Postman Cheatsheet - API Debugging Tool Reference

Split them by scope and sensitivity. Values tied to one environment — base URLs, credentials — belong in the Environment, because switching between dev, staging and prod replaces them wholesale without disturbing the others. Anything needed across every environment goes in Global, such as formatting conventions or backend-agnostic defaults. Sensitive values belong only in the Environment, and that environment must stay out of version control. On the read side pm.variables.get is usually easier since it resolves across environment and global by precedence; on the write side, use pm.environment.set or pm.globals.set to be explicit about the destination.

It must separate "the endpoint is broken" from "the data changed". Asserting a 200 status alone is close to worthless, since an empty object also returns 200. The useful shape is layered: assert the status code to confirm the channel, then assert a field with pm.expect(pm.response.json().name).to.eql("Alice") to confirm the contract, and add a response-time assertion to catch performance regressions. Pick fields that are stable in business terms — an id type, an enum-valued status — not display text that changes on every run.

They sit at opposite ends of the request lifecycle. Pre-request scripts run before the request is sent and exist to prepare dynamic content: generate a timestamp, add a header, rewrite the body, append query parameters. Test scripts run once the response is back and read that response to assert. A variable produced by a pre-request script is therefore available to the test script, but never the reverse. Passing a token or a unique key forward this way is how chained flows authenticate automatically after login.

The key is putting assertions inside the collection instead of eyeballing responses. Run it in bulk with Collection Runner and feed inputs through Set Data File so the same assertions apply across CSV/JSON data rows. Iterations controls repetition and Delay controls the gap between requests — workflows with dependencies need that gap, or the second request reads before the first has written. Exporting the collection then gives you both documentation and a shared assertion suite for the team.

Use Mock Server together with Example Responses. Define each endpoint’s method, path and response shape from the contract first and save those as example responses; the mock server then serves that contract so the frontend integrates normally. Contract-first has a bonus: when the backend is finally implemented, both sides already agree on field names and types, which cuts rework. Save separate examples for success, authentication failure and validation error so the frontend also gets the error states it needs to design against.