Request headers in Postman - Framework Patterns

Framework Mode - Request headers

Folder Structure for Postman Test Collections

Postman-Tests/
├── collections/
│   ├── User-API.postman_collection.json
│   ├── Product-API.postman_collection.json
│   └── Auth-API.postman_collection.json
├── environments/
│   ├── dev.postman_environment.json
│   ├── staging.postman_environment.json
│   └── prod.postman_environment.json
├── globals/
│   └── globals.postman_globals.json
├── scripts/
│   ├── pre-request-scripts.js
│   └── test-scripts.js
└── README.md

Test Framework Layers in Postman

• Collections: Group of API requests organized by feature or service. Each request can have its own headers.
• Environments: Variables for different setups (e.g., dev, staging) including base URLs and tokens.
• Globals: Variables accessible across all collections and environments.
• Pre-request Scripts: JavaScript code run before each request to set or modify headers dynamically.
• Tests: JavaScript assertions run after response to validate results.

Configuration Patterns for Request Headers

• Environment Variables: Store common header values like Authorization tokens or Content-Type to reuse across requests.
• Global Variables: Use for headers that apply to all requests regardless of environment.
• Pre-request Scripts: Dynamically set or update headers before sending requests, e.g., generate fresh tokens.
• Collection-level Headers: Define headers that apply to all requests in a collection to avoid repetition.
• Secure Storage: Keep sensitive header values like API keys in environment variables, not hardcoded in requests.

Test Reporting and CI/CD Integration

• Newman CLI: Run Postman collections from command line with detailed reports in JSON, HTML, or JUnit formats.
• CI/CD Pipelines: Integrate Newman runs in pipelines (e.g., Jenkins, GitHub Actions) to automate API tests on code changes.
• Report Analysis: Use generated reports to track header-related test failures like missing or incorrect headers.
• Notifications: Configure alerts on test failures to quickly fix header or authentication issues.

Best Practices for Request Headers in Postman Framework

• Reuse Headers via Variables: Use environment or global variables for headers to avoid duplication and ease updates.
• Secure Sensitive Data: Never hardcode secrets in headers; use environment variables with restricted access.
• Use Pre-request Scripts: Automate header updates like token refresh to keep tests reliable.
• Organize Collections by Feature: Group requests logically so headers relevant to a feature are managed together.
• Validate Headers in Tests: Write assertions to check if required headers were sent or received correctly.

Self Check Question

Where in this Postman framework structure would you add a new header for API authentication that changes per environment?

Answer: In the environments/ folder, add or update the environment variable (e.g., auth_token) and then reference it in the request headers or pre-request scripts.

Key Result

Organize Postman tests with collections, environments, and scripts to manage request headers efficiently and securely.

Practice

1. What is the main purpose of request headers in Postman API calls?

easy

A. To send extra information like authentication or data format

B. To write the body content of the request

C. To specify the URL of the API endpoint

D. To display the response status code

Solution

1. Step 1: Understand what request headers do

   Request headers add extra info to the API call, such as authentication tokens or content type.

2. Step 2: Differentiate headers from other parts

   Headers are not the body or URL; they are key-value pairs sent with the request.

3. Final Answer:

   To send extra information like authentication or data format -> Option A

4. Quick Check:

   Request headers = extra info [OK]

Hint: Headers add info like auth or format, not body or URL [OK]

Common Mistakes:

• Confusing headers with request body
• Thinking headers specify the URL
• Assuming headers show response info

2. Which of the following is the correct way to add a header named Authorization with value Bearer token123 in Postman?

easy

A. Authorization -> Bearer token123

B. Authorization = Bearer token123

C. Authorization Bearer token123

D. Authorization: Bearer token123

Solution

1. Step 1: Recall header syntax in HTTP

   Headers use a colon ':' to separate key and value, like Key: Value.

2. Step 2: Match the correct syntax

   Authorization: Bearer token123 uses colon correctly; others use wrong separators or miss colon.

3. Final Answer:

   Authorization: Bearer token123 -> Option D

4. Quick Check:

   Headers use colon ':' between key and value [OK]

Hint: Headers use colon ':' between key and value [OK]

Common Mistakes:

• Using '=' instead of ':'
• Omitting colon separator
• Using arrows or spaces only

3. Given this Postman header setup:
Content-Type: application/json
Accept: application/xml
What will the server expect and respond with?

medium

A. Server expects XML data and responds with JSON

B. Server expects JSON data and responds with XML

C. Server expects and responds with JSON

D. Server expects and responds with XML

Solution

1. Step 1: Understand Content-Type header

   Content-Type tells the server the format of data sent by client; here it is JSON.

2. Step 2: Understand Accept header

   Accept tells the server what response format client wants; here it is XML.

3. Final Answer:

   Server expects JSON data and responds with XML -> Option B

4. Quick Check:

   Content-Type = sent format, Accept = response format [OK]

Hint: Content-Type = sent data, Accept = desired response [OK]

Common Mistakes:

• Mixing up Content-Type and Accept meanings
• Assuming both headers mean the same
• Ignoring Accept header

4. You added a header in Postman as Content-Type = application/json but the server returns a 415 Unsupported Media Type error. What is the likely problem?

medium

A. You forgot to add the Authorization header

B. The value 'application/json' is invalid

C. Header syntax is incorrect; should use colon ':' instead of '='

D. The server does not support JSON at all

Solution

1. Step 1: Check header syntax

   Headers must use colon ':' to separate key and value, not '='.

2. Step 2: Understand server error 415

   415 means server rejects media type due to wrong or missing Content-Type header.

3. Final Answer:

   Header syntax is incorrect; should use colon ':' instead of '=' -> Option C

4. Quick Check:

   Wrong header syntax causes 415 error [OK]

Hint: Use ':' not '=' in headers to avoid 415 error [OK]

Common Mistakes:

• Using '=' instead of ':' in headers
• Assuming server rejects JSON always
• Ignoring header syntax errors

5. You want to send a POST request with JSON data and an API key for authentication in Postman. Which header setup is correct?

hard

A. Content-Type: application/json and Authorization: ApiKey 12345

B. Accept: application/json and Authorization: 12345

C. Content-Type: text/plain and ApiKey: 12345

D. Authorization: Bearer 12345 only

Solution

1. Step 1: Identify correct content type for JSON data

   Use Content-Type: application/json to tell server data format sent is JSON.

2. Step 2: Use proper authorization header format

   API keys often use Authorization: ApiKey [key] or similar; here Authorization: ApiKey 12345 is correct.

3. Final Answer:

   Content-Type: application/json and Authorization: ApiKey 12345 -> Option A

4. Quick Check:

   Content-Type + Authorization with correct syntax [OK]

Hint: Use Content-Type for data and Authorization for API key [OK]

Common Mistakes:

• Using wrong Content-Type for JSON
• Putting API key in wrong header
• Omitting Content-Type header