Sending requests

Every send runs the same steps as a run of the collection runner: variables are resolved, scripts run, auth is applied, the request goes out, test scripts run on the response, and secret values are masked before anything is shown or kept.

Press Mod+Enter, or choose Send request in the command palette, to send the request in the current tab. While it is waiting, Mod+period, or Cancel request, stops it. For other protocols the same command reads Invoke request, Connect or Subscribe, and stops with Disconnect or Unsubscribe; see Protocols.

Environments

An environment is a set of variables, such as the address and credentials of one stage of your API. Open the Environments section, or choose Manage environments in the palette, to make and edit them. Mod+E opens the environment picker, and the palette's @ search switches environment too.

Give each environment a colour, so you can tell at a glance where a request goes.
Mark an environment protected, and every send with it asks you first.
Duplicate an environment, or export it as a Postman environment file.
Globals holds variables every request sees, whichever environment is active.

Variables

Write {{name}} anywhere in a request to use a variable. A value can refer to another variable. A name is looked up from the narrowest scope out, and the first that has it wins:

values a script set during this send
the row of the data file, in a run
the active environment
the collection's variables
globals

Secrets

Mark a variable secret, and its value is kept in your operating system's keychain rather than with the collection. It is released only to send, and masked in the request shown back to you, the response, console output, history and run reports.

A variable can also read its value from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or Google Secret Manager. Choose Secret managers… on an environment to add a connection; its credentials are kept in the keychain, and the value is read on your computer each time you send. Teams can share secret values too; see Shared secrets.

Auth

Set auth once on a collection or a folder, in its Auth section, and every request inside it inherits it unless it sets its own. Auth and transport lists every scheme.

Scripts and tests

A collection, a folder and a request can each have a pre-request script and a test script. They run in that order, collection first, then each folder, then the request.

Scripts are JavaScript, with the pm object Postman scripts use: variables in every scope, the request and the response, pm.test and pm.expect for assertions, and pm.sendRequest. console.log writes to the response's Console tab, and each test's result shows on its Tests tab. Scripts run in a sandbox that reaches only what pm and console offer, and a script sees a secret as an opaque value.

Request settings

A request, a folder and a collection each have a Settings section for the timeout, redirects, TLS verification, certificates, proxy, HTTP version and retries, inherited down the tree like auth. Settings > Requests sets the default for each, which applies where nothing in the tree sets one. Auth and transport describes them.