Practical examples of examples of using Postman to test a RESTful API

Real-world examples of using Postman to test a RESTful API

Before we talk about theory, let’s walk through real examples of using Postman to test a RESTful API the way working engineers do it every day.

Imagine a simple users API with endpoints like:

• GET /users
• GET /users/:id
• POST /users
• PUT /users/:id
• DELETE /users/:id

You can adapt the same patterns to public APIs such as the data.gov ecosystem or any internal microservice.

Below are practical examples that build on each other, starting from basic smoke tests and moving into automated, data-driven testing.

Example of a basic GET request test with Postman

The first example of using Postman to test a RESTful API is the classic “Does this endpoint even respond?” check.

Scenario: You want to verify that GET /users returns a 200 OK and a JSON array.

Steps in Postman:

1. Open a new request tab and set the method to GET.
2. Enter the URL, for example: https://api.example.com/users.
3. Click Send.
4. Switch to the Tests tab and add:

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response is an array", function () {
    const jsonData = pm.response.json();
    pm.expect(Array.isArray(jsonData)).to.be.true;
});

This is one of the simplest examples of using Postman to test a RESTful API, but it already gives you regression value. Every time you run the request, you confirm the endpoint is alive and returning the expected structure.

Best examples of Postman tests for JSON schema and fields

Once the endpoint is reachable, you care about shape and content.

Scenario: You want to ensure each user in GET /users has id, name, and email, and that email looks like an email address.

Steps in Postman:

In the Tests tab, add:

pm.test("Users have required fields", function () {
    const users = pm.response.json();
    pm.expect(users.length).to.be.above(0);

    users.forEach(user => {
        pm.expect(user).to.have.property("id");
        pm.expect(user).to.have.property("name");
        pm.expect(user).to.have.property("email");
    });
});

pm.test("Email format looks valid", function () {
    const users = pm.response.json();
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

    users.forEach(user => {
        pm.expect(emailRegex.test(user.email)).to.be.true;
    });
});

These are some of the best examples of low-effort, high-value tests in Postman. They catch subtle contract changes that might not break the status code but will break your frontend or mobile clients.

If you want more formal schema validation, Postman’s test sandbox supports JSON schema checks using libraries like tv4 or ajv, which align well with how many teams document APIs using OpenAPI/Swagger (see the OpenAPI Initiative for standards).

Examples of testing POST requests and validating side effects

Reading data is only half the story. You also need examples of using Postman to test a RESTful API when you create or modify data.

Scenario: You want to test POST /users to ensure:

• It returns 201 Created.
• The response body contains the new user.
• The user can be retrieved afterward with GET /users/:id.

Steps in Postman:

Create a POST request to https://api.example.com/users with a JSON body:

{
  "name": "Ada Lovelace",
  "email": "ada@example.com"
}

In Tests:

pm.test("Status code is 201", function () {
    pm.response.to.have.status(201);
});

pm.test("Response contains new user with id", function () {
    const user = pm.response.json();
    pm.expect(user).to.have.property("id");
    pm.expect(user.name).to.eql("Ada Lovelace");
    pm.environment.set("createdUserId", user.id);
});

Then create a second request, GET /users/{{createdUserId}}, and in Tests:

pm.test("Created user can be retrieved", function () {
    const user = pm.response.json();
    pm.expect(user.name).to.eql("Ada Lovelace");
});

Here you see another example of chaining requests: the POST test saves the id into an environment variable, and the GET test uses it. This pattern shows up in many examples of real API test collections used in CI pipelines.

Examples include auth testing: API keys, Bearer tokens, and OAuth

In 2024–2025, almost every serious API is protected. So any realistic examples of using Postman to test a RESTful API must cover authentication.

Example of API key testing

Scenario: You’re testing a public data API that uses an API key in a header, like many endpoints on api.data.gov.

In Postman:

• Create an environment variable API_KEY.
• Under Headers, set x-api-key to {{API_KEY}}.

In Tests, ensure unauthenticated requests fail and authenticated ones pass:

pm.test("Unauthorized without key", function () {
    if (!pm.environment.get("API_KEY")) {
        pm.response.to.have.status(401);
    }
});

Then clone the request, set a valid key, and assert 200 or 403 depending on your access level.

Example of Bearer token testing

For modern microservices, Bearer tokens (JWTs) are everywhere.

Scenario: You hit POST /auth/login with credentials, get a token, and use it in subsequent requests.

In the login request Tests:

pm.test("Login returns token", function () {
    const data = pm.response.json();
    pm.expect(data).to.have.property("access_token");
    pm.environment.set("ACCESS_TOKEN", data.access_token);
});

Then in other requests, set an Authorization header:

Authorization: Bearer {{ACCESS_TOKEN}}

These are realistic examples of security-focused tests that teams run before every deployment to avoid accidentally exposing or breaking protected endpoints.

Examples of negative testing and error handling in Postman

Good API tests don’t just prove the happy path; they also prove the API fails in predictable ways. Some of the best examples of using Postman to test a RESTful API are negative tests.

Scenario: You want to verify that invalid input to POST /users returns a 400 Bad Request with a clear error message.

