Postman Cheat Sheet

Updated 2026-04-29

Next Topic: Prettier Code Formatter Cheat Sheet

🧠Study flashcards on this topic153 cards · spaced repetition→

Postman is an API platform that enables developers to design, test, document, monitor, and collaborate on APIs throughout their lifecycle. It provides a desktop application and web interface supporting HTTP, REST, GraphQL, WebSocket, gRPC, MQTT, SSE, MCP, and SOAP protocols. The 2026 v12 release made Postman AI-native and Git-native: collections are stored as YAML in your Git repository, Agent Mode handles tasks in natural language, and a new API Catalog gives teams a centralized view of every service in their organization. Postman centralizes the full API lifecycle—from design and mocking through testing, monitoring, and collaboration—making it an essential platform for API-first development teams.

What This Cheat Sheet Covers

This topic spans 34 focused tables and 252 indexed concepts, 153 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: HTTP Request TypesTable 2: CollectionsTable 3: Variables and ScopesTable 4: Dynamic VariablesTable 5: EnvironmentsTable 6: Authorization TypesTable 7: Pre-Request ScriptsTable 8: Post-Response Scripts (Tests)Table 9: Request Workflow ControlTable 10: Data-Driven TestingTable 11: Mock ServersTable 12: MonitorsTable 13: Newman (CLI Runner)Table 14: Postman CLITable 15: Code GenerationTable 16: WorkspacesTable 17: API DocumentationTable 18: Postman FlowsTable 19: Testing Advanced FeaturesTable 20: GraphQL SupportTable 21: WebSocket and SSE TestingTable 22: gRPC SupportTable 23: MQTT TestingTable 24: SOAP API TestingTable 25: Performance TestingTable 26: Interceptor and ProxyTable 27: API Schema and OpenAPITable 28: Debugging and ConsoleTable 29: Certificates and SSLTable 30: Request History and ReplayTable 31: API GovernanceTable 32: API Security TestingTable 33: Collaboration FeaturesTable 34: AI Features, Agent Mode & MCP

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: HTTP Request Types

Every API call starts with choosing a verb, and the verb carries meaning beyond just "fetch" or "send." These are the methods you'll select in Postman's request bar — the everyday GET/POST/PUT/PATCH/DELETE plus the lesser-used HEAD, OPTIONS, and TRACE — and the key thing to internalize is which ones are idempotent and safe, since that's what determines whether a retry is harmless or destructive.

Method	Example	Description
GET	`GET https://api.example.com/users`	• Retrieve data from a server • idempotent and safe — does not modify resources.
POST	`POST https://api.example.com/users` `Body: {"name": "Alice"}`	• Create new resources on the server • non-idempotent, typically includes a request body.
PUT	`PUT https://api.example.com/users/123` `Body: {"name": "Bob", "age": 30}`	• Replace an entire resource completely • idempotent — requires full resource representation.
PATCH	`PATCH https://api.example.com/users/123` `Body: {"age": 31}`	Partial update — modifies only the provided fields of a resource.
DELETE	`DELETE https://api.example.com/users/123`	• Remove a resource from the server • idempotent — may return 204 No Content.
HEAD	`HEAD https://api.example.com/users`	Retrieve response headers only without body — useful for checking resource existence or metadata.
OPTIONS	`OPTIONS https://api.example.com/users`	Discover allowed HTTP methods and CORS policies — used in preflight requests by browsers.
TRACE	`TRACE https://api.example.com/path`	Echo the request back — used for diagnostic loop-back testing along the request path.

Table 2: Collections

Collections are how Postman turns a pile of loose requests into something you can run, share, and version as a unit. The pieces here — folders for grouping, the Collection Runner for batch execution, forks and pull requests for safe collaboration, plus import/export and scheduled runs — together make a collection behave less like a scratchpad and more like a small codebase for your API.

Feature	Example	Description
Collection	Create > Collection > "User API Tests"	Organized group of API requests that can be run together, shared, and versioned as a single unit.

The rest of this section is part of the full cheat sheet

Table 3: Variables and Scopes

Variables let you write {{baseUrl}} once instead of hardcoding URLs and tokens everywhere — but the real subtlety is scope, which decides where a value is visible and which one wins when names collide. The rows walk from the broadest (global) down to the narrowest (local), and the resolution order matters: local beats data beats environment beats collection beats global. The initial-versus-current distinction at the end is the one people trip over most, since it's what keeps secrets off the team sync.

Scope	Example	Description
Global Variables	`{{baseUrl}}` set globally	Available across all workspaces, collections, and requests — broadest scope for shared values.

The rest of this section is part of the full cheat sheet

Table 4: Dynamic Variables

When you need a fresh UUID, a current timestamp, or believable fake data on every send, these built-in {{$...}} variables generate it on the fly — most powered by Faker.js. They're the fastest way to avoid duplicate-key errors and to populate realistic test users without writing a single line of script.

Variable	Example	Description
$guid	`{{$guid}}` → `"a8f9f8db-..."`	Generates a v4 UUID (universally unique identifier) for unique record identification.

The rest of this section is part of the full cheat sheet

Table 1: HTTP Request Types

Method	Example	Description
GET	`GET https://api.example.com/users`	• Retrieve data from a server • idempotent and safe — does not modify resources.
POST	`POST https://api.example.com/users` `Body: {"name": "Alice"}`	• Create new resources on the server • non-idempotent, typically includes a request body.
PUT	`PUT https://api.example.com/users/123` `Body: {"name": "Bob", "age": 30}`	• Replace an entire resource completely • idempotent — requires full resource representation.
PATCH	`PATCH https://api.example.com/users/123` `Body: {"age": 31}`	Partial update — modifies only the provided fields of a resource.
DELETE	`DELETE https://api.example.com/users/123`	• Remove a resource from the server • idempotent — may return 204 No Content.
HEAD	`HEAD https://api.example.com/users`	Retrieve response headers only without body — useful for checking resource existence or metadata.
OPTIONS	`OPTIONS https://api.example.com/users`	Discover allowed HTTP methods and CORS policies — used in preflight requests by browsers.
TRACE	`TRACE https://api.example.com/path`	Echo the request back — used for diagnostic loop-back testing along the request path.

Table 2: Collections

Feature	Example	Description
Collection	Create > Collection > "User API Tests"	Organized group of API requests that can be run together, shared, and versioned as a single unit.

Table 3: Variables and Scopes

Scope	Example	Description
Global Variables	`{{baseUrl}}` set globally	Available across all workspaces, collections, and requests — broadest scope for shared values.

Table 4: Dynamic Variables

Variable	Example	Description
$guid	`{{$guid}}` → `"a8f9f8db-..."`	Generates a v4 UUID (universally unique identifier) for unique record identification.