UiPath-ADAv1 API-Based Automation — 15 Questions

Question 1

Which activity should be used to securely pass a sensitive password to an API as part of a login request without exposing it in the logs?

Accepted Answer

SecureString variable. The 'SecureString' type is designed to store sensitive information in an encrypted format in memory. When a SecureString variable is used, UiPath handles it securely, and it will not be displayed in plain text in execution logs or the Locals panel, protecting it from unauthorized exposure. This is a standard security practice for handling credentials in UiPath.

Answer

String variable

Answer

GenericValue variable

Answer

Array of Strings

Question 2

An automation developer is designing a workflow to retrieve invoice data from a REST API that requires OAuth 2.0 authentication. Which approach is the most efficient and secure way to handle this in UiPath Studio?

Accepted Answer

Manually send a POST request to the token endpoint and save the response token to a variable to pass into every subsequent API call.. The 'HTTP Request' activity supports 'None', 'Basic', and 'APIKey' authentication types. OAuth 2.0 flows in UiPath are typically handled by using the 'UiPath.WebAPI.Activities' package's 'OAuth2Token' activity or by manually performing the token exchange via an HTTP Request activity and storing the result in a secure asset or variable. Option C describes a feature that does not exist in the standard activity properties.

Answer

Hardcode the client ID and client secret directly into the 'Header' property of the HTTP Request activity for every call.

Answer

Use an 'Invoke Code' activity to write a custom Python script that handles token requests and stores the token in a global text file.

Answer

Utilize the 'OAuthToken' authentication type within the HTTP Request activity, referencing credentials stored in Orchestrator Assets.

Question 3

A UiPath developer is building a workflow that calls a REST API which returns a JSON array of customer records. The developer needs to iterate over each customer record and extract the 'customerId' field. The HTTP Request activity has already been configured and the response content is stored in a variable named responseContent. Which two activities or steps are necessary to correctly parse and iterate through the JSON array? (Choose two.)

Accepted Answer

Use a For Each activity with the TypeArgument set to Newtonsoft.Json.Linq.JObject to iterate over the deserialized array.. To process a JSON array response, the developer must first deserialize the JSON string into a JArray using the Deserialize JSON activity. Then, a For Each activity with TypeArgument JObject can iterate over each element, allowing access to fields like 'customerId'. This combination leverages UiPath's built-in JSON handling capabilities and is the standard method for such scenarios.

Answer

Use the Deserialize XML activity to convert the response into an XML document and then use XPath queries.

Answer

Use the Read CSV activity to parse the JSON array into a DataTable.

Answer

Use a While loop with a counter to manually parse the JSON string using string manipulation functions.

Question 4

A UiPath developer is automating a process that interacts with a REST API requiring OAuth 2.0 authentication. The developer needs to obtain an access token using the client credentials grant type, then use that token in subsequent API calls. The HTTP Request activity is used for both token retrieval and API calls. Which configuration correctly handles the token retrieval and usage?

Accepted Answer

Set the HTTP Request activity's Method to POST, Endpoint to the token URL, Body to a JSON object containing 'grant_type', 'client_id', and 'client_secret', and BodyFormat to application/json. Then, in subsequent requests, add an Authorization header with value 'Bearer ' + access_token.. For OAuth 2.0 client credentials grant, the token request must be a POST to the token endpoint with the required parameters. The access token is then included in subsequent requests as a Bearer token in the Authorization header. This ensures secure and standard-compliant authentication with the API.

Answer

Set the HTTP Request activity's Method to POST, Endpoint to the token URL, and use the 'Parameters' property to add 'grant_type', 'client_id', and 'client_secret'. Then, in subsequent requests, add a custom header 'Token: ' + access_token.

Answer

Set the HTTP Request activity's Method to POST, Endpoint to the token URL, and use the 'Body' property with form-urlencoded format containing 'grant_type', 'client_id', and 'client_secret'. Then, in subsequent requests, add an Authorization header with value 'Basic ' + access_token.

Answer

Set the HTTP Request activity's Method to GET, Endpoint to the token URL, and add query parameters for 'grant_type', 'client_id', and 'client_secret'. Then, use the token as a query parameter in subsequent requests.

Question 5

A UiPath developer is using the HTTP Request activity to call a REST API that requires a bearer token for authentication. The token is stored in a secure asset in Orchestrator. The developer wants to ensure the token is not exposed in logs. Which configuration should be used?