Request body:

{
  "name": "",
  "email": "not-an-email"
}

In Tests:

pm.test("Returns 400 on invalid input", function () {
    pm.response.to.have.status(400);
});

pm.test("Validation error structure is correct", function () {
    const body = pm.response.json();
    pm.expect(body).to.have.property("errors");
    pm.expect(body.errors).to.be.an("array");
});

Other negative examples include:

• Requesting GET /users/999999 and asserting 404.
• Hitting a protected route without a token and asserting 401.
• Sending an unsupported HTTP method and asserting 405.

These examples of negative testing make your suite behave more like a QA engineer who actively tries to break the system.

Data-driven examples of using Postman to test a RESTful API

When you want coverage across many inputs, Postman’s Collection Runner and CSV/JSON data files shine.

Scenario: You want to test POST /users with multiple valid and invalid payloads.

1. Create a collection with a single POST /users request.
2. In the request body, use variables:

{
  "name": "{{name}}",
  "email": "{{email}}"
}

3. Prepare a CSV file:

name,email
Ada Lovelace,ada@example.com
Alan Turing,alan@example.com
Empty Name,
Invalid Email,not-an-email

4. Use the Collection Runner, select the CSV file, and run.

In Tests you can branch logic based on the data row:

const name = pm.iterationData.get("name");
const email = pm.iterationData.get("email");

if (!name || !email || !email.includes("@")) {
    pm.test("Invalid data returns 400", function () {
        pm.response.to.have.status(400);
    });
} else {
    pm.test("Valid data returns 201", function () {
        pm.response.to.have.status(201);
    });
}

This is a strong example of scaling your tests without duplicating requests. It’s common in teams that treat Postman collections as a lightweight alternative to full-blown test frameworks.

Examples include performance and latency checks

Postman is not a load-testing tool, but you can still catch obvious performance issues.

Scenario: You want to ensure GET /users responds in under 500 ms in normal conditions.

In Tests:

pm.test("Response time is acceptable", function () {
    pm.expect(pm.response.responseTime).to.be.below(500);
});

You can run this in a collection and watch for trends over time. If you’re dealing with APIs that support critical services (think healthcare or public data), combining these Postman checks with more formal monitoring or research-based thresholds from sources like the National Library of Medicine or Harvard University can help you define realistic performance expectations.

Example of integrating Postman tests into CI/CD

In 2024–2025, the most valuable examples of using Postman to test a RESTful API are the ones that run without anyone opening the Postman UI.

Scenario: You export a collection and run it in your CI pipeline using Newman (Postman’s CLI runner).

1. Export your Postman collection and environment.
2. Install Newman in your project:

npm install --save-dev newman

3. Add a script to package.json:

"scripts": {
  "test:api": "newman run postman_collection.json -e postman_environment.json"
}

4. In your CI config (GitHub Actions, GitLab CI, Jenkins, etc.), call npm run test:api.

Now all the examples you built earlier — status checks, schema tests, negative tests, performance checks — run on every commit. This is how many teams guard APIs that power sensitive domains, including health and research systems that must stay reliable for organizations like NIH or academic institutions.

Advanced examples of scripting and dynamic behavior in Postman

Once you’re comfortable with the basics, you can use Postman’s scripting to handle more dynamic scenarios.

Example: Randomized test data

To avoid collisions in POST /users, you can generate unique emails:

const random = Math.floor(Math.random() * 100000);
const email = `user_${random}@example.com`;

pm.environment.set("randomEmail", email);

Then reference {{randomEmail}} in your request body. This is one of those small but powerful examples of using Postman to test a RESTful API that behaves more like the real world, where data is rarely static.

Example: Conditional test logic based on environment

You might want stricter performance thresholds in production than in a staging environment.

const env = pm.environment.get("ENV") || "dev";
const limit = env === "prod" ? 300 : 800;

pm.test(`Response time under \({limit} ms for }\(env}`, function () {
    pm.expect(pm.response.responseTime).to.be.below(limit);
});

These advanced patterns turn your collection into a living test suite that adapts to where it’s running.

FAQ: examples of common Postman testing questions

What are some simple examples of using Postman to test a RESTful API?

Simple examples include:

• Sending a GET request and asserting 200 OK.
• Verifying the response is JSON and contains expected fields.
• Testing POST requests with a basic body and checking for 201 Created.

These are often the first examples of tests you’ll add when you start working with a new API.

Can you give an example of chaining multiple Postman requests?

Yes. A classic example of chaining is:

• Call POST /auth/login to get a token.
• Save the token in an environment variable.
• Use that token in the Authorization header for GET /users/me.

Each request builds on the last, which mirrors real client behavior.

What are examples of negative tests I should always include?

Common negative examples include:

• Invalid IDs returning 404.
• Missing or invalid auth tokens returning 401 or 403.
• Malformed JSON or missing required fields returning 400.

These tests keep your error handling honest.

Is Postman enough for API testing in 2024 and 2025?

For many teams, yes — especially when combined with Newman in CI. Postman covers a wide range of functional and regression scenarios. For heavy load testing or deep security analysis, you’ll usually pair it with specialized tools, but the examples of using Postman to test a RESTful API in this guide are more than enough to build a strong baseline.

If you take nothing else from this article, remember this: the best examples of using Postman to test a RESTful API are the ones you actually run on every change. Start with a few targeted tests, wire them into CI, and grow the collection as your API evolves. That’s how Postman stops being a one-off debugging tool and becomes part of your real testing strategy.