Request headers in Postman - Build an Automation Script

Verify custom request headers are sent and received correctly

Preconditions (2)

Step 1: Open Postman and create a new GET request

Step 2: Set the request URL to https://postman-echo.com/headers

Step 3: Add a custom header with key 'X-Test-Header' and value 'TestValue123'

Step 4: Send the request

Step 5: Observe the response body for the headers returned

✅ Expected Result: The response body contains the header 'X-Test-Header' with value 'TestValue123'

Automation Requirements - Postman/Newman

Assertions Needed:

Verify response status code is 200

Verify response JSON contains 'X-Test-Header' with value 'TestValue123'

Best Practices:

Use Postman test scripts to assert response values

Use environment variables for header values if needed

Keep tests independent and idempotent

Automated Solution

Postman

pm.test('Status code is 200', function () {
    pm.response.to.have.status(200);
});

pm.test('Response contains custom header', function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData.headers['x-test-header']).to.eql('TestValue123');
});

The first test checks that the HTTP status code returned is 200, meaning the request was successful.

The second test parses the JSON response body and verifies that the custom header 'X-Test-Header' is present with the exact value 'TestValue123'.

This ensures the header was sent and received correctly by the API.

Common Mistakes - 3 Pitfalls

{'mistake': 'Not setting the header key with correct casing', 'why_bad': 'Headers are case-insensitive but the API might return them in lowercase, causing assertion failures if case is mismatched.', 'correct_approach': "Use lowercase keys when accessing headers in response JSON, e.g., 'x-test-header'."}

Not checking the response status code before asserting header values

Hardcoding header values in multiple places

Bonus Challenge

Now add data-driven testing with 3 different custom header values

Show Hint

Practice

1. What is the main purpose of request headers in Postman API calls?

easy

A. To send extra information like authentication or data format

B. To write the body content of the request

C. To specify the URL of the API endpoint

D. To display the response status code

Solution

1. Step 1: Understand what request headers do

   Request headers add extra info to the API call, such as authentication tokens or content type.

2. Step 2: Differentiate headers from other parts

   Headers are not the body or URL; they are key-value pairs sent with the request.

3. Final Answer:

   To send extra information like authentication or data format -> Option A

4. Quick Check:

   Request headers = extra info [OK]

Hint: Headers add info like auth or format, not body or URL [OK]

Common Mistakes:

• Confusing headers with request body
• Thinking headers specify the URL
• Assuming headers show response info

2. Which of the following is the correct way to add a header named Authorization with value Bearer token123 in Postman?

easy

A. Authorization -> Bearer token123

B. Authorization = Bearer token123

C. Authorization Bearer token123

D. Authorization: Bearer token123

Solution

1. Step 1: Recall header syntax in HTTP

   Headers use a colon ':' to separate key and value, like Key: Value.

2. Step 2: Match the correct syntax

   Authorization: Bearer token123 uses colon correctly; others use wrong separators or miss colon.

3. Final Answer:

   Authorization: Bearer token123 -> Option D

4. Quick Check:

   Headers use colon ':' between key and value [OK]

Hint: Headers use colon ':' between key and value [OK]

Common Mistakes:

• Using '=' instead of ':'
• Omitting colon separator
• Using arrows or spaces only

3. Given this Postman header setup:
Content-Type: application/json
Accept: application/xml
What will the server expect and respond with?

medium

A. Server expects XML data and responds with JSON

B. Server expects JSON data and responds with XML

C. Server expects and responds with JSON

D. Server expects and responds with XML

Solution

1. Step 1: Understand Content-Type header

   Content-Type tells the server the format of data sent by client; here it is JSON.

2. Step 2: Understand Accept header

   Accept tells the server what response format client wants; here it is XML.

3. Final Answer:

   Server expects JSON data and responds with XML -> Option B

4. Quick Check:

   Content-Type = sent format, Accept = response format [OK]

Hint: Content-Type = sent data, Accept = desired response [OK]

Common Mistakes:

• Mixing up Content-Type and Accept meanings
• Assuming both headers mean the same
• Ignoring Accept header

4. You added a header in Postman as Content-Type = application/json but the server returns a 415 Unsupported Media Type error. What is the likely problem?

medium

A. You forgot to add the Authorization header

B. The value 'application/json' is invalid

C. Header syntax is incorrect; should use colon ':' instead of '='

D. The server does not support JSON at all

Solution

1. Step 1: Check header syntax

   Headers must use colon ':' to separate key and value, not '='.

2. Step 2: Understand server error 415

   415 means server rejects media type due to wrong or missing Content-Type header.

3. Final Answer:

   Header syntax is incorrect; should use colon ':' instead of '=' -> Option C

4. Quick Check:

   Wrong header syntax causes 415 error [OK]

Hint: Use ':' not '=' in headers to avoid 415 error [OK]

Common Mistakes:

• Using '=' instead of ':' in headers
• Assuming server rejects JSON always
• Ignoring header syntax errors

5. You want to send a POST request with JSON data and an API key for authentication in Postman. Which header setup is correct?

hard

A. Content-Type: application/json and Authorization: ApiKey 12345

B. Accept: application/json and Authorization: 12345

C. Content-Type: text/plain and ApiKey: 12345

D. Authorization: Bearer 12345 only

Solution

1. Step 1: Identify correct content type for JSON data

   Use Content-Type: application/json to tell server data format sent is JSON.

2. Step 2: Use proper authorization header format

   API keys often use Authorization: ApiKey [key] or similar; here Authorization: ApiKey 12345 is correct.

3. Final Answer:

   Content-Type: application/json and Authorization: ApiKey 12345 -> Option A

4. Quick Check:

   Content-Type + Authorization with correct syntax [OK]

Hint: Use Content-Type for data and Authorization for API key [OK]

Common Mistakes:

• Using wrong Content-Type for JSON
• Putting API key in wrong header
• Omitting Content-Type header