GraphQL body in Postman - Build an Automation Script

Send a GraphQL query using Postman and verify the response

Preconditions (2)

Step 1: Open Postman and create a new POST request

Step 2: Set the request URL to the GraphQL API endpoint

Step 3: In the Body tab, select 'GraphQL' as the body type

Step 4: Enter the following GraphQL query in the 'QUERY' section: '{ user(id: "1") { id name email } }'

Step 5: Click 'Send' to execute the request

Step 6: Observe the response body

✅ Expected Result: The response body contains the user object with id '1' and fields 'id', 'name', and 'email' with valid values

Automation Requirements - Postman test scripts (JavaScript)

Assertions Needed:

Response status code is 200

Response body contains 'data.user.id' equal to '1'

Response body contains 'data.user.name' as a non-empty string

Response body contains 'data.user.email' as a valid email format

Best Practices:

Use Postman's built-in pm.response and pm.expect for assertions

Validate response status before checking body

Use JSON parsing safely

Keep test scripts clear and maintainable

Automated Solution

Postman

pm.test('Status code is 200', () => {
    pm.response.to.have.status(200);
});

const responseJson = pm.response.json();

pm.test('User id is 1', () => {
    pm.expect(responseJson).to.have.nested.property('data.user.id', '1');
});

pm.test('User name is a non-empty string', () => {
    pm.expect(responseJson.data.user.name).to.be.a('string').and.not.empty;
});

pm.test('User email is valid format', () => {
    const email = responseJson.data.user.email;
    pm.expect(email).to.be.a('string').and.match(/^\S+@\S+\.\S+$/);
});

This test script runs after the GraphQL POST request in Postman.

First, it checks the HTTP status code is 200, meaning the request succeeded.

Then it parses the JSON response body safely.

Next, it verifies the user id is exactly '1' using nested property access.

It confirms the user name is a string and not empty, ensuring valid data.

Finally, it checks the user email matches a simple email pattern to confirm format correctness.

Using pm.expect and pm.test keeps tests clear and easy to maintain.

Common Mistakes - 4 Pitfalls

Not setting the request method to POST

{'mistake': "Entering GraphQL query in raw JSON body instead of using Postman's GraphQL body tab", 'why_bad': 'Postman provides a special GraphQL body tab that formats the request correctly; raw JSON may cause syntax errors.', 'correct_approach': 'Use the GraphQL body tab in Postman to enter queries and variables properly.'}

Not checking the response status code before parsing JSON

{'mistake': 'Using incorrect or brittle JSON path to access response data', 'why_bad': 'Incorrect paths cause tests to fail even if the response is correct; brittle paths break easily with API changes.', 'correct_approach': "Use nested property assertions like pm.expect(responseJson).to.have.nested.property('data.user.id') for reliable access."}

Bonus Challenge

Now add data-driven testing with 3 different user IDs (e.g., '1', '2', '3') to verify the API returns correct user data for each.

Show Hint

Practice

1. What is the main purpose of the query field in a GraphQL body when testing with Postman?

easy

A. To list all available API endpoints

B. To define the HTTP headers for the request

C. To set the URL of the GraphQL endpoint

D. To specify the exact data you want to fetch or mutate from the API

Solution

1. Step 1: Understand the role of the query field

   The query field contains the GraphQL query or mutation string that tells the API exactly what data to return or change.

2. Step 2: Differentiate from other request parts

   Headers and URLs are set elsewhere in Postman; the query field is specifically for the GraphQL operation.

3. Final Answer:

   To specify the exact data you want to fetch or mutate from the API -> Option D

4. Quick Check:

   GraphQL query = data request [OK]

Hint: Remember: query means what data you want [OK]

Common Mistakes:

• Confusing query with HTTP headers
• Trying to put URL or endpoint inside query
• Leaving query empty or missing

2. Which of the following is the correct minimal structure of a GraphQL body in Postman?

easy

A. { "query": "{ user { id name } }" }

B. { "url": "https://api.example.com/graphql" }

C. { "headers": { "Content-Type": "application/json" } }

D. { "variables": { "id": 1 } }

Solution

1. Step 1: Identify the required fields in a GraphQL body

   The minimal GraphQL body must have a query field with a valid query string.

