Postman Cheat Sheet

Build, test and document API requests. Collection = a folder of saved requests. Environment = a set of variables (dev / prod). On macOS use ⌘ instead of Ctrl.

43 entries
7 sections
Updated 1 Oct 2026
Click a command to see all its options

F

43 entries

On this page

Shortcuts #

Shortcut	Action
`Ctrl + Enter`	Send the request
`Ctrl + T`	New tab
`Ctrl + N`	Create new (request, collection…)
`Ctrl + S`	Save the request
`Ctrl + W`	Close tab
`Ctrl + L`	Focus the URL bar
`Ctrl + O`	Import (file, cURL, OpenAPI)
`Ctrl + K`	Search everything
`Ctrl + B`	Beautify the body (JSON/XML)
`Ctrl + \`	Toggle the sidebar
`Ctrl + Alt + C`	Postman Console (see raw requests and `console.log`)
`Ctrl + ,`	Settings

Variables #

Syntax	Meaning
`{{baseUrl}}/users`	Use a variable anywhere (URL, headers, body)
Scopes (narrow wins)	Global → Collection → Environment → Data → Local
`{{$guid}}`	Random UUID
`{{$timestamp}}`	Unix timestamp
`{{$randomEmail}}` / `{{$randomFirstName}}`	Fake test data
`{{$randomInt}}`	Random number 0–1000

Store secrets in environment variables and mark them as secret. Never hard-code tokens in shared requests.

Auth #

Setup	How
Bearer token	Authorization tab → Bearer Token → `{{token}}`
Set once for all	Put auth on the collection; requests use Inherit auth from parent
OAuth 2.0	Authorization tab → OAuth 2.0 → Get New Access Token

Scripts (Pre-request & Post-response) #

// Post-response: save a token from a login response
const json = pm.response.json();
pm.environment.set("token", json.token);

// Tests
pm.test("Status is 200", () => pm.response.to.have.status(200));
pm.test("Has a user id", () => pm.expect(json.id).to.be.a("number"));
pm.test("Fast enough", () => pm.expect(pm.response.responseTime).to.be.below(500));

// Pre-request: set a timestamp header
pm.request.headers.add({ key: "X-Time", value: Date.now().toString() });

API	Use
`pm.environment.get/set`	Environment variables
`pm.collectionVariables.get/set`	Collection variables
`pm.response.json()` / `.text()`	Response body
`pm.response.code`	Status code
`pm.sendRequest(url, cb)`	Send an extra request from a script

Handy Features #

Feature	Where
Paste a cURL command	Paste it in the URL bar or Import it
Generate code (fetch, axios, Python…)	`</>` icon on the right
Run a whole collection	Collection → Run (Collection Runner)
Mock server	Collection → Mock (fake API from saved examples)
Save response as example	Response → Save as example
History	Sidebar → History

Command Line #

Command	Action
	Install Newman
	Run a collection (CI)
	Postman CLI (logs in with an API key)

HTTP Status Codes #

Code	Meaning
`200` / `201` / `204`	OK / Created / No content
`301` / `304`	Moved permanently / Not modified
`400`	Bad request (invalid input)
`401` / `403`	Not logged in / not allowed
`404`	Not found
`409` / `422`	Conflict / validation error
`429`	Too many requests
`500` / `502` / `503`	Server error / bad gateway / unavailable

Option	What it does
(no packages)	Install everything from `package.json`
`pkg`	Add a dependency (saved in `package.json`)
`pkg@1.2.3` / `pkg@latest` / `pkg@next`	Specific version or tag
`-D` (`--save-dev`)	Development dependency
`-g`	Install a CLI globally
`-E` (`--save-exact`)	Save `1.2.3` instead of `^1.2.3`
`-O` (`--save-optional`)	Optional dependency
`--no-save`	Install without changing `package.json`
`--omit=dev`	Skip dev dependencies (production)
`--legacy-peer-deps`	Ignore peer-dependency conflicts
`-f` (`--force`)	Force (overrides conflicts and cache)
`--ignore-scripts`	Don't run install scripts
`--no-audit --no-fund`	Quieter, faster
`../my-lib` / `user/repo` / `file.tgz`	Install from a folder, GitHub or a tarball

Option	What it does
`-e env.json`	Environment file
`-g globals.json`	Global variables
`-d data.csv`	Data file: one iteration per row
`-n 5`	Number of iterations
`--folder "Users"`	Only one folder of the collection
`--env-var "token=abc"`	Set a variable
`-r cli,json,junit`	Reporters (`--reporter-junit-export out.xml`)
`--delay-request 200`	Wait between requests (ms)
`--timeout-request 5000`	Request timeout (ms)
`--bail`	Stop at the first failure
`-k` (`--insecure`)	Ignore TLS errors

Command / option	What it does
`login --with-api-key KEY`	Log in
`collection run <collection-id>`	Run a collection from your workspace (or a local `.json` file)
`-e <environment-id>`	Environment to use
`-n 3`	Number of iterations
`-d data.csv`	Data file for iterations
`--bail`	Stop at the first failure
`--reporters cli,json`	Output formats
`api lint <api-id>`	Check an API definition against the governance rules
`logout`	Log out