Postman Tutorial for Beginners: API Testing Step by Step

Postman is the tool most testers open first when a developer says “the API is ready”. It lets you send any request in seconds, save it, share it with the team and later turn it into automated tests. In this Postman tutorial you’ll go from installation to a complete, reusable collection for a real API, with environments, variables, authentication and request chaining, using the free SQA Tools practice API at every step.

Why Testers Use Postman

• No code needed to start: fill in method, URL and body, click Send.
• Organised: collections and folders mirror the API structure; everyone uses the same requests.
• Reusable: variables and environments mean one collection works on dev, QA and staging.
• Testable: JavaScript test scripts turn requests into automated checks.
• Shareable: export collections as JSON, share workspaces, generate documentation.
• CI-ready: Newman runs collections from the command line in Jenkins or GitHub Actions.

Install Postman and Understand the Interface

1. Download the desktop app from postman.com (Windows, macOS, Linux) or use the web version. A free account syncs your work.
2. Create a workspace (personal or team) for your project.

Send Your First Request

1. Click New → HTTP (or the + tab).
2. Method: GET. URL: https://sqatools.in/wp-json/sqa-api/v1/users
3. Click Send. Check status 200 OK, time and size in the response panel.
4. Open the Headers tab of the response: find X-Total-Count: 12 and the Link header.

Here’s the same request in your browser to compare:

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users?role=admin"

Query parameters with the Params tab

Instead of typing ?role=admin&sort=age, add rows in Params: key role value admin, key sort value age. Postman builds and encodes the URL. Untick a row to disable it temporarily: handy for negative tests.

POST with a JSON Body

1. New request, method POST, URL https://sqatools.in/wp-json/sqa-api/v1/objects
2. Body → raw → JSON, then paste:

   {
     "name": "Postman test object",
     "data": { "color": "blue", "qty": 3 },
     "ttl": 300
   }

3. Send. Expect 201 Created. Postman added Content-Type: application/json automatically (see the hidden headers in the Headers tab).
4. Copy the id from the response; you’ll use it next with PUT, PATCH and DELETE.

Collections: Organise Your Requests

A collection is a folder of saved requests, with shared variables, auth and scripts.

1. Click Collections → + and name it “SQA Practice API”.
2. Add folders: Users, Products, Objects CRUD, Auth, Negative tests.
3. Save each request (Ctrl/Cmd + S) into a folder with a clear name, e.g. “POST create object – 201”.

Shortcut: the API Testing Practice page has a Postman collection button that downloads a ready-made collection for this API. In Postman click Import and drop the file in.

Variables and Environments

Hardcoding https://sqatools.in/wp-json/sqa-api/v1 into 50 requests is painful when the team moves to a staging server. Use variables.

Create an environment

1. Environments → +, name it “SQA Practice”.
2. Add variable baseUrl = https://sqatools.in/wp-json/sqa-api/v1.
3. Add username = admin and password = admin@123; set the password type to secret.
4. Select the environment in the top-right dropdown.
5. Change your request URLs to {{baseUrl}}/users, {{baseUrl}}/objects…

Variable scopes (narrowest wins)

If the same name exists in several scopes, the narrower one (local, then data, then environment, then collection, then global) wins.

Authorization Tab

Set auth once at the collection level and let requests Inherit auth from parent.

Postman shows the header it generates (e.g. Authorization: Basic c3FhX3VzZXI6c3FhQDEyMw==) under the Headers tab’s hidden headers.

Request Chaining: Use Data from One Response in the Next

Real flows need values from earlier responses: a token from login, an id from create. In the Scripts → Post-response tab of the login request:

const body = pm.response.json();
pm.environment.set('access_token', body.access_token);

And in “POST create object”:

pm.collectionVariables.set('objectId', pm.response.json().id);

Then GET {{baseUrl}}/objects/{{objectId}}, PATCH {{baseUrl}}/objects/{{objectId}} and DELETE {{baseUrl}}/objects/{{objectId}} just work, in order. Run the folder with the Collection Runner and you have an end-to-end CRUD flow.

Dynamic variables

Postman has built-in random data: {{$randomFirstName}}, {{$randomEmail}}, {{$randomInt}}, {{$guid}}, {{$timestamp}}. Use them so every run creates unique data:

{ "name": "{{$randomProductName}}", "data": { "ref": "{{$guid}}" }, "ttl": 120 }

A Quick Look at Tests (Assertions)

Add checks in Scripts → Post-response:

pm.test('status is 201', () => pm.response.to.have.status(201));
pm.test('has Location header', () => pm.response.to.have.header('Location'));
pm.test('name echoed back', () => {
  pm.expect(pm.response.json().name).to.eql('Postman test object');
});

Results appear in the Test Results tab. Writing powerful scripts, schema validation, data-driven runs and Newman are covered in the next lesson: Postman Tests, Scripts and Newman.

Useful Postman Features Testers Forget

• Console (View → Show Postman Console): the exact request sent, after variables were resolved. Check here first when something “doesn’t work”.
• Code snippet (</> icon): converts a request into cURL, Python, JavaScript and more. Paste cURL into bug reports.
• Import cURL: paste a developer’s cURL command into Import to get a ready request.
• Import OpenAPI: generates a whole collection from a Swagger file.
• Settings per request: disable “Automatically follow redirects” to test 3xx codes; set request timeout.
• Mock servers: fake an API from saved examples so front-end and tests can start early.
• Postbot (AI assistant): generates test scripts and documentation from responses. Review what it writes.

Postman Practice Exercises

1. Build a collection with folders Users, Products, Objects, Auth using {{baseUrl}}.
2. GET page 2 of users with 5 per page; confirm ids 6 to 10.
3. Filter products by category=books; then try category=toys (expect 400).
4. Create an object, save its id with a script, then PATCH, GET and DELETE it in a chained run.
5. Call /basic/profile, /apikey/profile and /auth/me with each auth type; then each with wrong credentials.
6. Turn off “follow redirects” and GET /redirect: confirm 302 and the Location header.
7. Create a second environment “SQA Practice – broken” with a wrong baseUrl and see how errors look.

Interview Questions: Postman