x-www-form-urlencoded body in Postman - Build an Automation Script

Verify API accepts x-www-form-urlencoded body and returns success

Preconditions (2)

Step 1: Open Postman and create a new POST request

Step 2: Set the request URL to 'https://api.example.com/login'

Step 3: Select the 'Body' tab

Step 4: Choose 'x-www-form-urlencoded' as the body type

Step 5: Add key 'username' with value 'testuser'

Step 6: Add key 'password' with value 'Test@1234'

Step 7: Click 'Send' to submit the request

✅ Expected Result: Response status code is 200 and response body contains JSON with key 'message' and value 'Login successful'

Automation Requirements - Postman/Newman

Assertions Needed:

Verify response status code is 200

Verify response body contains JSON key 'message' with value 'Login successful'

Best Practices:

Use Postman tests tab to write assertions

Use environment variables for endpoint URLs

Avoid hardcoding sensitive data in scripts

Validate both status code and response body content

Automated Solution

Postman

pm.test('Status code is 200', function () {
    pm.response.to.have.status(200);
});

pm.test('Response has success message', function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.have.property('message', 'Login successful');
});

The first test checks that the HTTP status code returned by the API is 200, which means the request was successful.

The second test parses the response body as JSON and verifies that it contains a key named 'message' with the exact value 'Login successful'.

These tests ensure the API correctly processes the x-www-form-urlencoded body and returns the expected success response.

Common Mistakes - 3 Pitfalls

{'mistake': 'Not setting the body type to x-www-form-urlencoded', 'why_bad': 'The API expects data in this format; sending JSON or raw text will cause the request to fail or be rejected.', 'correct_approach': "Always select 'x-www-form-urlencoded' in Postman body tab when required by the API."}

Hardcoding sensitive data like passwords directly in the test scripts

Only checking status code without verifying response content

Bonus Challenge

Now add data-driven testing with 3 different username and password combinations

Show Hint

Practice

1. What does the x-www-form-urlencoded body type do in Postman?

easy

A. Sends data as plain text without encoding

B. Sends data as a JSON object in the request body

C. Uploads files as binary data

D. Sends form data as key-value pairs joined by '&' in the request body

Solution

1. Step 1: Understand the body type purpose

   x-www-form-urlencoded sends form data as key-value pairs joined by '&' in the request body, similar to how HTML forms send data.

2. Step 2: Compare with other body types

   JSON body sends data as JSON, binary uploads files, and plain text sends raw text. Only x-www-form-urlencoded uses key-value pairs joined by '&'.

3. Final Answer:

   Sends form data as key-value pairs joined by '&' in the request body -> Option D

4. Quick Check:

   Form data = key-value pairs & joined by '&' [OK]

Hint: Remember: form data uses key=value pairs joined by & [OK]

Common Mistakes:

• Confusing x-www-form-urlencoded with JSON body
• Thinking it uploads files
• Assuming it sends raw text without encoding

2. Which of the following is the correct way to set a key-value pair in Postman's x-www-form-urlencoded body tab?

easy

A. key: value

B. key=value

C. key and value in separate columns

D. JSON format like {"key":"value"}

Solution

1. Step 1: Check Postman UI for x-www-form-urlencoded

   In Postman, the x-www-form-urlencoded body tab shows two columns: one for keys and one for values.

2. Step 2: Understand correct input format

   You enter keys and values separately in these columns; Postman encodes them automatically as key=value pairs joined by '&'.

3. Final Answer:

   key and value in separate columns -> Option C

4. Quick Check:

   Separate columns = correct input method [OK]

Hint: Use separate key and value columns in Postman body tab [OK]

Common Mistakes:

• Typing key and value together with ':' or '=' manually
• Trying to enter JSON in x-www-form-urlencoded tab
• Not using the provided columns for input

3. Given the following key-value pairs in Postman's x-www-form-urlencoded body:
username: user1
password: pass@123
What will be the encoded request body sent?

medium

A. username=user1&password=pass%40123

B. username=user1,password=pass@123

C. {"username":"user1","password":"pass@123"}

D. username:user1&password:pass@123

Solution

1. Step 1: Understand URL encoding in x-www-form-urlencoded

   Special characters like '@' are percent-encoded. '@' becomes '%40'. Keys and values are joined by '=', pairs joined by '&'.

2. Step 2: Apply encoding to given data

   username=user1 (no special chars), password=pass@123 becomes password=pass%40123. Joined as username=user1&password=pass%40123.

3. Final Answer:

   username=user1&password=pass%40123 -> Option A

4. Quick Check:

   Special chars encoded, pairs joined by & [OK]

Hint: Encode special chars like '@' as %40 in form data [OK]

Common Mistakes:

• Not encoding special characters
• Using JSON format instead of form encoding
• Using commas or colons instead of & and =

4. You set the x-www-form-urlencoded body in Postman with keys and values, but the server responds with a 400 Bad Request error. What is the most likely cause?

medium

A. You forgot to set the Content-Type header to application/x-www-form-urlencoded

B. You used JSON format in the body tab

C. You entered keys and values in separate columns

D. You used GET method instead of POST

Solution

1. Step 1: Check Content-Type header requirement

   When sending x-www-form-urlencoded data, the Content-Type header must be set to application/x-www-form-urlencoded so the server knows how to parse the body.

2. Step 2: Analyze common mistakes

   Using JSON format or entering keys correctly is fine if Content-Type is correct. Using GET method sends no body. The most common cause is missing or wrong Content-Type header.

3. Final Answer:

   You forgot to set the Content-Type header to application/x-www-form-urlencoded -> Option A

4. Quick Check:

   Content-Type header missing = 400 error [OK]

Hint: Always set Content-Type header for form data [OK]

Common Mistakes:

• Not setting Content-Type header
• Using wrong HTTP method
• Entering data in wrong format

5. You want to send a login request using x-www-form-urlencoded body in Postman with keys username and password. The password contains spaces and special characters like pass word@123!. How should you prepare the body to ensure the server receives it correctly?

hard

A. Manually replace spaces with '%20' and special chars with percent codes before entering

B. Enter keys and values normally; Postman will encode spaces as '+' and special chars automatically

C. Use JSON body instead to avoid encoding issues

D. Replace spaces with underscores and remove special characters manually

Solution

1. Step 1: Understand Postman's encoding behavior

   Postman automatically encodes spaces as '+' and special characters as percent-encoded values when using x-www-form-urlencoded body type.

2. Step 2: Avoid manual encoding

   Manually encoding or altering the data can cause errors or double encoding. Using JSON body changes the content type and server parsing. Replacing characters manually is error-prone.

3. Final Answer:

   Enter keys and values normally; Postman will encode spaces as '+' and special chars automatically -> Option B

4. Quick Check:

   Postman auto-encodes form data correctly [OK]

Hint: Let Postman handle encoding; enter raw values normally [OK]

Common Mistakes:

• Manually encoding values causing double encoding
• Switching to JSON body unnecessarily
• Altering data by removing or replacing characters