Postman Interview Questions & Answers (2026): 35+ Real Questions for QA Engineers

A GUI + CLI tool for building, testing, documenting and monitoring HTTP APIs. Supports REST, GraphQL, gRPC, WebSocket and SOAP.

Postman: largest ecosystem, cloud sync, mock servers. Insomnia: lightweight, plugin-friendly. Bruno: Git-native, offline-first. Pick Postman for team workflows and CI.

A folder of related requests that share auth, scripts and variables — the unit of execution in Newman and CI.

Global → Collection → Environment → Data → Local.

Create one Environment per stage (different {{baseUrl}}, {{token}}) and select via the top-right dropdown — or pass -e in Newman.

Use secret variable type for tokens/passwords so values are masked in logs and snapshots.

No Auth, API Key, Bearer, Basic, Digest, OAuth 1.0, OAuth 2.0, AWS Signature, NTLM, Hawk.

A pre-request script on the collection root requests a new token if {{token_expiry}} is past, then sets {{access_token}} for all child requests.

const expiry = pm.environment.get("token_expiry");
if (!expiry || Date.now() > expiry) {
  pm.sendRequest({
    url: pm.environment.get("auth_url"),
    method: "POST",
    body: { mode: "urlencoded", urlencoded: [...] }
  }, (err, res) => {
    const j = res.json();
    pm.environment.set("access_token", j.access_token);
    pm.environment.set("token_expiry", Date.now() + j.expires_in * 1000);
  });
}

Pre-request runs before the call (set up variables, sign requests). Test runs after (assertions, chain extraction).

pm.test("Status 200", () => pm.response.to.have.status(200));
pm.test("Response time < 500ms", () => pm.expect(pm.response.responseTime).to.be.below(500));
pm.test("Has user id", () => pm.expect(pm.response.json().id).to.be.a("number"));

Extract a value in the first request's test script with pm.environment.set("orderId", res.id) and reference it as {{orderId}} in the next request's URL/body.

Open Collection Runner, attach a CSV/JSON, reference columns as {{column_name}} in the request, and write assertions that use the same column values.

email,password,expectedStatus
user@test.com,Valid@123,200
bad@test,wrong,401

Yes — newman run collection.json -d data.csv -e env.json.

Use Ajv inside a test script:

const Ajv = require("ajv");
const schema = { type: "object", required: ["id","email"], properties: { id:{type:"number"}, email:{type:"string"} }};
const valid = new Ajv().validate(schema, pm.response.json());
pm.test("Schema valid", () => pm.expect(valid).to.be.true);

A hosted endpoint that replays saved example responses — useful when the real backend isn't ready or you want deterministic responses in CI.

Scheduled runs of a collection (every 5 min / hourly / daily) that alert on failure — great for production smoke tests.

The CLI runner for Postman collections — ships JUnit/HTML/JSON reporters for CI.

- run: npm i -g newman newman-reporter-htmlextra
- run: newman run collection.json -e env.json \
    -r cli,junit,htmlextra \
    --reporter-junit-export results.xml

Newman exits non-zero by default when any assertion fails — no extra config needed.

Set body type to GraphQL, paste the query, fill variables in the JSON pane. Postman handles the POST + introspection.

New → WebSocket Request, connect to wss://..., send/receive messages, assert on incoming frames.

Yes — define a schema, run the collection against multiple environments, and assert each response matches the contract. For true consumer-driven contracts, pair with Pact.

Click "View Documentation" on a collection — Postman auto-generates and publishes a hosted doc site from your saved examples.

Yes (Postman v10+): the Performance tab runs a collection with N virtual users and ramp-up. For heavy load, use JMeter or k6 instead.

Store tokens in Environments marked as Secret, never in collection bodies. Use .env + Newman in CI, never commit env files with real secrets.

Use Postman Workspaces with role-based access. Never export a collection containing real tokens to GitHub.

Usually a Content-Type or Authorization header difference, or Postman silently following redirects. Compare with Code → cURL from Postman.

Parallelise with multiple Newman processes per folder, cache auth tokens with pre-request scripts, kill duplicate happy-path requests.

Enable Postman Console, capture request/response + timing, retry with the same correlation ID, hand off the HAR to the backend team.

Postman is great for exploratory + smoke + monitors. For deep regression, contract and unit-level API tests, use code-based frameworks like RestSharp/RestAssured — see our RestSharp guide.

Frame each as Situation → Action → Result → Learning. Rehearse out loud in the AI Mock Interview.