Postman API Testing Cheat Sheet
A reference for building requests, using variables, writing test scripts, and running collections in Postman.
2 PagesIntermediateFeb 20, 2026
Core Concepts
Building blocks of a Postman workspace.
- Collection- A folder of saved requests that can be organized, shared, and run together
- Environment- A named set of variables (e.g. dev, staging, prod) swapped without editing requests
- Variable scopes- Global, collection, environment, and local variables, resolved in that precedence order
- Pre-request script- JavaScript that runs before the request is sent (e.g. to set a timestamp or token)
- Tests tab- JavaScript assertions that run after the response is received
- Runner- Executes an entire collection or folder sequentially, optionally with a data file
Using Variables
Referencing and setting variables in a request.
javascript
// In URL or body: {{base_url}}/users/{{userId}}// Pre-request script: set a variablepm.environment.set("timestamp", Date.now());// Read a variableconst token = pm.environment.get("authToken");// Set from response in Tests tabconst body = pm.response.json();pm.environment.set("authToken", body.token);
Test Scripts (pm.test)
Common assertions written in the Tests tab.
javascript
pm.test("Status code is 200", function () { pm.response.to.have.status(200);});pm.test("Response has id field", function () { const jsonData = pm.response.json(); pm.expect(jsonData).to.have.property("id");});pm.test("Response time under 500ms", function () { pm.expect(pm.response.responseTime).to.be.below(500);});
Auth & Headers
Common authorization patterns used in requests.
javascript
// Bearer token header// Key: Authorization Value: Bearer {{authToken}}// Basic auth (Authorization tab -> Basic Auth)// username/password auto-encoded to base64// API key in header// Key: x-api-key Value: {{apiKey}}// Newman CLI: run a collection headlessly// newman run collection.json -e environment.json
Dynamic Variables & Faker Data
Generate randomized request data at send-time using Postman's built-in dynamic variables.
javascript
// Use directly in URL, headers, or body:// {{$guid}} -> random UUID// {{$timestamp}} -> current Unix timestamp// {{$randomInt}} -> random integer 0-1000// {{$randomEmail}} -> random fake email// {{$randomFullName}} -> random fake name// Pre-request script: build a request-scoped dynamic valueconst idempotencyKey = pm.variables.replaceIn("{{$guid}}");pm.request.headers.add({ key: "Idempotency-Key", value: idempotencyKey});// Combine faker-style data with a custom seed for reproducibilityconst seed = pm.environment.get("testRunSeed") || Date.now();pm.environment.set("testRunSeed", seed);
Conditional Request Flow (postman.setNextRequest)
Control execution order and branch or skip requests inside a collection run.
javascript
// Skip straight to a named request, bypassing everything in betweenif (pm.response.code === 401) { postman.setNextRequest("Refresh Token");} else { postman.setNextRequest("Get Order Details");}// Stop the entire run early (e.g. fatal setup failure)if (pm.response.code >= 500) { postman.setNextRequest(null);}// Loop a request N times using an environment counterlet iterations = parseInt(pm.environment.get("loopCount") || "0", 10);if (iterations < 5) { pm.environment.set("loopCount", iterations + 1); postman.setNextRequest("Poll Job Status");}
JSON Schema & Contract Validation
Assert an entire response body against a JSON Schema instead of field-by-field checks.
javascript
const schema = { type: "object", required: ["id", "email", "createdAt"], properties: { id: { type: "string" }, email: { type: "string", format: "email" }, createdAt: { type: "string" } }};pm.test("Response matches user schema", function () { pm.response.to.have.jsonSchema(schema);});// Assert array of items all conformpm.test("Every item has required fields", function () { const items = pm.response.json(); items.forEach((item) => { pm.expect(item).to.have.all.keys("id", "name", "price"); });});
Newman in CI Pipelines
Run collections headlessly in CI with machine-readable reports and exit codes.
bash
# Install once, run anywhere with Nodenpm install -g newman newman-reporter-htmlextra# Run with an environment, data file for iterations, and JUnit output for CInewman run collection.json \ -e prod.postman_environment.json \ -d test-data.csv \ --iteration-count 3 \ --reporters cli,junit,htmlextra \ --reporter-junit-export results/junit.xml \ --bail# Newman exits non-zero on any failed test/assertion,# so it plugs directly into a CI "fail the build" step
Scripting Lifecycle & Advanced APIs
Lesser-known script contexts and objects beyond basic pm.test.
- Collection-level scripts- Pre-request/test scripts set on the collection root run for every request inside it, before the request's own scripts
- pm.sendRequest()- Fires an ad-hoc async HTTP call from within a script, e.g. to fetch a fresh OAuth token before the main request
- pm.execution.setNextRequest()- Modern replacement for postman.setNextRequest(), used in the newer sandbox
- pm.info- Exposes requestName, iteration, and requestId inside scripts for conditional logic
- pm.visualizer.set()- Renders a custom HTML/handlebars template of the response in the Visualize tab
- Vault / secret variables- Variable type that masks values in the UI and logs, for API keys and passwords
- pm.cookies- Read/inspect cookies set on the response for the current domain
Pro Tip
Chain requests by extracting a value (like an auth token or created resource ID) from one response into an environment variable in its Tests tab, then reference it with `{{variable}}` in later requests in the same collection run.
Was this cheat sheet helpful?
Explore Topics
#PostmanAPITesting#PostmanAPITestingCheatSheet#ToolsOthers#Intermediate#CoreConcepts#UsingVariables#TestScriptsPmTest#AuthHeaders#DataStructures#APIs#Testing#CheatSheet#SkillVeris
