---
title: "Test unsaved integration credential"
method: POST
path: "/api/v1/integration_credentials/test"
tags: ["Integration Credential"]
---

# Test unsaved integration credential

`POST /api/v1/integration_credentials/test`

Test an integration credential before it is created: Rossum attempts to obtain
an access token from the third-party service using the submitted `secret` and, when the token
carries the granted scopes, checks that all requested scopes were granted.

Nothing is stored — the credential does not have to exist. To test an existing
(possibly edited) credential, use the
[test endpoint of the credential](/api/integration-credential#test-integration-credential) instead.

## Request body

- object
  - `type` 'coupa_sand_oauth2', required — Type of the tested credential.
  - `secret` CoupaSandOauth2Secret, required — When creating a credential or replacing the whole secret (PUT), all keys are required. Masked values may be sent back as the `[redacted...]` placeholder returned by GET — the stored value is kept, so the whole secret can be resubmitted without knowing it. Partial updates (PATCH) may send any subset of the keys.
    - `client_id` string — OAuth2 client ID issued by Coupa.
    - `client_secret` string — OAuth2 client secret issued by Coupa. Masked as `[redacted...]` in responses.
    - `base_api_url` string, uri — Base URL of the Coupa instance API.
    - `scope` string — OAuth2 scopes requested for the token, separated by commas or spaces.

## Response `200`

OK

- IntegrationCredentialTestResult
  - `status` 'ok' | 'failed', required — `ok` when a token was obtained and no requested scope is missing, `failed` otherwise.
  - `error` string, nullable, required — Human-readable description of the failure. `null` when the test passed.
  - `granted_scopes` string[], nullable, required — Scopes granted in the issued token. `null` when the token could not be obtained or the granted scopes could not be determined.
  - `missing_scopes` string[], nullable, required — Requested scopes that are not granted in the issued token. `null` when the granted scopes could not be determined.

## Other responses

- `400` — Invalid input data.
- `401` — The username/password is invalid or token is invalid (e.g. expired).
- `403` — Insufficient permission, missing authentication, invalid CSRF token and similar issue.
- `429` — Request rate is too high, wait before sending more requests. See [Rate Limiting](/guides/overview#rate-limiting) for more details.
- `500` — Server failure while processing the request.
- `502` — Invalid response from the upstream server.
- `503` — We're temporarily offline for maintenance. Please try again later.
- `504` — Upstream server could not complete the request in time.

## Changes

- **2026-09-03** `dbbbbe8374e6` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rossum/apis/rossum-api/changes/api/v1/integration_credentials/test/post.md)

---

[API](https://skmtc.dev/rossum/apis/rossum-api.md) · [All operations](https://skmtc.dev/rossum/apis/rossum-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rossum/rossum-api/revisions/dbbbbe8374e6/schema)