How to Test API Using Postman – Step-by-Step Guide

How to Test API Using Postman – Step-by-Step Guide

/ Software Testing / By

How to Test API Using Postman: A Step-by-Step Guide for Beginners

Application Programming Interfaces (APIs) play an important role in modern software development by allowing different applications and systems to communicate with one another. From mobile applications and e-commerce websites to banking platforms and cloud services, APIs help exchange data and perform operations efficiently.

However, an API must work correctly to ensure that an application delivers the expected results. This is where API testing becomes essential. Developers and software testers use tools such as Postman to send requests, examine responses, validate data, and identify errors.

If you are a beginner wondering how to test an API using Postman, this guide will help you understand the process step by step. You will learn about HTTP methods, API requests and responses, authentication, test scripts, collections, and common troubleshooting techniques.

What Is API Testing?

API testing is a software testing technique used to verify whether an Application Programming Interface behaves according to its requirements. It focuses on the communication between software components rather than testing only the application’s visual interface.

During API testing, testers send requests to an endpoint and examine the responses returned by the server. They check whether the correct data is received, whether errors are handled appropriately, and whether the API behaves as expected under different conditions.

Why Is API Testing Important?

API testing helps development and testing teams identify problems before they affect end users.

Some important benefits include:

  • Functional validation: Confirms that API operations perform their intended functions.
  • Data accuracy: Checks whether the API returns or updates the expected information.
  • Error detection: Identifies issues involving invalid inputs, missing parameters, and server errors.
  • Security validation: Helps verify authentication, authorisation, and access controls.
  • Integration testing: Checks whether different software components communicate correctly.
  • Regression testing: Helps detect whether code changes have affected previously working functionality.

API testing can also support performance testing and reliability assessments, although these activities may require specialised test configurations and tools.

What Is Postman?

Postman is a widely used API development and testing platform that enables developers and testers to create requests, send them to API endpoints, inspect responses, and automate checks.

Its interface makes it possible to test many APIs without writing a complete testing program from scratch. Users can configure request methods, headers, query parameters, request bodies, and authentication settings through the interface.

Key Features of Postman

1. HTTP request support

Postman supports common HTTP methods, including GET, POST, PUT, PATCH, and DELETE, allowing users to test different API operations.

2. Response inspection

Users can examine response status codes, headers, response times, and body content to understand how an API behaves.

3. Collections

Collections organise related API requests into reusable groups, making it easier to manage tests for a project.

4. Environment variables

Variables can store reusable values such as base URLs, identifiers, and configuration settings for different environments.

5. Automated testing

JavaScript-based test scripts can validate response status codes, data fields, and other expected conditions.

6. Collaboration and documentation

Postman provides features for organising, documenting, and sharing API work with other team members, depending on the available workspace and plan features.

How to Install and Set Up Postman

Before testing an API, you need access to Postman and an API endpoint that you are authorised to use.

Step 1: Install Postman

Visit the official Postman website and download the appropriate desktop application or use its supported web experience.

Follow the installation instructions for your operating system. Open Postman and sign in or create an account if required for the features you intend to use.

Step 2: Create a Workspace

A workspace provides an area for organising your API requests and related resources.

Create a workspace for your project, such as an e-commerce application, student management system, or employee management API.

A clear workspace structure helps keep requests organised as the number of tests grows.

Step 3: Create a New HTTP Request

Open a new request in Postman. You will generally need to configure the following elements:

  • HTTP method
  • API endpoint URL
  • Query parameters, if required
  • Request headers, if required
  • Authentication details, if required
  • Request body, for methods and endpoints that accept one

Once the required details are configured, you can send the request and inspect the response.

How to Test an API Using Postman Step by Step

The easiest way to understand API testing is to practise with a publicly available test API. The following example uses JSONPlaceholder, a sample API intended for testing and learning.

Step 1: Enter the API Endpoint

Open a new request in Postman and enter this sample endpoint:

https://jsonplaceholder.typicode.com/todos/1

This endpoint returns a sample to-do item. It is suitable for practising a basic GET request without modifying a real user’s data.