Accepted Answer

Add the token to the 'Headers' property as a string in the format 'Authorization: Bearer ' + token, and ensure the token variable is not logged by setting the log level to 'None' for that activity.. The HTTP Request activity requires manual configuration of the Authorization header for bearer tokens. The token should be retrieved from a secure asset and added to the Headers property. To prevent exposure, developers must avoid logging the token and can control logging levels. UiPath does not automatically mask headers, so explicit care is needed.

Answer

Use the 'Body' property to send the token as a form parameter, and set the 'Content-Type' to 'application/x-www-form-urlencoded'.

Answer

Add the token to the 'Headers' property as a string in the format 'Authorization: Bearer ' + token, and enable 'Secure' on the activity.

Answer

Use the 'Authentication' property of the HTTP Request activity, select 'Bearer', and provide the token variable. This automatically masks the token in logs.

Question 6

An automation developer is using the HTTP Request activity to call a REST API that returns a JSON response containing a nested array of customer records. The developer needs to extract the email address of the first customer whose status is 'active'. The response is stored in a variable of type String named apiResponse. Which approach correctly parses the JSON and retrieves the required email address?

Accepted Answer

Use the Deserialize JSON activity to convert apiResponse into a JObject, then use a Select Token activity with the query "$.customers[?(@.status=='active')].email" and take the first result.. The Deserialize JSON activity converts the JSON string into a JObject, allowing structured access. The Select Token activity supports JSONPath queries, and the filter expression with double equals correctly identifies active customers. Retrieving the first matching email requires proper JSONPath syntax and understanding of the JSON structure. The other options either misinterpret the JSON type or use incorrect query syntax.

Answer

Use the Deserialize JSON activity to convert apiResponse into a JArray, then use the Select Token activity with the query "$.customers[0].email".

Answer

Use the Deserialize JSON activity to convert apiResponse into a JObject, then use a Select Token activity with the query "$.customers[?(@.status='active')].email" and take the first result.

Answer

Use the Deserialize JSON activity to convert apiResponse into a JObject, then use a For Each activity to iterate over the JObject properties and check each status value.

Question 7

A developer is automating a process that requires calling an API protected by OAuth 2.0. The API uses the client credentials grant type. The developer has a client ID and client secret and needs to obtain an access token before making the actual API call. Which sequence of steps should the developer implement in UiPath?

Accepted Answer

Use the HTTP Request activity to POST to the token endpoint with the client ID and secret in the body, parse the access_token from the JSON response, then include it as a Bearer token in the Authorization header of subsequent requests.. The client credentials grant involves POSTing the client ID and secret to the token endpoint, receiving an access token, and then using that token as a Bearer token in the Authorization header for API calls. This sequence ensures secure authentication. The other options either use incorrect HTTP methods, bypass the token endpoint, or misplace the access token.

Answer

Use the HTTP Request activity to POST to the API endpoint directly with the client ID and secret in the Authorization header using Basic authentication, bypassing the token endpoint.

Answer

Use the HTTP Request activity to GET the token endpoint with the client ID and secret as query parameters, then use the returned token in the Authorization header.

Answer

Use the HTTP Request activity to POST to the token endpoint with the client ID and secret in the Authorization header using Basic authentication, then use the returned token in the body of subsequent requests.

Question 8

A developer is using the HTTP Request activity in UiPath to call a REST API. The API requires authentication and returns data in JSON format. The developer needs to ensure that the request is properly authenticated and that the response is correctly parsed. Which two actions should the developer take? (Choose two.)

Accepted Answer

Add an Authorization header with the appropriate authentication scheme, such as Bearer or Basic, and the credentials.. To authenticate, the developer must include an Authorization header with the correct scheme and credentials. To parse the JSON response, the developer must use the Deserialize JSON activity to convert the response string into a JObject. These two actions ensure the request is accepted and the data can be processed. The other options are either unnecessary or incorrect for this scenario.

Answer

Use the Select Token activity directly on the response string to extract the required data.

Answer

Set the BodyFormat property to application/json to ensure the request body is sent as JSON.

Answer

Set the Accept header to application/xml to ensure the response is in a parsable format.

Question 9

An automation project needs to retrieve secure credentials from a REST API endpoint that requires OAuth 2.0 authorization. Which activity should be utilized first to establish the connection before making subsequent data requests?

