Rate limit testing in Postman

Introduction

Rate limit testing checks if a system stops too many requests in a short time. This helps keep the system safe and fair for everyone.

When you want to protect an API from too many requests that can slow it down.

When you want to make sure users cannot overload a service by sending too many requests quickly.

When you want to test if the system shows a proper error message after too many requests.

When you want to check if the system blocks requests after a limit is reached.

When you want to verify that the system resets the limit after some time.

Syntax

Postman

1. Create a new Postman collection.
2. Add a request to the collection with the API endpoint.
3. Use the 'Pre-request Script' tab to write a loop or use Postman Runner to send multiple requests.
4. Check the response status code and body for rate limit messages (e.g., 429 Too Many Requests).
5. Use tests tab to add assertions like pm.response.code === 429.

Postman does not have built-in rate limit testing, so you simulate it by sending many requests quickly.

Look for HTTP status code 429 which means 'Too Many Requests'.

Examples

This script sends 5 requests before the main request runs. It helps simulate multiple calls quickly.

Postman

// Pre-request Script example to send 5 requests
for (let i = 0; i < 5; i++) {
  pm.sendRequest(pm.request, function (err, res) {
    console.log(`Request ${i + 1} status: ${res.status}`);
  });
}

This test checks if the response is either success (200) or rate limited (429). If rate limited, it checks the message.

Postman

// Test script to check rate limit response
pm.test('Check if rate limited', function () {
  pm.expect(pm.response.code).to.be.oneOf([200, 429]);
  if(pm.response.code === 429) {
    pm.expect(pm.response.json().message).to.include('rate limit');
  }
});

Sample Program

This Postman test sends 10 quick requests to the API. It checks if the server allows the requests or blocks them with a rate limit error.

Postman

POST https://api.example.com/data

// Pre-request Script
for (let i = 0; i < 10; i++) {
  pm.sendRequest(pm.request, function (err, res) {
    console.log(`Request ${i + 1} status: ${res.status}`);
  });
}

// Tests
pm.test('Status code is 200 or 429', function () {
  pm.expect(pm.response.code).to.be.oneOf([200, 429]);
});

pm.test('If rate limited, message contains "rate limit"', function () {
  if(pm.response.code === 429) {
    pm.expect(pm.response.json().message.toLowerCase()).to.include('rate limit');
  }
});

Important Notes

Rate limit errors usually return HTTP status 429.

Use Postman Runner to send many requests easily.

Check API documentation for exact rate limit rules.

Summary

Rate limit testing ensures the system blocks too many requests.

Use Postman to send multiple requests quickly and check responses.

Look for status code 429 and proper error messages.