Postman is API client tool for testing and documenting APIs. Allows making requests, automating tests, monitoring APIs. Available as desktop app and web client.

Request builder, collections, environments, automated testing, API documentation, mocking, monitoring, collaboration tools.

An HTTP request with method, URL, headers, body, parameters. Configure response validation, scripts, and tests.

GET (retrieve), POST (create), PUT (update), PATCH (partial update), DELETE (remove), HEAD (like GET without body). Most common for API testing.

PUT replaces entire resource, PATCH partially updates resource. PATCH is more efficient for small updates.

Provide metadata for request: Content-Type, Authorization, Accept, User-Agent. Key-value pairs sent with request.

Specifies format of request body: application/json (JSON), application/x-www-form-urlencoded (form), text/plain (text).

Provides authentication credentials: Bearer token, Basic auth (username:password encoded), API keys. Format: Authorization: Bearer <token>

Parameters appended to URL: /users?id=1&name=John. In Postman, add in Params tab.

Data sent in request (POST, PUT, PATCH). Formats: JSON, XML, form-data, raw. In Postman, configure in Body tab.

Folder containing related requests. Organize requests logically. Export/share collections.

Set of variables for different contexts (dev, staging, production). Example: {{base_url}} replaced with environment value.

Reference with {{variable_name}}. Define in Global, Collection, or Environment scope. Example URL: {{base_url}}/users

JavaScript code executed before request. Used for setup: generate tokens, set variables. Example: pm.environment.set("token", "abc123");

JavaScript code executed after request. Validate response. Example: pm.test("Status is 200", function() { pm.response.to.have.status(200); });

Global object providing Postman API. Methods: pm.test(), pm.response, pm.request, pm.environment.set/get().

pm.test("Status is 200", function() { pm.response.to.have.status(200); });

pm.test("Body contains userId", function() { pm.expect(pm.response.text()).to.include("userId"); });

const jsonData = pm.response.json(); Then access: jsonData.property or jsonData[0].property

pm.test("userId is 1", function() { pm.expect(pm.response.json().userId).to.equal(1); });

Data returned by server. Displayed in Response panel. Can be JSON, XML, HTML, plain text.

HTTP status: 200 (OK), 201 (Created), 400 (Bad Request), 401 (Unauthorized), 404 (Not Found), 500 (Server Error).

Metadata returned by server: Content-Type, Set-Cookie, Cache-Control. View in Headers tab.

1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, 5xx Server Error.

Username and password encoded in Base64. Authorization: Basic <base64(username:password)>. Set in Authorization tab: Type: Basic Auth.

Token sent in Authorization header. Authorization: Bearer <token>. Secure for APIs.

Key sent as header or query parameter. Example: X-API-Key: abc123 or ?api_key=abc123

Small data stored on client. Sent automatically with requests. Manage in Cookies panel.

CORS controls cross-origin requests. Postman disables CORS locally (useful for testing). Enable "Disable CORS" if needed.

Verify SSL certificate authenticity. Can disable for testing: Settings -> SSL certificate verification toggle.

Execute multiple requests in collection sequentially. Useful for test suites. Click Collection -> Run.

CSV/JSON file containing test data. Runner iterates through rows. Useful for data-driven testing.

Number of times to execute collection. Useful for load testing or running same tests multiple times.

Save response body as example: Response panel -> Save as example. Attach to request.

Simulate API behavior without real server. Configure examples for responses. Useful for frontend development.

Generate documentation from collection. Include descriptions, examples, response codes. Share with team.

Container for collections and environments. Organize work logically. Share workspace with team members.

Export: Collection -> Export -> JSON. Share file or link. Invite team members to shared workspace.

Records recent requests. Access in History panel. Useful for revisiting requests.

Verify response meets expectations: pm.expect(value).to.equal(expected). Assertions fail if not true.

pm.test("Response time < 200ms", function() { pm.expect(pm.response.responseTime).to.be.below(200); });

pm.response.responseSize; Useful for API performance testing.

Intercept requests/responses. Settings -> Proxy. Useful for debugging and monitoring traffic.

Filter requests in Runner results. Show/hide passed, failed, skipped tests.

Use pre-request script: pm.environment.set("timestamp", Date.now()); Reference in request: {{timestamp}}

Use pre-request script: pm.environment.set("uuid", pm.guid()); Reference: {{uuid}}

Multipart form data for file uploads. Body -> form-data. Add file type for file uploads.

Send raw JSON, XML, or text. Body -> raw. Specify content type: JSON, XML, Text.

Encode special characters in URL. Postman auto-encodes. Example: space becomes %20

Store response data in variables: const id = pm.response.json().id; pm.environment.set("id", id); Use in next request: /users/{{id}}

Generate code for requests. Supported languages: JavaScript, Python, cURL, Java. Useful for integration.