Step 2: Select the HTTP Method

Choose GET from the method dropdown.

GET requests are used to retrieve information from a server. The other HTTP methods serve different purposes, depending on the API’s design.

HTTP method Common purpose
GET Retrieve information
POST Submit data or create a resource
PUT Replace a resource or update it according to the API’s rules
PATCH Partially update a resource
DELETE Request deletion of a resource

The exact behaviour depends on the API implementation. Always check the API documentation before selecting a method.

Step 3: Send the Request

Click Send.

Postman sends the request to the specified endpoint and displays the response.

For the sample endpoint, the response should contain a JSON object similar to this:

{
  "userId": 1,
  "id": 1,
  "title": "delectus aut autem",
  "completed": false
}

The example demonstrates how an API can return structured data. The exact response should be checked against the service’s current behaviour.

Step 4: Check the Status Code

After sending the request, inspect the HTTP status code displayed in the response area.

Common status codes include:

  • 200 OK: The request was successful.
  • 201 Created: A resource was created successfully.
  • 204 No Content: The request succeeded without a response body.
  • 400 Bad Request: The server could not process the request because of a client-side problem.
  • 401 Unauthorized: Authentication is missing or invalid.
  • 403 Forbidden: The request is understood, but access is not permitted.
  • 404 Not Found: The requested resource or endpoint was not found.
  • 500 Internal Server Error: The server encountered an unexpected problem.

A status code alone does not prove that the API is correct. You should also verify the returned data and any relevant business rules.

Step 5: Examine the Response Body

The response body contains the data returned by the API, when applicable.

For a JSON response, verify that:

  • The expected fields are present.
  • Values have the correct types.
  • The returned information matches the test scenario.
  • Unexpected or sensitive information is not exposed.
  • Error responses follow the API’s expected format.

For example, if the endpoint is supposed to return a to-do item, check that the response includes an identifier, a title, and a completion status.

Step 6: Inspect Response Headers and Time

Response headers may contain information about content type, caching, and other server behaviour.

For example, a JSON API commonly returns a content type indicating JSON data.

You can also inspect the response time shown by Postman. This helps you observe how long the request took under your current testing conditions. A single measurement does not establish overall performance; reliable performance testing requires repeated tests under controlled conditions.

How to Test GET and POST Requests in Postman

GET and POST requests are two common operations that beginners should understand.

Testing a GET Request

A GET request retrieves information from an endpoint.

For example:

https://jsonplaceholder.typicode.com/posts/1

To test it:

  1. Create a new request.
  2. Select GET.
  3. Enter the endpoint URL.
  4. Click Send.
  5. Check the response status, body, and headers.
  6. Confirm that the returned data matches the expected result.

You can also use query parameters when supported by the API. For example, an endpoint may accept a parameter to filter records by category or user ID.

Testing a POST Request

A POST request commonly submits information to an API to create a resource or initiate an operation.

For a learning example, use the JSONPlaceholder posts endpoint:

https://jsonplaceholder.typicode.com/posts

Follow these steps:

  1. Create a new request in Postman.
  2. Select POST.
  3. Enter the endpoint URL.
  4. Open the Body section.
  5. Select the raw body option and choose JSON.
  6. Enter a sample request body.
  7. Click Send and examine the response.

Example request body:

{
  "title": "Learning API Testing",
  "body": "Practising API requests with Postman",
  "userId": 1
}

The sample service may return a simulated created record. This should not be interpreted as permanent storage in a production database.

When testing a real POST endpoint, verify the expected status code, returned resource identifier, response fields, validation rules, and any side effects documented by the API.

How to Use Headers, Parameters, and Authentication

Many APIs require additional information beyond the endpoint URL and HTTP method.

Query Parameters

Query parameters help pass values through the URL. They are often used for filtering, sorting, pagination, or searching.

For example, an API might support a URL containing parameters for a user ID or page number.

In Postman, enter these values in the Params section. Postman will construct the query string in the request URL.

Request Headers

Headers provide additional information about the request.

Common examples include:

  • Content-Type: Specifies the format of the request body.
  • Accept: Indicates the response formats the client can accept.
  • Authorization: Carries authentication credentials or tokens when required.

