Postman: what it is, API testing and working with requests

What is Postman and key features

Postman is a platform for developing and testing APIs, available as a desktop app (Windows, macOS, Linux) and a web version. Originally created as a Chrome extension in 2012, Postman has grown into a full ecosystem with support for monitoring, mock servers and client code generation.

Request and response formats

Postman supports all HTTP methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. The request body can be in JSON, XML, form-data, x-www-form-urlencoded and binary formats. The response is displayed with syntax highlighting, Pretty-print and the ability to view raw headers.

Authentication support

Built-in authentication types include Bearer Token, Basic Auth, Digest Auth, OAuth 1.0, OAuth 2.0, API Key and AWS Signature. Postman automatically adds Authorization headers according to the selected type, which speeds up testing of protected endpoints without manually copying tokens.

Postman interface and navigation

The Postman interface consists of a side panel (Collections, APIs, Environments), a work area (Request Builder/Response Viewer) and a bottom panel (Console, Runner). The Params tab lets you edit URL query parameters in a table view, and the Headers tab manages HTTP headers.

Postman Console

Console (View → Show Postman Console) logs all network requests and responses in chronological order, including intermediate redirects and headers. It is an indispensable tool when debugging complex OAuth flows and redirect chains when the standard Response Viewer only shows the final result.

Workspaces and team work

Postman supports team workspaces with collection versioning via Fork and Merge. Team members can comment on requests, propose changes and sync collections in real time. Public Workspace lets you publish API documentation for external developers.

Creating and sending HTTP requests

A basic request in Postman is created by selecting an HTTP method and entering a URL in the address bar. After sending, the response is displayed in the bottom panel with the status code, execution time and size. Request parameters are encoded automatically as you type.

Dynamic variables and snippets

Dynamic variables in the format {{$variable}} can be used in the URL and request body. Built-in variables {{$guid}}, {{$timestamp}} and {{$randomInt}} generate unique values for each request. Code snippets are available via the Code button (), which generates an equivalent request in cURL, Python, JavaScript, Kotlin, Swift and other languages.

// Example of a Pre-request script: generating an HMAC signature
const timestamp = Date.now().toString();
const secret = pm.environment.get("api_secret");
const hash = CryptoJS.HmacSHA256(timestamp, secret);
pm.request.headers.add({
    key: "X-Signature",
    value: hash.toString()
});

Collections and environment variables

Collections are groups of related requests combined by project or functional module. Each collection can contain nested folders, shared headers and Pre-request scripts that run before each request in the collection. The order of requests is set by dragging.

Environment variables and global variables

Postman supports five variable levels: global, collection, environment, data and local. Conflict resolution priority is from local to global. Environment files contain key-value pairs for different environments: development, staging, production. Switching environments changes all URLs and tokens automatically.

Automating API testing with scripts

Postman lets you write JavaScript tests in the Tests tab that run after the response is received. Tests check the status code, response body, headers and execution time. Results are displayed in the Test Results panel with color-coded pass indicators.

pm library and request chaining

The pm object provides methods for working with the response: pm.response, pm.expect, pm.variables. Request chaining is implemented by saving data from one request's response into a variable and using it in the next. This is the basis for building integration tests and verifying business logic through a sequence of API calls.

// Test: checking the response structure and saving the token
pm.test("Status code is 200", () => {
    pm.response.to.have.status(200);
});

const json = pm.response.json();
pm.environment.set("auth_token", json.data.token);

Collection Runner and Newman

Collection Runner runs all collection requests sequentially, executing tests at each step. Newman is a console version of Postman for CI/CD pipelines (Jenkins, GitHub Actions, GitLab CI). Newman exports reports in JSON, JUnit and HTML formats for integration with monitoring systems.

Working with GraphQL and WebSocket

GraphQL requests in Postman are sent via POST to a single endpoint with a JSON body. The GraphQL (Beta) tab provides a visual editor with syntax highlighting, field autocomplete and schema. Request variables are passed in a separate Variables panel.

WebSocket and Socket.IO testing

Postman supports WebSocket connections through a separate interface with a message panel. You can send text and binary messages, view connection history and automatically reconnect on disconnect. The Socket.IO client works in compatibility mode with the Engine.IO protocol.

// WebSocket test in Postman via the pm API
const ws = new WebSocket("wss://echo.websocket.org");
ws.onmessage = (event) => {
    pm.test("Echo response received", () => {
        pm.expect(event.data).to.eql("Hello");
    });
};

Mock servers and monitoring in Postman

Mock servers in Postman let you emulate API endpoints based on existing collections. This is useful when the backend is not ready yet, but the frontend or mobile app is already being developed. A mock server returns a sample response from the collection with correct headers and status code.

Creating a Mock server

A mock server is created from a collection in one click: select the collection → Mock Servers → Add a new mock server. Postman generates a unique URL that can be used in the application code instead of the real API. For each collection request, the mock returns a saved Example Response, which lets you test the UI before the backend is finished.

API monitoring with Postman Monitors

Monitors run a collection on a schedule (every 5 minutes, hour or day) and check API availability and correctness. When a test fails, the monitor sends a notification to email or Slack. Monitoring works from the Postman cloud, does not require a separate server and supports up to 10,000 requests per month on the free plan.

// Test for monitoring: checking the response time
pm.test("Response time < 2000ms", () => {
    pm.expect(pm.response.responseTime).to.be.below(2000);
});

pm.test("Content-Type is JSON", () => {
    pm.response.to.have.header("Content-Type");
});

Security and secret management

Postman provides mechanisms for safe work with API keys. Secret-type variables are encrypted and not displayed in the interface. For team work, use a Workspace with Admin, Editor and Viewer roles.

Encrypting variables

When creating an environment variable, select the Secret type — the value is hidden with asterisks in all interfaces. Secrets are not exported to the collection when sharing and are not displayed in Newman logs. Passwords and tokens are recommended to be stored only in Secret variables.

Vault integration

Postman supports integration with HashiCorp Vault and AWS Secrets Manager. Pre-request scripts can dynamically fetch secrets from external storage, avoiding storing sensitive data in collection environment files.

Security and secret management

Postman provides mechanisms for safe work with API keys. Secret-type variables are encrypted and not displayed in the interface. For team work, use a Workspace with Admin, Editor and Viewer roles.

Encrypting variables

When creating an environment variable, select the Secret type — the value is hidden with asterisks in all interfaces. Secrets are not exported to the collection when sharing and are not displayed in Newman logs. Passwords and tokens are recommended to be stored only in Secret variables.

Vault integration

Postman supports integration with HashiCorp Vault and AWS Secrets Manager. Pre-request scripts can dynamically fetch secrets from external storage, avoiding storing sensitive data in collection environment files.