Practical tips on writing API Tests with Postman
Tags: testing
Published: 2020-07-28 07:38:57

# Introduction

For my portfolio, I conducted exploratory testing with Postman and saved my requests in a <a href="https://github.com/ashleygraf101/postman-collection">set of collections</a>. This is what I learnt. As part of my study, I took <a href="https://twitter.com/ambertests">Amber Race</a>'s <a href="https://testautomationu.applitools.com/">TAU</a> course on Service APIs, which I will reference throughout. 

## Tips
1- Use the environmental variables. They make mistakes harder to make, and ensure you're using the same values every time. 

2- Duplicate is your friend. When you're just changing a single param, it's better not to rewrite the whole test every time.

3- You can write pre-request scripts and tests which also send requests to the API you're testing, or any other you have access to. 

<i>What's so cool about pre-request scripts?</i>

Well, tests aren't flaky in and of themselves. There's nothing inherent about them. It is often to do with the way they're written, and thus it can be fixed. 

Pre-request scripts enable API tests to be <b>independent</b> of each other. You no longer have to be reliant on test order.

Here's one of mine for each, before I discovered you can make pre-collection pre-test scripts.

![Pre-request](https://dev-to-uploads.s3.amazonaws.com/i/wob3ubtesiyv3vdbbls3.png)<figcaption>Pre-request: Pulling up a list of all my IDs, and picking one</figcaption>

![Test](https://dev-to-uploads.s3.amazonaws.com/i/dfczny0cbodia5e7sg5h.png)<figcaption>Test: Checking that the specific ID is deleted and attempts to get a crocodile with that ID returns a 404</figcaption>

4- You can write pre-request scripts for a whole collection. 

With a pre-collection pre-request script, I can move all of the current pre-request script to pre-collection, and create a crocodile object for just this test in my new pre-request script. Then I keep the test script the same. Perhaps the variable name might change. 

![Click edit collection, and it's on the third column](https://dev-to-uploads.s3.amazonaws.com/i/324u7h4i66km1k0obspu.png)
<figcaption>Click edit collection, and it's on the third column</figcaption>

5- You can test a whole set of possible inputs without creating a separate request for each one. Here's how.

a) create a CSV file with a header row. Where you're only testing one set of inputs and the reason for using each line is slightly different, I like to use the second column for explanation.

![CSV file has first row as header](https://dev-to-uploads.s3.amazonaws.com/i/f7ksefey08yotpoiyq36.png)
<figcaption>CSV file has first row as header</figcaption>

b) Use the header row name to get the variable. Then set it like so. It will look red and an alert will appear that it is not connected to anything. That's true enough until...

![Add the file to the pre-request script like so]
(https://dev-to-uploads.s3.amazonaws.com/i/0l38n0jufol2b7ojhexe.png)
<figcaption>Add the file to the pre-request script like so</figcaption>


![Add the variable into the body, and you get this result](https://dev-to-uploads.s3.amazonaws.com/i/tczxbuwzf5ide7a47wfs.png)
<figcaption>Add the variable into the body, and you get this result</figcaption>

c) When you run the collection, add the file in 'upload file'. 

![Upload file here](https://dev-to-uploads.s3.amazonaws.com/i/hxnkmzjng2vpzovn5h47.png)
<figcaption>Upload file here</figcaption>

## Plus: From exploratory to regression

If I was to transform this test suite from exploratory to regression, I would do the below. 

The API I am using has a rate-limit of 100 crocodiles per account. Therefore I should delete my new crocodile objects after every test, and create a new one for every test. 

I would create several before testing the 'view list of crocodiles' request. Creating crocodile objects this way I don't need to manually delete crocodiles every so often. 

I would then use two test-k6 accounts - one on the limit to check the rate-limit works, and one for the rest of the tests which require authorization.