Postman is a good platform for testing and collaborating with your teammates whether you created S2S and client callable scripts or brainCloud off-the-shelf APIs.

To install Postman, simply:

Download from https://www.getpostman.com/
Choose your platform, and complete the installation process

S2S examples

Example of S2S Cloud Code script call (session-less)

Follow the Cloud Code Tutorial Link to create an S2S script and name it "AddNums".
Navigate to App > Design > Servers > My Servers page, click [+ Add New Server...], enter a name for your server (e.g. newGame_SERVER), and select Custom Server from the Server Type dropdown menu.
Leave the Base URL and IP Ranges blank, and hit Save, and the portal page will generate a Server Secret for you.

Now you have created an S2S script and configured the S2S server in the brainCloud dashboard, you can test them from Postman.

Open the imported request -- script-AddNums, or create a request you own by following the pattern of the picture below (Method: POST, URL: https://api.braincloudservers.com/s2sdispatcher), then hit Send and check the response.

Note: "service": "script"; "operation": "RUN"

Example of brainCloud build-in S2S APIs call (session-less)

Open the imported request -- itemCatalog-SYS_GET_CATALOG_ITEMS_PAGE, or create a request your own by following the pattern of the picture below (Method: POST, URL: https://api.braincloudservers.com/s2sdispatcher), then hit Send and check the response.

Note: "service": "itemCatalog"; "operation": "SYS_GET_CATALOG_ITEMS_PAGE"

Example of brainCloud S2S API auth-call (session-based)

Open the imported request -- prod-session-based-auth, or create a request your own by following the pattern of the picture below (Method: POST, URL: https://api.braincloudservers.com/s2sdispatcher), then hit Send and check the response.

Note: "service": "authenticationV2"; "operation": "AUTHENTICATE"

Copy down the returned sessionId from the above auth-call.
Make a second request, using that sessionId and setting the packetId to 1, then hit Send and check the response.

Note: "service": "time"; "operation": "READ"

The S2S API calls documented in the API Ref are mapped to discrete Services and Operations on the server.

The codes, together with operation-specific parameters (specified in the JSON data object) are used to send commands to the server.

Note: Only the API Calls in the S2S section of the API Ref can be used for S2S calls.

Using Curl

When using the Curl command line with nested JSON parameters to test your S2S API call, recommend putting the parameters of the API call to a JSON file, then refer to this file with the --data option (-d) in the Curl command.

curl -d "@paraItemCat.json" -X POST https://sharedprod.braincloudservers.com/s2sdispatcher -H "Content-Type: application/json"

Example of making the client API calls

Every request that is sent to the brainCloud client API server has an MD5 check attached to it in the X-SIG request header.

The MD5 value is calculated by taking the body being sent to the API, appending the app secret to it, and then calculating the MD5 on all of that. The result is sent as a 32-character hex string.

Only if the MD5 value is present, and checks out, the brainCloud API server will accept the request. The body used in the calculation must be exactly the body that is sent - any change to it, even whitespace, needs a new MD5 value.

Note: Method: POST, URL: https://api.braincloudservers.com/dispatcherv2

Open the imported request -- client-api-authenticateEmail (or create a request you own by following the steps below), and check the content of this request in the Body textbox. You will find that is the same format as the request which is called from the brainCloud portal API Explorer page.

Note: The following picture is the same API call which called from the brainCloud portal App > Design > Cloud Code > API Explorer page.

Request body fields

A body copied from the API Explorer contains more fields than the API needs. For this authenticate call, these are the fields that matter:

Packet fields

Field	Required?	Notes
`packetId`	Yes	Use 0 for the authenticate call, then increase it by one on each later request in the session.
`messages`	Yes	Must contain at least one message.
`sessionId`	No	Leave it out or set it to null for authenticate. Later calls send the `sessionId` returned by authenticate.
`bypassUserEnabledCheck`	No - ignored	Only used by the brainCloud portal; ignored on requests sent to `/dispatcherv2`.

Fields in the authenticate message's data

Field	Required?	Notes
`gameId`	Yes	Your App ID.
`releasePlatform`	Yes	Must be a platform enabled for your app.
`authenticationType`	Yes	e.g. Email.
`externalId`	Yes	e.g. the user's email address.
`authenticationToken`	Yes	e.g. the user's password.
`clientLibVersion`	Yes	Must be a client library version brainCloud still supports.
`gameVersion`	Sometimes	Required only if your app sets a minimum app version for that platform.
`forceCreate`	No	False by default. Set it to true to create the user if the account doesn't exist yet.
`clientLib`	No	Informational only.
`profileId`	No	Can be left out.
`externalAuthName`	No	Only used with External authentication.
`countryCode`, `languageCode`, `timeZoneOffset`	No	Set the user's country, language and time zone. The language falls back to the app's default.
`ccCall`	No - ignored	Only meaningful for calls made from Cloud Code; ignored on requests sent to `/dispatcherv2`.

So the smallest body for an email authenticate call looks like this:

{
  "packetId": 0,
  "messages": [
    {
      "service": "authenticationV2",
      "operation": "AUTHENTICATE",
      "data": {
        "gameId": "YOUR_APP_ID",
        "releasePlatform": "IOS",
        "authenticationType": "Email",
        "externalId": "user@example.com",
        "authenticationToken": "user-password",
        "clientLibVersion": "4.6.0",
        "gameVersion": "1.0.0",
        "forceCreate": true
      }
    }
  ]
}

Generate the MD5 with a Postman pre-request script (recommended)

Postman can calculate the MD5 and add the X-SIG header for you every time you click Send, so you never have to copy the body to another tool, and editing the body never leaves you with a stale checksum.

Find your App Secret on the brainCloud portal App > Design > Core App Info > Application IDs page.

In your Postman request, open the Scripts tab and choose Pre-request (labelled Before request in some Postman versions; older versions have a separate Pre-request Script tab).
Paste the following script, replacing YOUR_APP_SECRET with your App Secret:

// Your App Secret, from App > Design > Core App Info > Application IDs
var secret = "YOUR_APP_SECRET";

// The exact body that will be sent, with any Postman variables filled in
var body = pm.variables.replaceIn(pm.request.body.raw);

// MD5 of the body with the App Secret appended
var hash = CryptoJS.MD5(body + secret).toString();

// Add the X-SIG header, or replace it if it is already there
pm.request.headers.upsert({ key: "X-SIG", value: hash });

If you previously added an X-SIG header by hand on the Headers tab, delete it - the script sets it for you.
Now you are good to go! Click the Send button and check the response from the brainCloud API server. You can see the header the script added under the request's Headers in the Postman Console.

Go to brainCloud portal User > Summary > User Summary to check the user you just created from Postman.

Tips:

To avoid pasting the secret into every request, add the script to the Scripts tab of the collection or folder instead - it then runs before every request in it. You can also keep the secret in a Postman environment variable (e.g. appSecret) and read it with var secret = pm.environment.get("appSecret");.
Keep your App Secret private - don't share or publish requests or collections that contain it.
If the response is Bad sig (reason code 40301), check that the secret is the App Secret of the app in gameId, on the same brainCloud server you are sending to.

Alternative: generate the MD5 with an MD5 tool

If you'd rather not use a script, you can calculate the MD5 outside Postman and add the header by hand. You'll have to repeat these steps every time the body changes.