Using the .NET .http file to test native auth in Entra External ID (EEID)

Rory Braybrook

3 min read

·

Aug 31, 2026

--

1

Listen

Share

All the .http posts are here.

The .http docs are here.

The native auth docs are here.

Read this for more background.

A “.http” file is a plain-text file supported natively by the VS HTTP client editor (also compatible with the VS Code REST Client extension format) that lets you define, organise, and execute HTTP requests directly from your IDE — without needing external tools like Postman or curl.

In a .NET project, it’s commonly scaffolded automatically alongside ASP.NET Core Web API projects, giving you a ready-made way to exercise your API’s endpoints during development.

I have been using Postman to test the API, but when I created another native auth project, I decided to try the .http method.

As stated above, this is now part of the project. I don’t need to use Postman.

My .http file to test EEID sign-in via native auth with username and password looks like:

@BasicApi_HostAddress = http://localhost:5216

### Native Auth Password
@tenant = eeid tenant name e.g. contoso
@tenantDomain = contoso.onmicrosoft.com
@clientId = dd...b9
@username = some-user@company.co.nz
@password = some-password

### Start sign up
# @name startSignUp
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/initiate
Content-Type: application/x-www-form-urlencoded
Host: {{tenant}}.ciamlogin.com

client_id={{clientId}}&challenge_type=password redirect&username={{username}}

###

### Challenge
# @name challenge
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/challenge
Content-Type: application/x-www-form-urlencoded

client_id={{clientId}}&challenge_type=password redirect&continuation_token=
  {{startSignUp.response.body.$.continuation_token}}

###

### Token
# @name token
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={{clientId}}&password={{password}}&continuation_token=
  {{challenge.response.body.$.continuation_token}}
  &grant_type=password&scope=openid offline_access

###

Note: The body lines are wrapped here for readability only.

In VS, it looks like:

Press enter or click to view image in full size

To send the “Start sign up” request, just click “Send request”.

This displays:

Press enter or click to view image in full size

in a separate tab.

The “continuation_token” is then passed to the next request. You have to run the requests in the correct order.

“{{startSignUp.response.body.$.continuation_token}}” is a variable expression that VS resolves at request-send time, right before the request is transmitted.

This:

• Looks up the named request (`startSignUp`) in the in-memory response cache
• Reads its “response.body”
• Applies the JSONPath “$.continuation_token” to extract the value from the JSON response
• Substitutes the resolved value into the request body/headers/URL wherever the “{{…}}” placeholder appears

The end result of the “Token” request is:

{
  "token_type": "Bearer",
  "scope": "profile openid email 00000003-0000-0000-c000-00...00/User.Read",
  "expires_in": 3773,
  "ext_expires_in": 3773,
  "access_token": "ey...eg",
  "refresh_token": "1....Vg",
  "id_token": "ey...7g"
}

Clicking the “Debug” link starts the project under the debugger (if not already running) and immediately fires this request, so breakpoints are hit.

There’s a lot more functionality, e.g environments and secrets — refer to the docs above.

Refer to “How to run a .http file”.

All good!