Gayan Abeyratne

Steps to start with POSTMAN 1. Install POSTMAN on Windows To install Postman, go to the apps page and click Download for macOS / Windows / Linux depending on your platform. • Download the setup file • Run the installer 2. Open the POSTMAN tool. 3. Create a collection • Close the pop-up window • Move to the Collections tab • Click on + icon to create New collection • Enter a name • Click create button 4. HTTP Methods GET - GET requests use to retrieve resource representation/information only – and not to modify it in any way. As GET requests do not change the state of the resource, these are said to be safe methods. Additionally, GET APIs should be idempotent, which means that making multiple identical requests must produce the same result every time until another API (POST or PUT) has changed the state of the resource on the server. POST - POST requests use to create new subordinate resources, e.g. a file is subordinate to a directory containing it or a row is subordinate to a database table. Talking strictly in terms of REST, POST methods are used to create a new resource into the collection of resources. PUT - PUT requests use primarily to update existing resource. If the resource does not exist, then API may decide to create a new resource or not. DELETE - DELETE requests use to delete resources which are identified by the Request-URI. PATCH - PATCH requests are to make partial update on a resource. If you see PUT requests also modify a resource entity so to make more clear – PATCH method is the correct choice for partially updating an existing resource and PUT should only be used if you’re replacing a resource in its entirety. 5. Create GET Request • Click on the dots in the right corner of the TEST collection • Click Add Request • Enter a Request name • Click Save • Request will create under the collection • Select HTTP method as GET • Enter below URL https://reqres.in/api/users?page=2 • Click Send • Response display under Body tab • Status display as 200 for Success request • Time which have taken for give the response display in milliseconds • Click Save to save the request • Other types of Status Codes and meanings 200 (OK) - A 200 code is the most common and represents a successful response. 400 (Bad Request) - 400 level mean there was a client-side error — Errors can be like the user typing the wrong URL in the address bar. 401 (Unauthorized) - A 401 error response indicates that the client tried to operate on a protected resource without providing the proper authorization. It may have provided the wrong credentials or none at all. 403 (Forbidden) - 403 status code simply means access to the resource is forbidden. That means the client’s request is formed correctly, but the REST API refuses to honor it i.e. the user does not have the necessary permissions for the resource. 404 (Not Found) - The 404-status code means the requested resource is no longer available or, more specifically, just not found. 405 (Method Not Allowed) - The API responds with a 405 error to indicate that the client tried to use an HTTP method that the resource does not allow. 500 (Internal Server Error) - 500 is the generic REST API error response. Most web frameworks automatically respond with this response status code whenever they execute some request handler code that raises an exception. 6. Create POST Request • You can get sample requests from https://reqres.in/ • Add new request and select HTTP method as POST • Enter below URL https://reqres.in/api/users • Move to Body tab and click raw (Note: Body tab not applicable for GET requests) • Copy and paste the following request body { "name": "morpheus", "job": "leader" } • Click on Text dropdown and select JSON (application/json) (Note: Use to convert the request from text format to JSON format and it is automatically added as Header in Headers tab) • Click Send Note: If you are getting an error like “Could not get any response” then the issue might be Self-signed SSL certificates are being blocked hence fix this by turning off 'SSL certificate verification' in Settings > General following below steps; Click below setting icon at the top of the right side and click Settings Turn off the 'SSL certificate verification' in General tab • Click again Send button • This API use to create a user and response display with id and created date { "name": "morpheus", "job": "leader", "id": "974", "createdAt": "-T06:05:18.531Z" } 7. Create PUT Request • Add new request and select HTTP method as PUT • Enter below URL https://reqres.in/api/users/2 • Move to Body tab • Copy and paste the following request body { "name": "morpheus", "job": "zion resident" } • Click on Text dropdown and select JSON (application/json) • Click Send • This API use to update job of the user and response display with the updated job and date { "name": "morpheus", "job": "zion resident", "updatedAt": "-T06:22:06.382Z" } 8. Basic Authentications • What is Authorization? The meaning of authorization can be seen as a question which is, are we eligible to access a secured resource on the Server? If the answer is yes, then in technical terms we can say that we are Authorized to access the resource. If the answer is No, we can say that we are not Authorized to access the resource. For example, let us say you have added yours and your sister’s fingerprint in your phone. You and your sister can open the same mobile phone, which means only you and your sister are authorized to open the phone and see the data. Similarly, while there could be many