Accepted Answer

HTTP Request. To interact with OAuth 2.0 secured APIs, the automation must first obtain an access token by authenticating with the identity provider. The HTTP Request activity is used to POST client credentials or grant codes to the token endpoint. Understanding this sequence is vital for API automation, as failing to handle the authentication handshake results in 401 Unauthorized errors, preventing any data exchange with protected resources during the workflow execution.

Answer

Invoke Workflow File

Answer

Get Asset

Answer

Deserialize JSON

Question 10

When designing a robust API automation workflow in UiPath, which TWO of the following practices are considered essential for maintaining production-grade reliability?

Accepted Answer

Use a Try-Catch block around the HTTP Request activity.. Production-grade API automation requires handling transient errors and ensuring data integrity. Implementing global exception handling via Try-Catch blocks allows for graceful failure, while checking HTTP status codes ensures the automation reacts to business logic errors rather than just network issues. These practices minimize downtime and provide auditability, which is essential when dealing with external system dependencies that may change or experience intermittent latency during high-volume processing periods.

Answer

Always hardcode the API secret directly in the HTTP Request activity.

Answer

Store all API payloads in global variables only.

Answer

Disable SSL verification for all requests to ensure speed.

Question 11

Refer to the exhibit. After invoking an API, you receive the JSON structure shown. Which activity and property configuration is required to extract the 'id' value into a variable?

Accepted Answer

Use 'Deserialize JSON' then access via 'jsonObject("data")("id").ToString'.. To extract nested values from a JSON response, one must first convert the string response into a JObject using the Deserialize JSON activity. Once in object form, the JObject can be navigated using standard dot notation or string indexing. This is a fundamental skill for API-based automation because it allows robots to programmatically access specific data fields needed for subsequent logic or UI-based interactions.

Answer

Use 'Get Text' activity with 'data.id' as the selector.

Answer

Use 'Assign' activity to read the response string directly using string splitting.

Answer

Use 'Deserialize JSON Array' to extract the 'id' field.

Question 12

Which HTTP method is most appropriate when you need to create a new resource on a server, such as submitting a new expense report via an API?

Accepted Answer

POST. The POST method is the standard HTTP verb used for sending data to a server to create a new resource. In the context of UiPath, using the correct HTTP verb is essential for interacting with RESTful services as the server interprets the verb to determine the intended action. Using an incorrect verb often leads to 405 Method Not Allowed errors from the API endpoint.

Answer

GET

Answer

PUT

Answer

DELETE

Question 13

Which THREE of the following are valid ways to authenticate an API request in UiPath's HTTP Request activity?

Accepted Answer

Adding 'Authorization' key to the Headers collection.. Authentication is fundamental to secure API consumption. UiPath supports multiple methods including API keys (passed as headers or query strings), OAuth tokens (retrieved via separate requests), and Basic Authentication (encoded in headers). Knowing these options allows developers to align their automation with the specific security standards defined by the target service provider, ensuring compliance and successful communication during the robot's runtime execution.

Answer

Hardcoding credentials into the Endpoint field URL.

Answer

Writing the password into a plain text file for the API to read.

Question 14

Refer to the exhibit. You are performing an API call and receive a 400 Bad Request error. What is the most likely cause of this issue in the context of your UiPath automation?

Accepted Answer

The request body content does not match the expected API schema.. A 400 Bad Request error indicates that the server could not process the request due to client-side issues, such as malformed JSON, missing mandatory fields, or invalid data types. In UiPath, this often stems from incorrect mapping of input variables to the request body. Debugging this requires verifying the request body content against the API's contract definition to ensure the data format matches the server's expected schema exactly.

Answer

The API server is currently down or under maintenance.

Answer

The authentication token has expired or is invalid.

Answer

The requested resource path does not exist on the server.

Question 15

When sending a large JSON payload using the HTTP Request activity, which property must be correctly set to ensure the server processes the data as the intended format?

Accepted Answer

The 'Content-Type' header.. Setting the 'Content-Type' header is critical in API automation. It informs the server how to interpret the request body (e.g., as application/json, application/xml, or text/plain). If this header is missing or incorrect, the server may reject the request or fail to parse the body correctly, even if the payload data itself is perfectly formed according to the JSON specification.

Answer

The 'Timeout' property.

Answer

The 'Accept' header.

Answer

The 'Authentication' property.