Postman Cheat Sheet (2026): Assertions, Variables & Newman

Postman Cheat Sheet

Everything you write in Postman's Pre-request and Tests tabs on one page — variables, assertions, schema validation, chaining requests, dynamic data, the Collection Runner and Newman for CI. New to Postman? Start with Postman Essentials.

Variable Scopes ⭐

Use any variable as {{name}} in URLs, headers, bodies, auth and query parameters. pm.variables.get("name") reads a value from whichever scope wins.

Precedence (highest first): Local → Data → Environment → Collection → Global. The narrowest scope wins.

Secrets: keep tokens and passwords in the current value of an environment variable (it isn't synced or exported) or in Postman Vault — never in the initial value of a shared collection.

Tests Tab — Core Assertions ⭐

pm.test("Status is 201", () =>
    pm.response.to.have.status(201)
);

pm.test("Responds in under 2 s", () =>
    pm.expect(pm.response.responseTime).to.be.below(2000)
);

pm.test("JSON content type", () =>
    pm.expect(
        pm.response.headers.get("Content-Type")
    ).to.include("application/json")
);

pm.test("Returns the new user", () => {
    const body = pm.response.json();

    pm.expect(body.id).to.be.a("number");
    pm.expect(body.name).to.eql("Asha");
});

pm.test("Body mentions success", () =>
    pm.expect(pm.response.text()).to.include("success")
);

Check the header's value, not just that it exists — to.have.header("Content-Type") alone passes even when the type is wrong.

Assertion Reference

JSON Schema Validation

const schema = {
    type: "object",
    required: ["id", "name"],
    properties: {
        id: { type: "number" },
        name: { type: "string" }
    }
};

pm.test("Matches schema", () =>
    pm.response.to.have.jsonSchema(schema)
);

Reading the Response

const body = pm.response.json();       // parsed JSON

pm.response.text();                    // raw body
pm.response.code;                      // status code
pm.response.responseTime;              // milliseconds
pm.response.headers.get("Content-Type");

body.user.address.city;                // nested object
body.users[0].name;                    // first array item
body.users.length;                     // array size
body.users.find(u => u.role === "admin"); // search an array

Chaining Requests ⭐

Step 1 — save a value in the Tests tab of the first request:

pm.collectionVariables.set(
    "userId",
    pm.response.json().id
);

pm.environment.set(
    "token",
    pm.response.json().token
);

Step 2 — reuse it in later requests:

{{baseUrl}}/users/{{userId}}

Or in a header:

Authorization: Bearer {{token}}

A typical end-to-end flow:

login → save token → create → save ID → get → update → delete → get again (expect 404)

Call Another Request from a Script

pm.sendRequest(
    pm.collectionVariables.get("baseUrl") + "/users/999",
    (err, res) => {
        pm.test("Unknown user returns 404", () =>
            pm.expect(res.code).to.eql(404)
        );
    }
);

Useful for fetching a token or checking a side effect without adding a separate request.

Pre-request Scripts

pm.variables.set(
    "email",
    "user_" + Date.now() + "@test.com"
); // unique data per run

pm.variables.set(
    "orderDate",
    new Date().toISOString().slice(0, 10)
);

Built-in dynamic variables:

{{$guid}}, {{$timestamp}}, {{$randomInt}}, {{$randomEmail}}, {{$randomFirstName}}, {{$randomUUID}}

Control the run order:

pm.execution.setNextRequest("Request name");

This jumps to another request in the Runner.

To stop the run:

pm.execution.setNextRequest(null);

Collection Runner

For data-driven runs, the file's column names become variables. A CSV header such as:

email,password

lets requests use:

{{email}}
{{password}}

Newman (CI/CD) ⭐

npm install -g newman newman-reporter-htmlextra

# Run a collection
newman run collection.json

# Run with an environment
newman run collection.json -e qa.postman_environment.json

# Data-driven execution
newman run collection.json -d testdata.csv

# Run 5 iterations
newman run collection.json -n 5

# Run one folder only
newman run collection.json --folder "Smoke"

# Pass a secret at run time
newman run collection.json \
  -e qa.json \
  --env-var "password=$API_PASSWORD"

# Generate CLI, JUnit and HTML reports
newman run collection.json \
  -e qa.json \
  -r cli,junit,htmlextra \
  --reporter-junit-export results/junit.xml \
  --reporter-htmlextra-export results/report.html

Newman exits with code 1 when any test fails, so the CI build fails automatically.

Full Jenkins and GitHub Actions setups: Postman Newman CI/CD.

Design better test cases for real endpoints in the API Testing Scenario Lab.

📚 Official documentation: Postman Learning Center · MDN: HTTP

FAQs

What's the Difference Between Environment and Collection Variables?

Environment variables change per environment, such as base URLs and credentials. Collection variables belong to one collection regardless of environment and are useful for values produced during a run, such as IDs.

How Do You Pass a Token from One Request to the Next?

Save it in the first request's Tests tab:

pm.environment.set("token", pm.response.json().token);

Then use {{token}} in later requests' headers.

How Do You Validate a JSON Schema in Postman?

Define the schema as an object and assert:

pm.response.to.have.jsonSchema(schema);

How Do You Run Postman Tests in CI?

Export the collection and environment, then run them with Newman in the pipeline. Publish the JUnit and HTML reports as CI artifacts.

Where Should Passwords and Tokens Live?

Use the current value of environment variables or Postman Vault locally, and CI secrets passed with --env-var in automated pipelines. Never store sensitive credentials in a shared collection's initial values.

Go Deeper

• Postman Scripting & Assertions
• REST Assured vs Postman
• The Complete API Testing Tutorial
• Top 30 API Testing Interview Questions