APIs in a company or a project. It is not necessary that everyone have access on all the APIs. Only authorized people can access the secured APIs. Note: Please follow below link for more about Authorizations, https://learning.getpostman.com/docs/postman/sending_api_requests/authorization/ • What is Authentication? Authentication is a process of presenting your credentials to the system and the system validating your credentials. These credentials tell the system about who you are. Which enables the system to ensure and confirms a user’s identity. Here system can be anything, it can be a computer, phone, bank or any physical office premises. • Authorization Vs Authentication Authorization is a process of allowing or denying someone from accessing something, once Authentication is done. So, in layman terms Authentication tells who you are while Authorization tells what you can do. Eg: When a person accesses the server with the key/password, the server checks whether the person is available in directory and is also associated with the same key/password. If it is, you are good to go (Authentication). If you have access to the resource, then you will be granted access to the resource (Authorized). • Checking Authorization Create a GET request and enter the endpoint as https://postman-echo.com/basic-auth Press send and look at the response Note: The status code is 401 which corresponds to unauthorized access and the response message says Unauthorized. The status code and response from the server indicates that we are not authorized to access the API we are trying to access. • Checking authorization using credentials Enter the endpoint https://postman-echo.com/basic-auth in GET request. Go to Headers Enter the following key value pairs in Header Authorization: Basic postman:password Note: We are using username as postman and password as password Press Send and see the response box and status code. • What is Token based authentication? Token based authentication allow client application to access the restricted resources of a server-side application. Token based authentication uses a bearer token between client and server to access the resources. And to get the token, client application first sends a request to Authentication server endpoint with appropriate credential. If the username and password is found correct, then the Authentication server send a token to client as a response and the client application then use the token to access the restricted resources in next requests. ASP.Net Web API uses OWIN OAuth middleware for Authentication server operations. The following diagram shows the Authentication Server representation for Web API. Send a POST request to the server for the bearer token using the newly created user's username and password as a parameter. A new parameter grant_type is added with the request with value 'password'. The screenshot is shown below. The final request is a GET request to get weather info as a JSON string. This request contains a header parameter named Authorization and its value is the bearer token. The following screen shows details. 9. Manage Environments An environment is a set of key-value pairs. The key represents the name of the variable. While working with APIs, you often need different setups for your local machine, the development server, the testing server or the production API. Environments let you customize requests using variables, so you can easily switch between different setups without changing your requests. Set up an environment • Click below icon at the top of the right corner • Click Add button under Environment • We are going to set up environment using below URL https://reqres.in/api/users/2 • Add the variables and values as listed in below • Create a new request with GET method • Set up the URL as {{getsingleuser}}/2 • Click Send • id=2 user’s details display as response. 10. Manage Global Global variables provide a set of variables that are available in all scopes. You can have multiple environments, but only one environment can be active at a time with one set of global variables. Set up Global variables: • Click the gear icon • Click the Global button at the bottom • We are going to set up global variables for POST API request which explained in 6 Request body: { "name": "morpheus", "job": "leader" } • Add variables as follows • Click Save • Update the request body with global variables { "name": "{{name}}", "job": "{{job}}" } • Click Send 11. Scripts in Postman Postman contains a powerful runtime based on Node.js that allows you to add dynamic behavior to requests and collections. This allows you to write test suites, build requests that can contain dynamic parameters, pass data between requests, and a lot more. You can add JavaScript code to execute during 2 events in the flow: 1. Before a request is sent to the server, as a pre-request script under the Pre-request Script tab. 2. After a response is received, as a test script under the Tests tab. Execution order of scripts 12. Pre-request scripts Pre-request scripts are snippets of code associated with a collection request that are executed before the request is sent. This is perfect for use-cases like including the timestamp in the request headers or sending a random alphanumeric string in the URL parameters. • We are going to write pre-request scripts for POST API request which explained in 6. • Move to Pre-request scripts and parse values for the request using following code postman.setEnvironmentVariable("name", "morpheus"); postman.setEnvironmentVariable("job", "leader"); • Update