2. Step 2: Check each option

   { "query": "{ user { id name } }" } correctly shows a JSON object with a query string. The structures with "url" and "headers" are for other parts of the Postman request, not the body. { "variables": { "id": 1 } } only has variables without a query, which is invalid.

3. Final Answer:

   { "query": "{ user { id name } }" } -> Option A

4. Quick Check:

   GraphQL body needs query string [OK]

Hint: GraphQL body always needs a query string [OK]

Common Mistakes:

• Putting URL or headers inside the GraphQL body
• Sending variables without a query
• Using invalid JSON format

3. Given this GraphQL body in Postman:

{
  "query": "query getUser($id: ID!) { user(id: $id) { name email } }",
  "variables": { "id": "123" }
}

What data will the API return if user 123 exists?

medium

A. Only the user's ID

B. The user's name and email fields

C. An error because variables are not allowed

D. All users' names and emails

Solution

1. Step 1: Understand the query and variables

   The query requests name and email of a user with a specific id passed as a variable.

2. Step 2: Interpret the expected response

   Since id is set to "123", the API will return the name and email of user 123 if they exist.

3. Final Answer:

   The user's name and email fields -> Option B

4. Quick Check:

   Variables filter data = user 123 info [OK]

Hint: Variables customize queries to fetch specific data [OK]

Common Mistakes:

• Ignoring variables and expecting all users
• Thinking variables cause errors in GraphQL
• Expecting ID field in response without requesting it

4. You send this GraphQL body in Postman:

{
  "query": "query getUser($id: ID!) { user(id: $id) { name email } }"
}

The API returns an error about missing variables. What is the fix?

medium

A. Add a variables field with the required id value

B. Remove the $id variable from the query

C. Change the query to a mutation

D. Add HTTP headers for authentication

Solution

1. Step 1: Identify the cause of the error

   The query requires a variable $id but no variables field was sent, so the API complains about missing input.

2. Step 2: Fix by adding variables

   Include a variables JSON object with the id value, e.g., { "id": "123" }, to satisfy the query requirement.

3. Final Answer:

   Add a variables field with the required id value -> Option A

4. Quick Check:

   Variables must match query parameters [OK]

Hint: Always send variables if query requires them [OK]

Common Mistakes:

• Forgetting to send variables when query uses them
• Trying to remove variables from query without adjusting logic
• Assuming authentication fixes variable errors

5. You want to test a GraphQL mutation to update a user's email using variables in Postman. Which GraphQL body correctly uses variables for this mutation?

hard

A. { "query": "mutation updateUser { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": 456, "email": "[e-mail]" } }

B. { "query": "mutation { updateUser(id: 456, email: \"[e-mail]\") { id email } }" }

C. { "query": "mutation updateUser($id: ID!, $email: String!) { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": "456", "email": "[e-mail]" } }

D. { "query": "mutation updateUser($id, $email) { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": "456", "email": "[e-mail]" } }

Solution

1. Step 1: Check variable declarations in mutation

   Variables must be declared with types and exclamation marks for required fields, e.g., $id: ID!, $email: String!.

2. Step 2: Verify variables usage and JSON format

   { "query": "mutation updateUser($id: ID!, $email: String!) { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": "456", "email": "[e-mail]" } } correctly declares variables with types and passes matching variables in JSON. { "query": "mutation { updateUser(id: 456, email: \"[e-mail]\") { id email } }" } hardcodes values without variables. { "query": "mutation updateUser { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": 456, "email": "[e-mail]" } } misses variable types. { "query": "mutation updateUser($id, $email) { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": "456", "email": "[e-mail]" } } misses exclamation marks in variable types.

3. Final Answer:

   { "query": "mutation updateUser($id: ID!, $email: String!) { updateUser(id: $id, email: $email) { id email } }", "variables": { "id": "456", "email": "[e-mail]" } } -> Option C

4. Quick Check:

   Declare variables with types and pass matching values [OK]

Hint: Declare variables with types and pass matching JSON values [OK]

Common Mistakes:

• Omitting variable types or exclamation marks
• Using variables without declaring them
• Hardcoding values instead of using variables