Joao and I worked this out over IM. For the benefit of others, here's what was happening.
All Joao had access to was the request payload:
grant_type=password&username=Usuario&password=user123456
When attempting to create a VSI through req/rsp pairs, DevTest couldn't determine the operation without the POST line. So, we added it manually like this:
POST /gateway/oauth/token HTTP/1.1
grant_type=password&username=Usuario&password=user123456
Now, we were getting the operation name, but no arguments. To get the arguments to be recognized, we had to indicate embedded form parameters were present using a header:
POST /gateway/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
grant_type=password&username=Usuario&password=user123456
From there, everything started to work.
--Mike