the request body as follows { "name": "{{name}}", "job": "{{job}}" } • Send the request Request read the values from pre-request scripts 13. Test scripts and Assertions Test scripts are written in JavaScript and run after a request is sent and a response has been received from the server. You can use the code snippets to build the scripts. Assertions in programming language is a statement written such that it verifies whether the given predicate is true or false. A predicate is an expression which gives only Boolean expression as the output viz. true or false. It is hard to write assertions or functional methods in JavaScript therefore we will learn how to write assertions using an external JavaScript library called Chai – Assertion Library. Assertions in Postman are based on the capabilities of this Chai Assertion Library. The assertions that writing with this assertion library takes lot less effort compared to write directly in JavaScript. • Chai Assertion Library Chai assertion Library is included by Postman by default in its application, so when you are writing chai assertions you don’t have to worry about any other installation processes. The most amazing fact about assertions in Postman is that they write human readable tests. Tests written in assertions are so human readable that you might find it as an English sentence. All this makes your tests easier to read and more friendly for humans. Although we are not needed to write very complex chai assertions as that are not required but we will cover the most common and frequently required assertions in Postman which will make your way complete while using this software. • pm.test() Postman has a newer PM API (known as the pm.*API) which is the more powerful way to write tests. The pm.test() function is used to write test specifications inside the Postman test sandbox. Writing tests inside this function allows you to name the test accurately and ensures that the rest of the script is not blocked in case of any errors. Some things to know about the pm.test() function: a. The function accepts 2 parameters, the name of the test (as a string) and a function to return a Boolean value. b. It can be used only in the Tests tab, after the primary Postman request has been sent. • Move to Tests tab • Click on the snippets which validating the Status Code pm.test("Status code is 200", function () { pm.response.to.have.status(200); }); • Send the request • Move to Test Results tab – Status display as PASS • Run the same code with incorrect status code pm.test("Status code is 200", function () { pm.response.to.have.status(201); }); • Move to Test Results tab – Status display as FAIL • pm.expect() The pm.expect() assertion function was built on the shoulders of the popular JavaScript test library ChaiJS BDD. Using a similar syntax, pm.expect() makes it easy to write readable tests, and you can deal with assertions of data from a response or variables. Eg: Write the following code inside Tests tab, press Send and see the response. pm.test(“Response time is less than 100ms”, function () { pm.expect(pm.response.responseTime).to.be.below(100); }); NOTE: This assertion can also be modified to check the time to be above a certain value (to.be.above(value)) and equal to a certain value (to.be.equal(value)). • pm.response.to.be. * The pm.resonse.to.be object provides shorthand for frequently used response-based checks. Using this family of assertions streamlines tests for response status types and body variations. Eg: Write the following code inside Tests tab, press Send and see the response. pm.test("Status is OK", function () { pm.response.to.be.ok; }); • Assert on Response Status Code Meaning This assertion is based on checking a specific property. In this assertion we will check a specific property and its value. In the example given below we are checking the property status and its value being OK. Eg: Write the following code inside Tests tab, press Send and see the response. pm.test(“Status is OK”, function(){ pm.response.to.have.property(‘status’, ‘OK’); }); • Assert on Response Type This assertion is based on verifying the Response Type. In the below test, we are verifying that if the Response Type is JSON. Eg: Write the following code inside Tests tab, press Send and see the response. pm.test(“Response if Json”, function(){ pm.response.to.be.json; }); • Assert on Response Header This assertion is based on checking whether the header has content-type or not. Eg: Write the following code inside Tests tab, press Send and see the response. pm.test(“Content-Type is present”, function () { pm.response.to.have.header(“Content-Type”); }); 14. Postman Console The Postman Console is analogous to a browser’s developer console, except that it’s tuned for API development. If an API or API test is not behaving as you expect, this would be the place where you will go to deep dive while debugging. As long as the console window is open, all your API activities will be logged here to see what’s going on under the hood. • Click the View tab at the top • Click Show Postman Console • Run the API and check console – All your API activities will be logged here 15. Pass values to the GET API request using CSV file • Add a folder under the collection Click on the dots in the right corner of the collection • Give a folder name and Create • Add new request inside the folder • Select HTTP method as GET • Username and password send as URL parameters in this GET request • Add URL as below