The exact headers depend on the API specification.

Authentication in Postman

Protected APIs may require authentication before they allow access to resources.

Postman supports several authentication approaches, including:

Basic authentication: Sends a username and password using the HTTP Basic authentication scheme. HTTPS should be used to protect credentials in transit.

Bearer token authentication: Sends an access token, commonly in the Authorization header.

API key authentication: Uses a key in a header, query parameter, or another location specified by the API.

OAuth 2.0: Uses an authorisation framework to obtain and use access tokens according to the configured flow.

Select the appropriate authentication type in the request’s Authorization settings and provide the required values securely. Avoid sharing tokens, passwords, or private API keys in screenshots, exported collections, or public repositories.

How to Write API Tests and Assertions in Postman

Sending requests manually is useful for learning, but test scripts help validate responses consistently.

Postman provides a JavaScript-based scripting environment where you can check status codes, response values, and other conditions. In current Postman workflows, response validation scripts are commonly added in the Scripts area under Post-response.

Example: Validate the Status Code

Use the following script to verify that a GET request returns HTTP 200:

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

After sending the request, Postman runs the test and reports whether the assertion passes.

Example: Validate a JSON Field

For the sample to-do endpoint, you can check whether the returned object contains an ID and a title:

pm.test("Response contains expected fields", function () {
    const data = pm.response.json();

    pm.expect(data).to.have.property("id");
    pm.expect(data).to.have.property("title");
});

This test checks whether the required fields exist. More detailed tests can validate data types, exact values, and business rules.

Example: Validate a Boolean Value

You can also check that the completed field in the sample to-do response is a Boolean:

pm.test("Completed field is a boolean", function () {
    const data = pm.response.json();

    pm.expect(data.completed).to.be.a("boolean");
});

These examples demonstrate basic response validation. Real projects should include positive scenarios, negative scenarios, boundary conditions, and checks for appropriate error handling.

How to Organise API Tests Using Collections and Environments

When an application has many endpoints, managing individual requests separately becomes difficult. Collections and environments help organise the testing workflow.

What Are Postman Collections?

A collection is a group of related requests. For example, a student management API collection might include requests to:

  • Retrieve student records.
  • Create a student record.
  • Update student information.
  • Retrieve a specific student.
  • Delete a test record.

Collections make requests easier to reuse, share, and run as a group.

What Are Environment Variables?

Environment variables store reusable configuration values.

For example, you might create a variable named baseUrl for the API’s base address and reference it in requests:

{{baseUrl}}/todos/1

Different environments can use different base URLs, such as development, testing, and staging systems.

Store sensitive values carefully and use appropriate secret-management practices. Do not commit credentials or access tokens to public repositories.

Running a Collection

Postman’s collection-running features can execute multiple requests in sequence. Where configured, test scripts can check the responses and report failures.

Before running a collection against a real system, ensure that the requests are appropriate for that environment. Requests that create, modify, or delete data should use authorised test data and suitable cleanup procedures.

How to Automate API Testing with Postman

Automated API testing helps teams repeat checks after code changes and reduce the need for manual verification.

A typical workflow includes:

  1. Create a collection of related API requests.
  2. Add assertions to validate expected responses.
  3. Configure variables and authentication.
  4. Run the collection using the available runner.
  5. Review test results and investigate failures.
  6. Integrate collection execution into a suitable continuous integration workflow if required.

Newman is a command-line collection runner associated with Postman collections. It can be used to run supported collection tests from scripts or build pipelines, subject to the relevant setup and compatibility requirements.

Automation is particularly useful for regression testing, but automated tests must be maintained as API requirements change.

Common API Testing Errors in Postman and How to Fix Them

Beginners may encounter errors when configuring requests or communicating with an API. Understanding the possible causes makes troubleshooting easier.

1. 400 Bad Request

Possible causes: Invalid JSON, missing parameters, incorrect field names, or data that fails validation.

How to troubleshoot: Review the API documentation, validate the request body, and check the server’s error response for details.

2. 401 Unauthorized

Possible causes: Missing credentials, an expired token, or an invalid authentication configuration.

