API Testing with Postman Interview Questions

This Q&A bank contains 100 questions and answers on API testing foundations, Postman configurations, scripting assertions, dynamic environment variables, and CI/CD triggers.

Use the interactive details tags to expand and read the answers.

A. API Basics & Fundamentals

Q1: What is API testing and why is it important?

API testing verifies that Application Programming Interfaces work as intended, meeting functional, security, and performance standards. It validates business logic directly without relying on a UI.

It is important because:

APIs are the backbone of modern microservice architectures.
Failures in backend APIs cascade to downstream apps.
API tests run faster and provide quicker feedback than UI tests.

Q2: What are the different types of APIs?

Public APIs: Available to any third-party developers (e.g., Google Maps API).
Private APIs: Internal to an organization.
Partner APIs: Exposed to specific business partners under contractual agreements.
Composite APIs: Orchestrate multiple API calls into a single response.

Q3: What is the difference between SOAP and REST APIs?

SOAP (Simple Object Access Protocol) is XML-based, strictly contracted via WSDL, heavy, and secure by default.
REST (Representational State Transfer) uses standard HTTP methods, handles JSON, XML, or HTML formats, is lightweight, and is widely preferred.

Q4: Explain HTTP methods in API testing.

GET: Retrieve data from the server.
POST: Create a new resource.
PUT: Update a resource completely.
PATCH: Update a resource partially.
DELETE: Remove a resource.

Q5: What is idempotency in HTTP methods?

Idempotency means sending the same request multiple times returns the same outcome.

GET, PUT, DELETE are idempotent.
POST is not idempotent (repeated calls create duplicate records).

Q6: Difference between URI, URL, and Endpoint.

URI (Uniform Resource Identifier) is an identifier for a resource.
URL (Uniform Resource Locator) defines the location and protocol to find the resource (e.g., https://api.com/users).
Endpoint is the exact URL where an API resource is exposed to clients.

Q7: Categories of HTTP status codes.

1xx: Informational.
2xx: Success (e.g., 200 OK, 201 Created).
3xx: Redirection.
4xx: Client Error (e.g., 400 Bad Request, 401 Unauthorized, 404 Not Found).
5xx: Server Error (e.g., 500 Internal Server Error).

Q8: What are headers in API requests and responses?

Headers carry metadata about the request or response (e.g., Content-Type: application/json, Authorization: Bearer <token>, Accept-Language: en).

Q9: What is JSON and why is it preferred over XML?

JSON is a lightweight key-value text format. It is preferred because it has smaller payloads, is parsed natively by JavaScript, and is easier for humans to read than XML.

Q10: How do you validate an API response?

Validate the HTTP status code, check the response headers (e.g., content-type), assert values in the response body, and verify the JSON schema matches the contract.

B. Postman Features & Usage

Q11: What is Postman and why is it widely used in API testing?

Postman is an API platform for sending requests, writing scripts, and running automated tests. It is popular because of its user-friendly interface, environment switching, and Newman CLI integration for pipelines.

Q12: Explain the structure of a request in Postman.

A request in Postman includes:

HTTP Method and URL/Endpoint.
Params (Query parameters).
Headers.
Request Body (JSON, form-data).
Authorization config.
Pre-request and Test scripts.

Q13: What are Postman Collections and why are they important?

A Collection is a folder system that groups related API requests. It keeps tests organized, supports sharing, generates documentation, and runs batches via Collection Runner.

Q14: What are environments in Postman?

Environments store key-value variables specific to server contexts (e.g., baseUrl pointing to Dev, QA, or Staging), allowing testers to switch context without updating code.

Q15: What are variables in Postman and how do you use them?

Variables store reusable values. Scopes: Global, Collection, Environment, and Local. Used in endpoints and payloads using double curly braces: {{baseUrl}}/users/{{userId}}.

Q16: What is the difference between Pre-request Script and Tests in Postman?

Pre-request Script executes before the HTTP request is sent (e.g., generating timestamps).
Tests script executes after the response is received (e.g., checking assertions).

Q17: How do you write a basic test script in Postman?

Use Postman's JavaScript library (pm):

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

Q18: How do you send authentication credentials in Postman?

Under the Authorization tab, choose the auth type:

Basic Auth (username/password).
Bearer Token (token string).
API Key or OAuth 2.0.

Q19: What is Collection Runner in Postman?

A built-in tool that runs all requests in a collection in sequence, supports iterating over CSV/JSON data files, and logs pass/fail results.