https://postman-echo.com/get?username={{username}}&password={{password}} • Above keys and values automatically added to the Params field • Create a CSV file for send values to the username and password parameters • CSV file format: username,password a85 ,63sgsg4 sobtiankit,sdgw456 • Check whether CSV file values contain in the API response using test scripts since the username and password included in the response body as output parameters • Use following codes as test scripts: tests["Body contains username " + data.username] = responseBody.has(data.username); tests["Body contains password " + data.password] = responseBody.has(data.password); • Collection Runner Collections are groups of requests that can be run together as a series of requests, against a corresponding environment. Running a collection is useful when you want to automate API testing. When you run a collection, you send all requests in your collection one after another. When you use scripts, you can build integration test suites, pass data between API requests, and build workflows that mirror your actual use case of APIs. • Move to the Collection and click below icon • Select the folder which needs to run • Click Run • Collection Runner • We are going to read two rows in CSV file therefore keep Iteration as 2 • Click Select File Button • Select the CSV file and Open • Click the drop down and select the Data File Type as text/csv • Click Preview to check that data have uploaded correctly • Tick on Keep variable values checkbox • Run the Collection • Click on underlined request name to see the Request URL and Response Body • Expand the Request URL and Response Body to check whether values passed correctly to the request from CSV file and get response correctly Iteration 1 read the values from raw 1 Iteration 2 read the values from raw 2 • Test scripts are running as below and validate the API 16. Pass values to the POST API request using JSON file • Add a new folder under the collection • Add new POST request inside the folder • Add URL as below https://reqres.in/api/users • Add the request body as follows { "name": "{{name}}", "job": "{{job}}" } • Create a JSON file for send values to the name and job parameters • JSON file format: [ { "name":"morpheus", "job":"leader" }, { "name":"Hendri", "job":"manager" } ] • Check whether JSON file values contain in the API response using test scripts since the name and job included in the response body as output parameters • Use following codes as test scripts: tests["Body contains name " + data.name] = responseBody.has(data.name); tests["Body contains job " + data.job] = responseBody.has(data.job); • Run the collection • Collection Runner • We are going to read two rows in JSON file therefore keep Iteration as 2 • Click Select File Button • Select the JSON file and Open • Click the drop down and select the Data File Type as application/json • Click Preview to check that data have uploaded correctly • Tick on Keep variable values checkbox • Run the Collection • Click on underlined request name to see the Request Body and Response Body • Expand the Request Body and Response Body to check whether values passed correctly to the request from JSON file and get response correctly Iteration 1 Iteration 2 • Test scripts are running as below and validate the API 17. Postman Monitors Rest APIs forms the backbone of modern-day distributed applications. It is very important that your API’s responses and performance remain up to the mark throughout the day. Monitors can help you schedule a Collection of test runs to monitor the Performance and Response of your APIs. Monitors can be scheduled to run very frequently, like every 5 minutes, or can be scheduled to run at an interval of few hours throughout the day. Follow below steps to Monitor Collections in Postman. • Create a collection called Monitoring • Enter your api requests in it • Open the menu by clicking the arrow button • Take a look at the Monitor tab • If you have not signed in to postman, you should sign now otherwise you won’t be able to use Postman Monitor. • Once you have signed in to Postman, we can create a Monitor to run our Collection. • Click on Add Monitor Note: This option only opens after signing in • You will see a popup as shown in the below image.  • This contains few options to enter such as; a. Monitor Name: Monitor name is quite straightforward. It is the name for your monitor. You can name it anything as we here named it Monitoring Collection. You can apply many monitors to the same collection, so it would be better if you apply meaningful names to know later what you were monitoring. b. Environment: Environment field allows you to select the environment you want your tests to run. If you had earlier created an environment in Postman, then you will find here in the drop down. Just select the one you want. If your scripts are hard coded with environment URLs then you may select No Environment option. Postman monitoring does not allow using Global Environments. If you are using any then you might have to write it again in the local environment. c. Schedule: Schedule option is used for scheduling the intervals at which the monitor will run. Since monitors run in specific intervals, you have to set the value accordingly. The options are quite straightforward. You can set minute timer for minute intervals, hourly timers for hourly intervals and similarly there is weekly timer. d. Regions: Region option is available in monitors to synchronize the timings according to the region. There are several