Request headers in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the purpose of request headers

Which of the following best describes the main purpose of HTTP request headers in API testing?

A They carry metadata about the request such as content type, authorization, and caching policies.

B They contain the actual data payload sent to the server in the request body.

C They specify the IP address of the client making the request.

D They define the server's response format and status codes.

💡 Hint

Think about what extra information is sent along with the request but is not the main data.

Request headers provide metadata about the request, such as content type, authorization tokens, and caching instructions. They do not contain the main data payload or server response details.

❓ Predict Output

intermediate

Output of a Postman test script checking a header

Given the following Postman test script, what will be the test result if the response header Content-Type is application/json; charset=utf-8?

Postman

pm.test('Content-Type is application/json', () => {
  pm.response.to.have.header('Content-Type', 'application/json');
});

A Test fails because the header value does not exactly match 'application/json'.

B Test passes because the header contains 'application/json' as part of its value.

C Test fails because the header 'Content-Type' is missing.

D Test passes because Postman ignores charset in header value comparisons.

💡 Hint

Check if the test checks for exact match or partial match of the header value.

The test checks for an exact match of the header value 'application/json'. Since the actual header value includes charset, it does not exactly match, so the test fails.

❓ locator

advanced

Best practice for locating a header in Postman test scripts

Which of the following is the best way to check if the Authorization header exists in a Postman response?

A pm.response.headers.get('Authorization') !== undefined

B pm.response.headers['Authorization'] !== null

C pm.response.headers.find(header => header.key === 'Authorization')

D pm.response.headers.has('Authorization')

💡 Hint

Look for the method designed to check header existence directly.

The has method is the recommended way to check if a header exists in Postman response headers. Other options may cause errors or are less direct.

❓ assertion

advanced

Correct assertion for checking JSON content type header

Which Postman test assertion correctly verifies that the Content-Type header starts with application/json (ignoring charset)?

A pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json');

B pm.expect(pm.response.headers.get('Content-Type')).to.match(/^application\/json/);

C pm.expect(pm.response.headers.get('Content-Type')).to.equal('application/json');

D pm.expect(pm.response.headers.get('Content-Type')).to.be.a('string');

💡 Hint

Think about how to check the start of a string with possible extra text after it.

The match assertion with a regular expression checking the start of the string is the best way to verify the header starts with 'application/json', ignoring charset or other parameters.

❓ framework

expert

Handling dynamic request headers in automated tests

In an automated API test suite using Postman, you need to send a dynamic X-Request-ID header with a unique UUID for each request. Which approach is best to implement this?

A Hardcode a fixed UUID value in the header for all requests to keep tests consistent.

B Add the UUID generation logic in the Tests script after the request is sent.

C Use a Pre-request Script to generate a UUID and set it as an environment variable, then reference it in the header value.

D Manually enter a new UUID value in the Headers tab before each test run.

💡 Hint

Consider when and where to generate dynamic data before sending the request.

Using a Pre-request Script to generate a UUID and store it in an environment variable allows the header to have a unique value each time the request runs. This is the best practice for dynamic headers.

Practice

1. What is the main purpose of request headers in Postman API calls?

easy

A. To send extra information like authentication or data format

B. To write the body content of the request

C. To specify the URL of the API endpoint

D. To display the response status code

Solution

1. Step 1: Understand what request headers do

   Request headers add extra info to the API call, such as authentication tokens or content type.

2. Step 2: Differentiate headers from other parts

   Headers are not the body or URL; they are key-value pairs sent with the request.

3. Final Answer:

   To send extra information like authentication or data format -> Option A

4. Quick Check:

   Request headers = extra info [OK]

Hint: Headers add info like auth or format, not body or URL [OK]

Common Mistakes:

• Confusing headers with request body
• Thinking headers specify the URL
• Assuming headers show response info

2. Which of the following is the correct way to add a header named Authorization with value Bearer token123 in Postman?

easy

A. Authorization -> Bearer token123

B. Authorization = Bearer token123

C. Authorization Bearer token123

D. Authorization: Bearer token123

Solution

1. Step 1: Recall header syntax in HTTP

   Headers use a colon ':' to separate key and value, like Key: Value.

2. Step 2: Match the correct syntax

   Authorization: Bearer token123 uses colon correctly; others use wrong separators or miss colon.

3. Final Answer:

   Authorization: Bearer token123 -> Option D

4. Quick Check:

   Headers use colon ':' between key and value [OK]

Hint: Headers use colon ':' between key and value [OK]

Common Mistakes:

• Using '=' instead of ':'
• Omitting colon separator
• Using arrows or spaces only

3. Given this Postman header setup:
Content-Type: application/json
Accept: application/xml
What will the server expect and respond with?

medium

A. Server expects XML data and responds with JSON

B. Server expects JSON data and responds with XML

C. Server expects and responds with JSON

D. Server expects and responds with XML

Solution

1. Step 1: Understand Content-Type header

   Content-Type tells the server the format of data sent by client; here it is JSON.

2. Step 2: Understand Accept header

   Accept tells the server what response format client wants; here it is XML.

3. Final Answer:

   Server expects JSON data and responds with XML -> Option B

4. Quick Check:

   Content-Type = sent format, Accept = response format [OK]

Hint: Content-Type = sent data, Accept = desired response [OK]

Common Mistakes:

• Mixing up Content-Type and Accept meanings
• Assuming both headers mean the same
• Ignoring Accept header

4. You added a header in Postman as Content-Type = application/json but the server returns a 415 Unsupported Media Type error. What is the likely problem?

medium

A. You forgot to add the Authorization header

B. The value 'application/json' is invalid

C. Header syntax is incorrect; should use colon ':' instead of '='

D. The server does not support JSON at all

Solution

1. Step 1: Check header syntax

   Headers must use colon ':' to separate key and value, not '='.

2. Step 2: Understand server error 415

   415 means server rejects media type due to wrong or missing Content-Type header.

3. Final Answer:

   Header syntax is incorrect; should use colon ':' instead of '=' -> Option C

4. Quick Check:

   Wrong header syntax causes 415 error [OK]

Hint: Use ':' not '=' in headers to avoid 415 error [OK]

Common Mistakes:

• Using '=' instead of ':' in headers
• Assuming server rejects JSON always
• Ignoring header syntax errors

5. You want to send a POST request with JSON data and an API key for authentication in Postman. Which header setup is correct?

hard

A. Content-Type: application/json and Authorization: ApiKey 12345

B. Accept: application/json and Authorization: 12345

C. Content-Type: text/plain and ApiKey: 12345

D. Authorization: Bearer 12345 only

Solution

1. Step 1: Identify correct content type for JSON data

   Use Content-Type: application/json to tell server data format sent is JSON.

2. Step 2: Use proper authorization header format

   API keys often use Authorization: ApiKey [key] or similar; here Authorization: ApiKey 12345 is correct.

3. Final Answer:

   Content-Type: application/json and Authorization: ApiKey 12345 -> Option A

4. Quick Check:

   Content-Type + Authorization with correct syntax [OK]

Hint: Use Content-Type for data and Authorization for API key [OK]

Common Mistakes:

• Using wrong Content-Type for JSON
• Putting API key in wrong header
• Omitting Content-Type header