Using Postman Snippets

Scripting Using Snippets in Postman

Postman supports our manual interactive testing of REST APIs by allowing us to create requests, send them to the API and then we can look at the response to see if the API call worked as expected. DZone’s previously covered how to secure REST APIs with client certificates.

A lot of tools do that.

Postman Benefit: Scripting for Assertions

One of the benefits of using Postman is that it allows us to write JavaScript code, which can assert the responses and automatically check the response.

This code checks that the status of the message is 200, meaning Success.

Test Results Automatically Reported

And when I send the request, the code will run and the results will be shown in the Test Results tab.

How to Use This

This can be used to:

• support exploratory testing by asserting on common assertions
• move toward more automated validation of your application by using the Postman runner. To create a set or requests which are automatically sent and the assertions reported on.

What Does This Post Cover?

I will use the snippets to create a script with no coding knowledge:

• create a basic GET Request
• use the Snippets feature of the Tests tab to write assertions
• run the assertions in the GUI

This post has a supporting video that you can find here, or embedded in the post below.

First Create a Request

I'll create a simple request to support this tutorial.

a GET http://localhost:4567/todos request on my test application returns a JSON response with two todo items in it.

This is hardcoded data in the application so it will always be there when the application first starts up.

In the Real World

If I do this in the real world I will:

• Check the Status Code
• Check the content type
• Make sure the body is valid JSON

Check other conditions based on the state of the application.

I Can Automate These Conditions Without Coding

I can create assertions in Postman using the snippets functionality without knowing much about how to code.

Check the Status Code

When I have the "Tests" tab selected.

I can use the snippets on the side to have Postman automatically add code into my Tests.

In the snippets, I can see "Status code: Code is 200", when I click on that Postman will add code into my test.

pm.test("Status code is 200", function () { pm.response.to.have.status(200);})

We can add this test without needing much coding knowledge, but we do have to learn to read the code.

If I read this it means.

Have a postman test call "Status code is 200", this is a JavaScript function and it will expect the postman response to have status code of 200.

I can use this, without amending the code, and Postman will assert that the status code is 200.

With any test we really want to make sure it fails. When if I amend the GET to a URL that doesn't exist e.g. /todosNOT

We should receive a 404 from the application and the Test Results will be red and show us the number of tests which have failed, and we have only added one. And we can see it has failed.

Related DZone Tutorial: How to Secure REST API Endpoints with Spring Security and OAuth2.

Assert on Content Type

I can add a basic content type header check without coding, by selecting "Response header: content-type header check" from snippets.

pm.test("Content-Type is present", function () { pm.response.to.have.header("Content-Type");});

And if we read it it says.

Have a postman test call "Content-Type is present", this is a JavaScript function and it will expect the postman response to have a header of type "Content-Type".

But this doesn't assert on the value of the header so I can't check that it is "application/json" as we are expecting.

I need to write some code to check this.

I can add a line into the test:

pm.expect(pm.response.headers.get("Content-Type")).to.eql("application/json");

Snippets Can Help

Snippets can help you get started with assertions in Postman.

The assertions are useful when you are performing exploratory testing and want to have something monitor invariant assertions as you test. i.e. stuff you expect to always be true for the testing you are performing. For further reading, DZone’s previously covered how to secure your REST API with Keycloak.