Postman & API Testing Interview Questions
Postman and API testing interview questions — status codes, scripts, variables, Newman — with answers.
Postman & API testing interview questions
API testing interviews combine HTTP fundamentals with practical Postman scripting. Expect to write a pm.test or explain how you'd test a given endpoint.
1. Why test APIs and not only the UI?
APIs hold most business logic, are faster and more stable to test than UIs, can be tested before the front end exists, and failures point straight to the faulty service.
2. What's the difference between PUT and PATCH?
PUT replaces the whole resource with the request body; PATCH updates only the fields sent. PUT is idempotent by definition; PATCH may or may not be.
3. What do 200, 201, 204, 400, 401, 403, 404, 409, 422 and 500 mean?
OK; Created; No Content; Bad Request; Unauthorized (not authenticated); Forbidden (authenticated but not allowed); Not Found; Conflict; Unprocessable Entity (validation failed); Internal Server Error.
4. Which HTTP methods are idempotent?
GET, PUT, DELETE, HEAD and OPTIONS — repeating them has the same effect as doing it once. POST is not idempotent.
5. What is a Postman collection? An environment?
A collection is a group of saved requests (with folders, scripts and auth). An environment is a set of variables — like baseUrl and credentials — for a target such as dev or staging.
6. Explain variable scopes in Postman.
Global, collection, environment, data and local. The narrowest scope wins when names clash. Use environments for per-server values and collection variables for values passed between requests.
7. Pre-request vs post-response scripts?
Pre-request scripts run before sending (generate data, set auth headers, refresh tokens). Post-response scripts run after (assertions, saving values like tokens and IDs).
8. How do you write a test in Postman?
pm.test('name', () => { pm.response.to.have.status(200); pm.expect(pm.response.json().id).to.eql(1); });
9. How do you pass a token from a login request to later requests?
Save it in the login request's script — pm.collectionVariables.set('token', pm.response.json().accessToken) — and use Bearer {{token}} in the Authorization of the collection or each request.
10. How do you validate the response structure?
With a JSON Schema: pm.response.to.have.jsonSchema(schema), checking types, required fields and optionally that no unexpected fields appear.
11. What is Newman?
Postman's command-line collection runner. It runs exported collections with environments and data files, produces reports (cli, JUnit, htmlextra) and exits non-zero on failures, so it fits any CI pipeline.
12. How do you run data-driven tests?
Provide a CSV or JSON data file to the Collection Runner or newman run -d. Each row is an iteration; columns become variables accessible via {{column}} or pm.iterationData.get().
13. How would you test a "create user" API?
Valid creation (201, body, Location header); response schema; required fields missing (400/422 with messages); invalid formats (email, phone); duplicates (409); boundary lengths; unauthorised and forbidden callers (401/403); SQL/script injection in fields; idempotency on retries; then GET to confirm persistence and DELETE to clean up.
14. What is the difference between authentication and authorization testing?
Authentication: can the caller prove who they are (missing/expired/invalid tokens → 401)? Authorization: are they allowed to do this (accessing another user's resource → 403 or 404)?
15. How do you test API performance in Postman?
Assert pm.response.responseTime for basic checks, and use Postman's performance runner or dedicated tools (k6, JMeter) for real load tests.
16. What is contract testing?
Verifying that an API keeps its agreed request/response structure — via schema validation or consumer-driven contracts (Pact) — so changes don't silently break consumers.
17. How do you keep secrets out of shared collections?
Secret-type environment variables, local values that don't sync, and injecting credentials in CI with newman --env-var from repository secrets.
18. What is mocking an API and when is it useful?
Simulating an API's responses (Postman mock servers, WireMock) so front-end or dependent teams can work and test before the real API is ready, or to reproduce error responses on demand.