Q20: What is Newman and why is it used?

Newman is the NodeJS command-line runner for Postman collections. It allows running collections in headless environments and CI/CD build scripts.

Q21: How do you handle dynamic data in Postman tests?

Retrieve values from the response body and save them to environment variables:

let token = pm.response.json().token;
pm.environment.set("token", token);

Q22: How do you import/export collections and environments in Postman?

Export: Right-click a collection or environment -> Export (saves as JSON).
Import: Use the Import button on the top-left to drag and drop JSON files.

Q23: What is a Monitor in Postman?

A cloud-based monitoring feature that schedules collection runs automatically at set intervals to verify API uptime and alert on failures.

Q24: How do you validate JSON schema in Postman?

Use the pm.response.to.have.jsonSchema(schema) assertion inside the Tests tab with a defined AJV schema structure.

Q25: How do you pass query parameters in Postman?

Either append parameters directly to the URL (?status=active) or add key-value rows in the Params tab below the address bar.

C. API Testing in Depth

Q26: How do you approach testing a new API when no documentation is available?

Capture API traffic using browser DevTools or proxy tools (e.g. Fiddler).
Explore endpoints starting with GET calls.
Inspect error responses to identify required headers/parameters.
Interview developers to verify assumptions.

Q27: What are the most common API testing validations?

Validations should cover: HTTP status codes, payload fields and data types, content-type and security headers, response latency SLAs, and schema validation.

Q28: How do you test API error handling?

Perform negative testing: send missing required fields, send invalid data types, trigger authentication failures, and exceed rate limits to verify correct 4xx and 5xx error codes.

Q29: What is the difference between functional and non-functional API testing?

Functional: Verifies logic correctness (e.g., correct response payload fields).
Non-functional: Checks performance metrics (e.g., speed under load) and security policies (e.g., OWASP top 10).

Q30: How do you validate data integrity in API testing?

Use request sequencing: execute POST to create, run GET to verify, execute PUT to modify, and query the database directly to verify database records match.

Q31: How do you test API security in Postman?

Test accessing endpoints without tokens (should fail), use expired/tempered tokens (should fail), and check for CORS restrictions and sensitive plain text data exposure.

Q32: How do you test an API for performance using Postman?

Assert response time in test scripts: pm.expect(pm.response.responseTime).to.be.below(500); For heavy load validation, export the collection to JMeter or k6.

Q33: How do you chain API requests in Postman?

Chaining passes data from one response to the next. The tests tab of request A saves the variable, and request B references it using {{variableName}}.

Q34: How do you test APIs that have dependencies on other services?

Use Postman mock servers or stubs to simulate the dependencies, or design contract tests to validate interactions without full integration.

Q35: How do you handle dynamic tokens or session IDs in Postman?

Parse the token from the login response body using pm.response.json().token and set it as an environment variable in the Tests tab.

Q36: How do you ensure API backward compatibility?

Run regression test suites against old versions, check that deprecated fields still return correct data, and verify new properties are optional.

Q37: How do you test API pagination?

Send requests with limit and offset params (?limit=10&offset=20), check response sizes, and test limits (first, last, out-of-bounds pages).

Q38: How do you test sorting and filtering in APIs?

Send filter parameters (?status=active) and verify only matching records return. Send sort parameters (?sort=name&order=asc) and verify the list matches array sort logic.

Q39: How do you validate API contracts?

Compare responses against Swagger/OpenAPI files using contract assertions or AJV schema validations in Postman.

Q40: How do you test APIs that return asynchronous responses?

Submit the request to get a job ID, run a status polling API in a loop (using postman.setNextRequest), and validate the final payload once completed.

D. Scripting & Automation in Postman

Q41: What scripting language does Postman use for automation?

Postman uses JavaScript. Pre-request scripts run before the call, while Test scripts execute after the response arrives.

Q42: How do you store and use dynamic values across requests?

In the Tests tab: pm.environment.set("myKey", pm.response.json().someValue); Use it in the URL of the next request as {{myKey}}.

Q43: How do you run data-driven tests in Postman?

Use a CSV or JSON file in Collection Runner. The variable names in the collection (e.g. {{username}}) must match the column headers in the data file.

