# Reporting from CI with JUnit XML

> Create the app token your CI pipeline reports test results with, and manage it from the JUnit XML card.

The **JUnit XML** app sends the JUnit XML report your test framework writes to Probara from any CI
pipeline, with the Probara CLI. Each report becomes an automated test run with its results, the
test cases it names and their attachments.

The CLI signs in with an **app token**: a token that belongs to the organization, not to a person.
It uses no seat, and it keeps working when the person who created it leaves. This guide covers the
card in Probara; the [CLI page](https://docs.probara.net/en/developers/cli/) covers the pipeline side.

## Before you start

| You need                                              | Why                                                                                                                         |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| A paid plan (**Pro** or **Enterprise**, or any trial) | Reporting from CI is not part of the Free plan. On Free, its dialog shows **See plans** instead of **Create an app token**. |
| A Probara **owner** or **admin**                      | Only owners and admins can create and manage app tokens. Other members see the card without its tokens.                     |

## Create a token

1. In **Workspace › Integrations**, select the **JUnit XML** card. The dialog lists what the app can
   do and links to the CLI guide.
2. Open the **Access tokens** tab and select **Create an app token**.
3. Enter a **Token name** and select **Create token**. Name it after what uses it — the repository
   or the pipeline — so you know which one to revoke later.
4. Select **Copy token** in **Copy your new token**. This is the only time Probara shows it: store it
   in your CI as a secret named `PROBARA_API_TOKEN` before you select **Done**.
5. Add this step to your pipeline after the tests, and replace `<PROJECT_CODE>` with your project's
   Project ID, such as `SHOP`:

   ```yaml
   - name: Report to Probara
     if: always()
     run: npx @probara/cli import junit reports/junit.xml
     env:
       PROBARA_API_TOKEN: ${{ secrets.PROBARA_API_TOKEN }}
       PROBARA_PROJECT: <PROJECT_CODE>
   ```

The card on the Integrations page shows how many active tokens the app has.

## Manage tokens

Under **App tokens**, the **Access tokens** tab lists each active token with who created it (or
**Created by a removed user**), when, and when it was last used (**Never** until its first report).

**Revoke** a token, and confirm, when it may have leaked or when someone who could read it leaves
your team: pipelines that use it stop reporting at once, and it cannot be undone. Create a new token
for them first. Because an app token outlives the person who created it, rotating it is your call:
Probara never revokes it on its own.

## What an app token can do

Only what the CLI does: create automated runs, send reports (which can create the test cases and
suites they name), add attachments to their results, and close runs — and, for the framework
reporters, read the case keys of a run. It cannot read anything else, cannot remove attachments, and cannot be used with [Probara MCP](https://docs.probara.net/en/developers/mcp/) or for any other API
call. For scripts and other API clients, use a personal [API token](https://docs.probara.net/en/developers/authentication/).

## Where its work shows up

Runs, activity entries and attachments that an app token created show the app's logo and name beside
the token name — for example **JUnit XML · nightly-ci** — in the runs list, the run and milestone
summaries, [Workspace activity](https://docs.probara.net/en/guides/workspace/activity/) and the attachments list. A revoked
token keeps its name there.

## When the plan changes

If your organization moves to the Free plan, its app tokens are kept but Probara refuses them, so
pipelines stop reporting; its dialog says so and offers **See plans**. You can still see and revoke the
tokens. They work again as soon as the organization is back on a paid plan, with nothing to set up
again. Manual test runs are not affected.