options available for matching the time. We will be using the US (East) region (which is also the default region) just for simplicity. You should use the region according to your physical location for better testing and monitoring. • Press Monitor this collection • The monitor will be visible to your monitor console once you press the button in the previous step. • Once you click the monitor, a new window will open in your browser which will redirect you to your account in Postman. A new console can be seen which looks like the following image. • Now you can sit back and relax and let Postman do its work. You have successfully applied a monitor to one of your collection. Postman will run it according to the schedule you set. • Analyzing Monitor Results: • After some time, the monitor console will look something like this. • This is an API performance report. The green bars you see depicts that the tests have passed for the request. If you have a failed test the bar will turn into red. The tests need to have assertions in them so that we can catch any issues in the API.  • Monitors page can be viewed again by simply login in to postman in your web browser.  • You will see the Postman dashboard after logging in as shown in the image below. Click on the Monitors. • You will see all the monitors in the next window. Here we have only one, so we see that one only. • Click on the monitors and the same bars will appear again. You can choose any bar that shows anything wrong to you to have a look at it. For example, let say we choose the bar corresponding to 12:55 AM • As soon as we click on the bar, the corresponding data appears just below it. • You can look at the data and see different requests, tests, and even error. This is similar to the collection runner console and has similar features. There is also another feature in the response data shown above. If you are more into debugging and looking for particular errors, you can look at the console log also. • Click on the console log • This will show you the console where it has logged the errors and all the logs that were processed. This helps developers and debuggers to know what went wrong. Remember to delete the monitor when you done experimenting with it. With these features monitors is a better way to develop and test but it also comes with some disadvantages. • Disadvantages of Monitors: Since monitors comes with little disadvantages along with its features, it totally depends on you whether it is a problem for you or not. a. Cannot be used in Postman network: Postman monitors do not work if the postman servers are in the same network as you are. Being in the same network there is a problem that since your network is working you will never be able to diagnose “how will your collection behave in another network “, therefore postman monitors are not allowed when located in the same network. But since this is a possible scenario Postman has a solution to that. If you are in the same network as Postman’s, then you need to buy the pro version of Postman. Once you have done that, postman will provide you with another IP through which monitors can be run. b. Cannot import global variables As discussed earlier while setting the monitor, global variables cannot be imported into the monitors. Once you are initializing the monitor, it needs only local variables if you are using any. If in case you have global variables, you need to copy them as local variables in a new environment.  c. Monitor’s API call limits You can initialize and run Postman monitor with your collection, but monitor is designed to be a pro only feature in Postman. Free service is to make you familiar with monitors. If you are using the free service like we did in this tutorial, you will get only 1000 API calls per month and that includes every monitor’s combined. You can anytime buy the Postman pro feature to enjoy unlimited API calls through monitors, but this disadvantage is only a disadvantage according to you. If you are able to manage your tasks and work within the free version limit, it is well and good. 18. Workflows in Postman A workflow is a sequence of things in order to achieve a particular task. A workflow is a set of well-defined steps that you have to take to complete a task. In postman workflow is the flow of requests in a defined sequence. The above problem we discussed has a predefined pattern that is running the requests sequentially. Till now we have seen how to run tests on a request and how to run many requests with many tests simultaneously in Collection runner. A collection runner is a very important feature in Postman and without it, it becomes very hard for a person to execute more than one request and perform different tests on them at once. • Execution order of Collection Runner As we discussed above, collection runner runs the requests in a particular order. If you noticed earlier, it is a sequential order run. We need a sequential run to test end to end API flow to check whether everything is correct or not. End to end testing is done to check the flow of an application from start to finish, just as it is designed to work.  