Q44: How do you write assertions for status codes and response times?

pm.test("Status code is 200", () => { pm.response.to.have.status(200); });
pm.test("Time < 500ms", () => { pm.expect(pm.response.responseTime).to.be.below(500); });

Q45: How do you validate JSON response body in Postman?

let data = pm.response.json();
pm.test("Check name", () => { pm.expect(data.name).to.eql("John"); });

Q46: How do you validate a JSON schema in Postman tests?

const schema = { "type": "object", "required": ["id"] };
pm.test("Schema check", () => { pm.response.to.have.jsonSchema(schema); });

Q47: How do you log output to Postman Console?

Write console.log("val:", value); and view output in the Postman Console panel (Alt + Ctrl + C).

Q48: How do you handle loops in Postman scripts?

Control flow dynamically using: postman.setNextRequest("Request Name"); Set to null to stop execution loops: postman.setNextRequest(null);.

Q49: How do you call one request from another in Postman?

Sequencing is managed via postman.setNextRequest("targetRequestName"), which overrides Docusaurus/Postman default linear order.

Q50: How do you generate random test data in Postman?

Use dynamic variables: {{$randomEmail}}, {{$randomFirstName}}, or write JavaScript's random math in the pre-request script.

Q51: How do you handle conditional testing in Postman scripts?

Write conditional blocks in the Tests script to change assertions based on status codes:

if (pm.response.code === 200) { ... }

Q52: How do you automate Postman tests in CI/CD pipelines?

Export the collection and environment as JSON files, and run them headlessly in your pipeline script using: newman run collection.json -e env.json

Q53: How do you capture values from headers in Postman?

let token = pm.response.headers.get("Authorization");

Q54: How do you validate arrays in Postman response?

let items = pm.response.json().items;
pm.test("Array count", () => { pm.expect(items.length).to.be.above(0); });

Q55: How do you run only selected tests in a Postman collection?

Organize tests into subfolders and execute only specific folders in Newman or Collection Runner, or use setNextRequest to skip tests.

Q56: How do you use environment variables in scripts?

Get: pm.environment.get("variable_name");
Set: pm.environment.set("variable_name", "value");

Q57: How do you parameterize requests in Postman?

Place double curly brackets containing variable names in headers, URLs, or JSON body payloads (e.g. {{user_name}}).

Q58: How do you run Postman tests headlessly?

Install Newman CLI using npm (npm install -g newman) and execute runs via command line terminal commands.

Q59: How do you retry failed requests in Postman scripts?

Use a retry count variable in Staging environments:

if (pm.response.code !== 200 && retryCount < 3) {
    postman.setNextRequest(pm.info.requestName);
}

Q60: How do you test APIs with file uploads in Postman?

Configure body type to form-data, add a key of type file, and choose files from your local storage.

E. Advanced Testing Scenarios

Q61: How do you test versioned APIs?

Verify changes across routes (e.g., /v1/ vs /v2/). Check that deprecated endpoints handle validation checks gracefully.

Q62: How do you test APIs in a microservices architecture?

Mock external service dependencies, focus on API schemas, and write contract tests to check service boundaries.

Q63: How do you test APIs that return asynchronous results?

Execute request, parse job ID, run a status query iteratively in the test script until status becomes completed, then perform assertions.

Q64: How do you test APIs with third-party integrations?

Mock third-party API payloads to prevent billing charges and bypass network instability during integration runs.

Q65: How do you test API rate limiting?

Trigger request bursts in a loop. Verify that the server returns a 429 Too Many Requests code when thresholds are crossed.

Q66: How do you test webhooks in Postman?

Set up a Postman Mock Server endpoint, configure the webhook to send notifications to that mock URL, and check the received logs.

Q67: How do you test GraphQL APIs in Postman?

Configure the request type to POST, select GraphQL body payload, write queries/mutations, and assert JSON response attributes.

Q68: How do you test APIs with file downloads?

Assert that the Content-Disposition header matches the expected filename and check that the Content-Length matches target limits.

Q69: How do you test APIs that require digital signatures?

Use a Pre-request script to calculate HMAC hashes (using CryptoJS) and inject the signature value into the Authorization header dynamically.

Q70: How do you mock APIs in Postman?

Create a Mock Server in Postman, add endpoints, save response templates, and route your client calls to the mock server URL.

Q71: How do you handle API request sequencing in Postman?

Organize requests sequentially in collection folders, and configure conditional routing using postman.setNextRequest().

Q72: How do you test APIs that have different behavior for different users?

Map different Bearer tokens (Admin, Standard User, Guest) to variables, and verify Role-Based Access Control permissions.

Q73: How do you test an API migration from monolith to microservices?

Run identical test scenarios on both environments, and compare response payloads and execution speeds to verify parity.

