{ user_id }}}

{
  "status": 200,
  "data": { ... },
  "header": { ... }
}

extract:
  token: $.data.token                    # nested field
  user_id: data.user.id                  # shorthand (no $ prefix)
  response_status: res.status            # explicit res. prefix
  first_item: data.items[0]              # array index
  all_names: data.items[*].name          # array wildcard
  server_header: res.header.Server[0]    # response header

assert:
  - ["$.status", "eq", 200]
  - ["$.data.email", "not_null"]
  - ["$.data.items", "contains", "expected-value"]

config:
  http:
    debug: true

- name: login
  type: http
  request:
    method: POST
    url: /auth/login
    headers:
      Content-Type: application/json
    body:
      email: admin@example.com
      password: "{{ admin_password }}"
  extract:
    token: $.data.accessToken
    refresh: $.data.refreshToken
  assert:
    - ["$.status", "eq", 200]
    - ["$.data.accessToken", "not_null"]
    - ["$.data.expiresIn", "gt", 0]