APIs are everywhere. Every time you log in with Google, check the weather on your phone, or pay for something online, an API is doing the heavy lifting. They are the connective tissue of modern software, and knowing how to test one is fast becoming a baseline technical skill, not just a developer specialty.
The problem is that most API testing resources assume you are comfortable writing code and that’s not always the case. Postman is an API platform used by more than 40 million developers and 500,000 organizations worldwide, including 98% of the Fortune 500. Its appeal is simple: it lets you send requests to APIs, inspect responses, and run tests, all through a graphical interface. No terminal. No code. No setup headaches.
This guide walks you through the full process, from installation to running your first real test.
What Is an API, and Why Does Testing It Matter?
An API (Application Programming Interface) defines how two software systems communicate. When you call an API endpoint, you send a structured HTTP request to a server, and it sends back a structured response, usually in JSON format.
Testing an API means verifying if it behaves as it should: that it returns the correct data, the right status codes, and the right errors in cases where it’s fed bad input. It’s much cheaper to catch bugs at the API layer rather than catching them in production, or in a worst case scenario, after a user has already hit them.
Step 1: Install Postman
Download the Postman desktop app for Windows, macOS, or Linux here. You can opt for the browser version, but I would recommend the desktop app for more stability.
You don’t have to go for the free account, but it is recommended. It allows you to sync your work across a number of devices and you can collaborate with your team. Once logged in, you will find yourself in the workspace view, which is where all requests, collections, and environments live.
Step 2: Understand the Interface
The Postman layout is built around a few key areas:
- The address bar: where you enter the API endpoint URL
- The method dropdown: where you select GET, POST, PUT, DELETE, or other HTTP methods
- The tabs below the URL bar: Params, Authorization, Headers, Body, and Scripts
- The response panel: where you see what the server sends back
You will spend most of your time in the address bar, the method dropdown, and the response panel. The other tabs come into play for more complex requests.
Step 3: Send Your First Request
Before testing anything real, try a public API that requires no authentication. JSONPlaceholder is a free, open REST API built for exactly this purpose.
Here is how to make your first request:
- Click the + button to open a new request tab
- Make sure the method is set to GET
- Enter this URL in the address bar: https://jsonplaceholder.typicode.com/posts/1
- Click Send
You will get a response back almost instantly. The response panel will show you:
- The status code (200 OK means success)
- The response time in milliseconds
- The response body in JSON format, with a post ID, title, and body text
That is a live API call with zero code written. If you want to explore more public APIs to practice on, The Public APIs repository on GitHub maintains a curated list of free, open APIs across dozens of categories.
Step 4: Read the Response
The response panel is where the real information lives. Here is what to look at:
Status Codes
HTTP status codes tell you whether a request succeeded or failed. According to Postman’s documentation, the most common ones are:
- 200 OK: The request worked and data was returned
- 201 Created: A resource was created successfully (typically from a POST)
- 400 Bad Request: Your request had invalid syntax or missing parameters
- 401 Unauthorized: Authentication is required or failed
- 404 Not Found: The resource you requested does not exist
- 500 Internal Server Error: Something broke on the server’s end
Response Body
The body tab shows the actual data returned. Set it to Pretty for readable, indented JSON. Raw gives you the unformatted string. Preview renders it as HTML if the response is a web page.
Response Time and Size
Postman displays both in the top right of the response panel. Hover over the time value to see a breakdown: DNS lookup, connect time, and server processing time. These numbers matter when you are checking API performance.
Step 5: Handle Authentication
Most production APIs require some form of authentication. Postman handles the three most common types cleanly, without you writing a single auth header manually. As Postman’s blog explains:
API Key
Go to the Authorization tab, select API Key from the dropdown, then enter the key name and value. Postman adds it to the request header automatically. Commonly used for services like OpenWeatherMap, News API, and similar.
Bearer Token
Select Bearer Token in the Authorization tab and paste your token. Postman adds Authorization: Bearer <your-token> to the header for you. Bearer tokens are the standard for OAuth 2.0 flows and JWT-based authentication.
Basic Authentication
Enter a username and password. Postman encodes them as Base64 and sends them in the Authorization header, which is what the server expects.