Q74: How do you test an API that returns streaming data?

Configure Postman WebSocket connections, subscribe to the event stream, and assert on incoming messages and connection durability.

Q75: How do you test APIs with scheduled jobs?

Configure cron schedules to execute frequently in QA environments, or trigger jobs manually using admin API routes.

Q76: How do you handle flaky APIs in automation?

Implement retry policies inside pre-request/test scripts, and handle dynamic delays instead of using hardcoded intervals.

Q77: How do you test localization in APIs?

Send headers (e.g. Accept-Language: fr-FR) and verify that description strings, currencies, and timestamps adjust.

Q78: How do you validate API caching behavior?

Verify headers like Cache-Control, ETag, and check if repeated requests yield fast response times.

Q79: How do you test APIs under failure scenarios?

Mock the target endpoints to return status codes like 500 or 503, and verify client-side failover capabilities.

Q80: How do you test gRPC APIs in Postman?

Import the .proto service definition file, select the method to test, pass query values, and trigger execution.

F. CI/CD & Integration Testing

Q81: How do you integrate Postman tests into CI/CD pipelines?

Export collections and environments to JSON format, and run them inside build stages (Jenkins, GitLab CI) using the Newman CLI.

Q82: What is Newman and why is it used?

Newman is the headless command-line runner for Postman collections, used in automated pipelines to run API assertions without a GUI.

Q83: How do you generate HTML reports from Newman?

Run Newman using the htmlextra reporter plugin: newman run col.json -r htmlextra This creates responsive dashboards.

Q84: How do you schedule Postman collections to run automatically?

Set up scheduled Jenkins cron jobs, or use Postman cloud Monitors to run checks at hourly intervals.

Q85: How do you pass dynamic environment variables in CI/CD?

Override variables using the Newman CLI flag: newman run col.json --env-var "baseUrl=https://qa.api.com"

Q86: How do you run specific folders or requests from a collection in CI/CD?

Use the --folder argument in Newman: newman run col.json --folder "SmokeTests"

Q87: How do you integrate Postman with version control (Git)?

Save and commit exported collection JSON files directly into your framework Git repositories, or sync using Postman Git integrations.

Q88: How do you test APIs automatically after deployment?

Configure post-deployment triggers in pipelines to run Newman scripts as verification gates before updating production environments.

Q89: How do you run Postman collections in parallel?

Configure your CI pipeline runner (e.g. Jenkins) to execute multiple Newman commands concurrently on parallel build nodes.

Q90: How do you publish API test results to a dashboard?

Configure Newman to export results in JUnit XML format, and import them into Jenkins or Azure DevOps reporting dashboards.

G. Best Practices & Common Pitfalls

Q91: What are API testing best practices?

Avoid hardcoded values; use variables.
Write both positive and negative tests.
Validate response times and schemas.
Clean up test data afterwards.

Q92: How do you ensure API tests are maintainable?

Group requests logically, reuse code in Pre-request folders, and avoid hardcoding authentication tokens.

Q93: What is schema validation and why is it important?

It checks if response payloads conform to defined properties and types, catching breaking modifications early.

Q94: What’s the difference between smoke, regression, and load testing in APIs?

Smoke: Quick ping to check if endpoints are alive.
Regression: Running full suites to check functional changes.
Load: Testing response times under heavy user traffic.

Q95: What are common mistakes in Postman testing?

Hardcoding endpoints and tokens.
Testing only success scenarios.
Neglecting to assert on schema structures.

Q96: How do you handle API security testing in Postman?

Test endpoints without headers (should fail), use invalid tokens, and execute injection payloads inside parameter forms.

Q97: How do you manage large Postman collections efficiently?

Break large collections into smaller, feature-specific folders, and write shared scripts at the collection level.

Q98: How do you test APIs with complex JSON structures?

Parse the response using pm.response.json() and access deep nested fields using JavaScript dot notation or lodash methods.

Q99: How do you keep Postman environments in sync across teams?

Use shared workspaces in Postman, or version control environment JSON templates (excluding secret keys) in Git.

Q100: If an API test fails in CI/CD, how do you troubleshoot?

Check Newman execution logs, verify environment variable exports, check endpoints, and rerun manually in Postman.

A. API Basics & Fundamentals​

B. Postman Features & Usage​

C. API Testing in Depth​

D. Scripting & Automation in Postman​

E. Advanced Testing Scenarios​

F. CI/CD & Integration Testing​

G. Best Practices & Common Pitfalls​