REST API Testing with Postman & Newman: Comprehensive Best Practices

1. Fundamentals of RESTful API Verification

A REST API request consists of four core elements: HTTP Method (GET, POST, PUT, DELETE, PATCH), Endpoint URL, Headers (Authorization, Content-Type), and Request Body (JSON/XML).

When testing REST APIs, QA engineers must validate key response criteria:

• HTTP Status Code: 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, 500 Internal Server Error.
• Response Payload: JSON structure accuracy, data types, required fields, and nested objects.
• Header Attributes: Content-Type validation, CORS headers, cache controls, and rate limits.
• Performance & Latency: Response time benchmarks (e.g., < 200ms).

2. Writing Automated Assertions in Postman

Postman allows writing JavaScript tests inside the Tests tab of requests or collections using the pm.test() and pm.expect() syntax.

// 1. Validate HTTP Status Code 200 OK
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

// 2. Validate Response Time under 500ms
pm.test("Response time is less than 500ms", function () {
    pm.expect(pm.response.responseTime).to.be.below(500);
});

// 3. Validate JSON Body Fields
pm.test("Verify user data object", function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData.success).to.eql(true);
    pm.expect(jsonData.user.email).to.include("@");
    pm.expect(jsonData.user.id).to.be.a('number');
});

3. Environment Variables & Chaining Requests

Avoid hardcoding API keys, authentication tokens, and base URLs. Postman supports Global, Environment, and Collection variables.

To chain API requests (e.g., logging in to extract a Bearer JWT token and reusing it in subsequent endpoints):

// Extract Bearer Token from Login Response
const responseData = pm.response.json();
pm.environment.set("authToken", responseData.token);