}
		if testCase.expectedRespStatus != http.StatusOK {
			b, err := io.ReadAll(rec.Body)
			if err != nil {
				t.Fatal(err)
			}
			var apiErr APIErrorResponse
			err = xml.Unmarshal(b, &apiErr)
			if err != nil {
				t.Fatal(err)
			}
			gotErr := apiErr.Code
			wantErr := testCase.wantAPICode
			if gotErr != wantErr {

	}
	expectedMap.Set("Vary", "Origin")

	req, _ := http.NewRequest(http.MethodOptions, s.endPoint, nil)
	req.Header.Set("Origin", "http://foobar.com")
	res, err := s.client.Do(req)
	if err != nil {
		c.Fatal(err)
	}

	for k := range expectedMap {
		if v, ok := res.Header[k]; !ok {
			c.Errorf("Expected key %s missing from %v", k, res.Header)
		} else {
			expectedSet := set.CreateStringSet(expectedMap[k]...)

		c.Fatalf("root user should have access to all buckets")
	}

	// This must fail.
	if err := userAdmClient.AddUser(ctx, globalActiveCred.AccessKey, globalActiveCred.SecretKey); err == nil {
		c.Fatal("AddUser() for root credential must fail via root STS creds")
	}
}

// TestSTSTokenRevoke - tests the token revoke API
func (s *TestSuiteIAM) TestSTSTokenRevoke(c *check) {

    executeSynchronously("/").assertBody("retry success")

    // The call that seeds the connection pool.
    listener.removeUpToEvent(CallEnd::class.java)

    // The ResponseFailed event is not necessarily fatal!
    listener.removeUpToEvent(ConnectionAcquired::class.java)
    listener.removeUpToEvent(ResponseFailed::class.java)
    listener.removeUpToEvent(ConnectionReleased::class.java)