The HTTP Mental Model & Your First Postman Collection

The idea, in one line

An API request is a message you send to a server, and the response is its reply. Your job is to check the reply is the one you expected.

The methods — what you're asking for

Each method names your intent. There are five you'll meet constantly:

• GET — read something
• POST — create something new
• PUT — replace a whole resource
• PATCH — update just part of a resource
• DELETE — remove a resource

Two words about those methods come up a lot. Safe means the request changes nothing on the server — GET is safe. Idempotent is a big word for a simple idea: sending it twice leaves the server in the same state as sending it once. GET, PUT and DELETE are idempotent; POST and PATCH are not. That's exactly why a POST that gets retried can create a duplicate — a classic bug to go hunting for.

The status codes — what came back

The response arrives with a number that tells you how it went. They group into families:

• 2xx = it worked — 200 OK, 201 Created, 204 No Content
• 4xx = your request was wrong — 400 bad body, 401 no auth, 403 forbidden, 404 missing, 409 conflict
• 5xx = the server broke — 500 and friends

Responses also carry headers — small labels of metadata, like Content-Type (what format the body is) and Authorization (who's asking).

See it work

Start in Postman, a friendly app for sending requests by hand. In each request's Tests tab you write a little JavaScript that runs after the reply arrives and checks it.

// Postman Tests tab: this JS runs after the response arrives.
// POST /posts -> create a record, then save its new id.

pm.test("status is 201 Created", function () {
    pm.response.to.have.status(201);
});

pm.test("body echoes what we sent", function () {
    const body = pm.response.json();
    pm.expect(body.title).to.eql("smoke test");
});

// Save the new id so later requests can reuse it.
pm.environment.set("post_id", pm.response.json().id);
// base_url also lives in the environment: {{base_url}}/posts

Read it top to bottom: you checked the status was 201, checked the reply contained what you sent, then stashed the new id. Nothing more mysterious than that.

Advanced — why an environment matters

An environment is a small bag of saved values, like the base URL and your token. Because your requests read from the bag instead of hard-coding those values, the exact same collection can run against a dev server today and a prod server tomorrow — you just swap the bag. That reuse is what turns a pile of requests into a proper suite.

Grounded in the MDN HTTP methods reference and Postman Learning Center (Writing tests)