Command-line runner for Postman collections. Run tests in CI/CD: newman run collection.json

Install Newman plugin or run via command line. Execute collection as build step. Generate reports.

Use if statements to control test flow: if (pm.response.code === 200) { ... }

pm.environment.set("key", value) for environment. pm.globals.set("key", value) for global. pm.variables.set("key", value) for local.

Validate response structure against schema. Use ajv library in Postman for JSON schema validation.

Parse JSON: const arr = pm.response.json(); Test length: pm.expect(arr).to.be.an('array').that.is.not.empty

Parse response and use values. Extract values for next requests. Chain APIs based on response.

Maximum time to wait for response. Settings -> Timeout in ms. Default: 0 (no timeout).

Automatically retry failed requests. Settings -> Automatically follow redirects toggle.

By default, Postman follows redirects. Check response history: Response panel -> Timeline. Verify final URL.

Gzip/Brotli compression. Postman auto-decompresses. Check Content-Encoding header.

Parse XML: const xmlToJson = pm.response.text(); Validate XML structure using regex or libraries.

Authorization type for OAuth APIs. Get tokens programmatically. Postman manages token refresh.

Local > Env > Global. Local scoped variables have highest priority. Allows variable overriding.

Runner shows results in console. Export as JSON or other formats using plugins.

Schedule collection runs at intervals. Monitor API health, performance, uptime. Send notifications on failures.

Modify requests before sending. Use pre-request scripts. Useful for adding auth headers, timestamps.

Process responses after receiving. Use test scripts. Validate, transform, log responses.

Use console.log in scripts. View output in Console panel. Check request/response details.

Measure response time, size. Compare performance across versions. Identify bottlenecks.

Iterate through pages. In pre-request script, adjust page parameter. Validate items per page.

Request with sort parameter: /items?sort=name. Validate response order. Compare consecutive items.

Request with filter parameter: /items?filter=active. Validate only filtered items in response.

Test API with edge cases: null, empty, max values. Ensure proper error handling.

Test with invalid data. Expected failures: 400, 401, 404, 422. Verify error messages.

Send multiple requests rapidly. Check response headers: X-Rate-Limit, Retry-After. Verify 429 status.

Run multiple requests simultaneously. Runner with high iteration count. Monitor for race conditions.

Newman generates HTML reports. Use --reporters html. Share test results with team.

Export versions with timestamps. Use git for version control. Track API changes over time.

Variables available across workspaces. Set in Manage Environments -> Globals tab. Use: {{variable}}

Settings -> SSL certificate verification toggle. Use only for testing. Never in production.

Auto-generated token for requests. Used to prevent CSRF attacks. Can be disabled.

Postman limits response preview size. Download full response. Use filters in Console.

Postman generates documentation from collection. Include descriptions and examples. Publish to public link.

Save response as example after sending request. Attach to request. Mock server uses examples.

Duplicate request to create variations. Test different parameters/headers without recreating.

Body -> form-data. Add files and fields. Postman handles encoding automatically.

Verify API conforms to contract/schema. Test request/response structure. Detect breaking changes.

Test different API versions: /v1/users, /v2/users. Ensure backward compatibility.

Use {{variable}} syntax in requests. Variables replaced during execution. Supports environment variables.

Headers -> Content-Type. Postman auto-sets for JSON, form-data. Manual for custom types.

Use custom domain for requests. Useful for testing in different environments: dev, staging, prod.

Pre-request script refreshes token before request: fetch token, store in environment, use in request.

Test all endpoints, use data-driven testing, verify error responses, test edge cases, automate, document.

Postman supports WebSocket in newer versions. Send/receive messages. Test real-time communication.

Send GraphQL queries in request body. POST to GraphQL endpoint. Validate JSON response.

Postman supports gRPC (experimental). Test service definitions. Validate messages.

Schedule collection runs periodically. Monitor uptime, performance. Send alerts on failures.

Maintain baseline test results. Compare new runs with baseline. Detect regressions in API behavior.

101-150. Advanced Topics (abbreviated)

101-110: Advanced scripting (Postman sandbox API), custom libraries, helpers and utilities. 111-120: Performance optimization, load testing with Newman, CI/CD integration (Jenkins, GitHub Actions, GitLab CI), Docker integration. 121-130: Security testing (API security, OAuth flows, JWT validation), OWASP testing, penetration testing with Postman. 131-140: Advanced mock servers, contract testing, Postman API for automation, webhooks and integrations. 141-150: Database testing (connecting to databases from Postman), API monitoring dashboards, team collaboration, enterprise features, API gateway testing.