If you are testing an API that requires OAuth 2.0, Postman can handle the full token exchange under the Authorization tab as well. Select OAuth 2.0, click Get New Access Token, fill in the values from the API docs, and Postman retrieves the token and attaches it automatically.
Step 6: Test POST, PUT, and DELETE Requests
GET is the simplest HTTP method because it only reads data. The others write, update, or delete it, and they require a request body.
POST (Create a resource)
Change the method dropdown to POST. Click the Body tab, select raw, and set the format to JSON. Then type your JSON payload. Using JSONPlaceholder:
{ “title”: “My first post”, “body”: “Testing the API”, “userId”: 1 }
Hit Send. A 201 Created response means it worked.
PUT (Update a resource)
Change the URL to https://jsonplaceholder.typicode.com/posts/1 and the method to PUT. Provide the full updated object in the body. A 200 OK response confirms the update.
DELETE (Remove a resource)
Change the method to DELETE. No body needed. A 200 OK or 204 No Content response means the deletion was accepted.
JSONPlaceholder does not actually modify data; it simulates responses. For testing real write operations, you will need a staging environment or a sandbox API.
Step 7: Organize with Collections
Once you have more than a handful of requests, Collections become essential. A Collection is a folder that groups related API requests together. Think of it as a project folder for your API work.
To create one:
- Click New in the sidebar
- Select Collection and give it a name
- Save any request to the collection by clicking Save > Save to Collection
Collections are also what you share with teammates, import from API documentation, or run in batch using the Collection Runner.
Step 8: Use Environments and Variables
If you are testing across development, staging, and production environments, typing the base URL every time is tedious and error-prone. Environments solve this.
An Environment is a set of key-value pairs (variables) that Postman injects into your requests. You use them like this in a URL:
{{baseUrl}}/users/{{userId}}
Switch the active environment from dev to prod in one click, and every request updates automatically. No find-and-replace. No typos.
Variable scopes in Postman, from broadest to narrowest:
- Global: accessible across all workspaces
- Collection: accessible only within a specific collection, environment-independent
- Environment: switches with the active environment (dev/staging/prod)
- Local: temporary, scoped to a single request run
When the same variable name exists at multiple scopes, the narrower scope wins.
Step 9: Write Basic Tests (Still No Code Required)
Postman lets you add post-response checks to any request. Open the Scripts tab, then click Post-response. While these checks technically use JavaScript, you do not need to write any. Click Snippets at the lower right of the code editor to see a list of pre-built checks you can insert with a single click.
Useful snippets Postman provides out of the box:
- Status code: Code is 200
- Response time is less than 200ms
- Response body: Contains string
- Response body: JSON value check
Select any snippet and the code drops straight into the editor. Hit Send, and the Test Results tab in the response section shows pass or fail. That is automated validation without writing a line yourself.
Common Mistakes to Avoid
- Sending a POST request without setting the Content-Type header to application/json when your body is JSON
- Forgetting to include the Bearer prefix before a token when adding it manually to a header
- Testing against production when a sandbox or staging environment is available
- Ignoring response headers, which often contain rate limit information, pagination details, and cache directives
- Not saving requests to a Collection, which means rebuilding them from scratch every session
Where to Go Next
Once you are comfortable with manual requests, two Postman features are worth exploring: the Collection Runner, which runs all requests in a collection sequentially, and Monitors, which schedule collections to run at set intervals and alert you when something breaks.
If you want to go deeper into API fundamentals before testing more complex flows, MDN Web Docs on HTTP is the most reliable free reference for status codes, methods, and headers. Postman’s own Learning Center is also thorough, and entirely free.
API testing used to mean spinning up a development environment, writing request code, parsing the response, and then debugging why nothing printed to the console. Postman collapsed that process into a few clicks. The interface is not just a convenience for non-developers; most developers use it too, precisely because it removes friction from work that should be fast.
Start with JSONPlaceholder. Learn what the status codes mean. Save your requests. Then, when you hit a real API in a real project, you will already know what you are doing.
Featured image: Walkator
Leave a Reply