How to troubleshoot: Check the authentication method, token validity, and required headers. Obtain credentials only through the authorised process.

3. 403 Forbidden

Possible causes: The authenticated account does not have permission to access the requested resource.

How to troubleshoot: Verify the account’s permissions and the API’s access requirements. Do not attempt to bypass access controls.

4. 404 Not Found

Possible causes: Incorrect endpoint URL, a missing resource, or an unsupported route.

How to troubleshoot: Check the endpoint path, resource identifier, API version, and server documentation.

5. 500 Internal Server Error

Possible causes: An unexpected server-side exception or an issue with a dependent service.

How to troubleshoot: Review the response body and available server logs if you have authorised access. Report reproducible problems to the API development team.

6. Connection or Timeout Errors

Possible causes: Network problems, an unavailable server, incorrect proxy settings, or an endpoint that takes too long to respond.

How to troubleshoot: Check connectivity, confirm the endpoint is accessible, and review relevant network and timeout settings.

Best Practices for Effective API Testing

Following a consistent testing process improves test quality and makes failures easier to diagnose.

  • Read the API documentation: Understand the expected inputs, outputs, status codes, and authentication requirements.
  • Test positive and negative scenarios: Verify valid requests as well as missing fields, invalid values, and unauthorised access.
  • Validate response data: Check important fields, types, and business rules instead of relying on status codes alone.
  • Use meaningful test names: Clear test names make failures easier to identify.
  • Organise requests into collections: Group related requests and use variables to reduce duplication.
  • Protect credentials: Keep API keys, tokens, and passwords out of public collections and source control.
  • Use controlled test environments: Avoid modifying production data unless explicitly authorised and necessary.
  • Automate repetitive checks: Run appropriate collections regularly and review failures.
  • Maintain your tests: Update assertions and test data when API contracts change.

Frequently Asked Questions About API Testing Using Postman

1. What is Postman used for in API testing?

Postman is used to create and send API requests, inspect responses, validate returned data, configure authentication, organise collections, and automate tests.

2. How do I test a REST API in Postman?

Enter the API endpoint, select the required HTTP method, configure parameters, headers, authentication, and request body as needed, then click Send. Verify the response status, headers, body, and expected behaviour.

3. Can beginners learn API testing using Postman?

Yes. Beginners can start by sending GET requests to sample APIs, inspecting JSON responses, learning HTTP methods, and gradually progressing to POST requests, authentication, and automated assertions.

4. What is the difference between GET and POST in Postman?

GET is commonly used to retrieve information, while POST is commonly used to submit data or create resources. The exact behaviour depends on the API’s specification.

5. Can Postman automate API testing?

Yes. Collections, test scripts, and collection-running features can automate many API checks. Newman can also run supported Postman collections from the command line.

6. What is a collection in Postman?

A collection is a group of API requests organised for reuse, collaboration, and testing. Collections can also include scripts and other configuration relevant to the testing workflow.

7. Do I need programming knowledge to use Postman?

You can perform basic API testing through Postman’s interface without writing code. However, knowledge of JavaScript is useful for creating advanced test scripts and assertions.

8. Which API should I use to practise Postman?

JSONPlaceholder is a sample API that beginners can use to practise common request patterns. Always check its documentation and understand that simulated write operations may not persist data like a production API.

Conclusion

Learning how to test an API using Postman is a valuable step for aspiring software testers, developers, and quality assurance professionals. Postman makes it possible to send requests, inspect responses, validate data, configure authentication, and organise repeatable tests in one workflow.

Start with simple GET requests and response validation, then practise POST requests, headers, authentication, collections, and automation. As your skills develop, focus on testing real-world scenarios, identifying edge cases, and understanding API requirements.

If you want to strengthen your software testing knowledge, explore the training resources available at eLearning Solutions. Building practical API testing skills can help you develop a stronger foundation for software testing and quality assurance work.

Final tip: Practise with authorised test APIs, document your test cases, and validate both successful and unsuccessful responses. Consistent practice will help you become more confident in API testing with Postman.

    Related Posts

    Scroll to Top