Most of the user journeys are not simple one or two API calls. Usually a user has to go through a set of actions, in turn set of API calls, to complete the user journey. Taking an example of an ecommerce website, there will be a good number of steps that you have to take in order to purchase an item. A generic flow can be outlined as: ◦ Logging into the website ◦ Searching a product ◦ Adding the product to cart ◦ Checking out ◦ Adding personal details such as address ◦ Payment This is where collection runners come into picture. We can define sequence of steps (API calls) in the collection runner. Collection runner will run the calls in a sequential order thereby completing the user journey as it is defined in the business requirements. • Default workflow in Postman The following short example will highlight the way Postman runs requests a. Make a new collection named No Workflow b. Enter any three requests in it  c. Run through Collection Runner and see the output. It starts with the first request and then continues to second and then to third. It is running sequentially. But what if after some time there is no need for second request? Let us say you have a collection with thirty meaningful requests. After some days, we found that request no. 16 needs to be run after request no. 19 otherwise we won’t get correct results. Now, this creates a problem. You cannot move the requests up and down because there is a chance some other request might move in the process. Moving requests up and down becomes a time-consuming process. • How to change the workflow in Postman. In postman it is very easy for you to arrange the running of request according to your needs. When you create multiple requests, the default workflow is sequential i.e. all the requests will run as you created them (considering you did not move any). Workflow can be changed easily in Postman. For this follow the following steps. a. Make a new Collection named With Workflow b. Enter all the three requests in it that we mentioned above and in the same order as we mentioned. NOTE: Instead of doing all the work again, try to Duplicate the collection No Workflow and Rename it to With Workflow c. Go to Google API request and enter the following in the tests tab postman.setNextRequest(“Customer API”) This is a self-descriptive statement I believe. You are telling Postman to set next request. In the braces, you need to always write the name of the request. NOTE: Name of the request should be exactly same as you have written while naming the request. They are case sensitive. d. Click on Runner and run the request Notice the order in which requests are run now. This has changed the workflow of the collection and hence now we can run the collection in an order that we want. Observe that one request has not run this time which is weather API. This has happened because in Google API we mentioned about the next request but what to run after customer API? We did not mention it, so Postman tries to run it sequentially as without workflow but since customer API is our last request, it stops there. Workflows are of significant and powerful feature in Postman. It is a very appreciated feature among engineers who use Postman. While using it inside Postman, you will find it very handy when there is a need for change in the request. However, we need to take care while setting the next request in the tests tab. Sometimes, it may happen that you are stuck in infinite loop. To show this let us create a new Workflow, as mentioned in the next section • Infinite loops in Workflow To learn about how sometimes we can get in an infinite loop just because of a simple mistake, we will take three search requests on google namely ToolsQA, Postman and Calculator which will search ToolsQA, Postman, Calculator respectively.  Note: Use any three api requests which we have created in previous steps a. Create a new Collection called Infinite Workflow and save the following three API requests in the collection we just created ◦ https://www.google.co.in/search?q=toolsqa and name it as ToolsQA ◦ https://www.google.co.in/search?q=postman and name it as Postman ◦ https://www.google.co.in/search?q=calculator and name it as Calculator b. Go to ToolsQA request and set the next request as Calculator c. Go to Calculator and set the next request as Postman   d. Go to Postman and set the next request as ToolsQA e. Run the collection Infinite Workflow in the collection runner and see the Runner It is now running in an infinite loop. Go on and observe the tests tab of each request and see where we set the loop to run infinitely. Although if you are stuck here, then definitely something is wrong with your workflow. There is no point in looking at the runner as it will run forever and ultimately hangs. It is always better to stop the runner to save memory and other resources such as server load. The runner can be stop by just clicking the stop button • Placement of setNextRequest You might be wondering what if there is a lot of test code? Where should you put the setNextRequest to run it successfully? Placement of setNextRequest is not important while writing it in tests. You can write it anywhere you like, and it will still run. It is just a method of saying to the Postman that once you are done with all the test and other stuff, when you are leaving this request you have to run this request. It doesn’t matter where you put it since it acts just like a command. 19. Reference: https://learning.getpostman.com/docs/postman/scripts/test_examples/ https://reqres.in https://postman-quick-reference-guide.readthedocs.io/en/latest/assertions.html https://learning.getpostman.com/docs/postman/scripts/postman_sandbox_api_reference/ https://www.toolsqa.com/postman/different-types-of-asserts-in-postman/ https://www.chaijs.com/ https://www.toolsqa.com/postman/monitor-collections-in-postman/ https://www.toolsqa.com/postman/workflows-in-postman/