Testing Your REST API Thoroughly with Postman

Building an API and testing it thoroughly are equally important. An API that works in one scenario but fails silently in another is worse than useless — it erodes trust and creates hard-to-debug problems in the React frontend. Postman is the tool that closes this gap. In this lesson you will build a complete Postman collection for the MERN Blog API — covering all endpoints, all edge cases, success paths and failure paths, with environment variables for effortless switching between development and production, and automated test scripts that verify your API’s correctness in one click.

Why Thorough API Testing Matters Before Building the Frontend #

Setting Up the Postman Environment #

Create Environment: "MERN Blog — Development"

Variables:
  baseUrl    → http://localhost:5000/api    (initial value)
  authToken  → (empty — set automatically after login)
  userId     → (empty — set after registration)
  postId     → (empty — set after creating a post)

Create Environment: "MERN Blog — Production"

Variables:
  baseUrl    → https://your-api.render.com/api
  authToken  → (empty)
  userId     → (empty)
  postId     → (empty)

Switching environments:
  Top-right dropdown in Postman → select "MERN Blog — Development"
  All {{baseUrl}} references resolve to http://localhost:5000/api
  One click to switch to Production — all URLs update automatically

Collection Structure #

MERN Blog API/
├── Auth/
│   ├── Register — POST {{baseUrl}}/auth/register
│   ├── Login   — POST {{baseUrl}}/auth/login       ← auto-saves token
│   ├── Get Me  — GET  {{baseUrl}}/auth/me
│   └── Logout  — POST {{baseUrl}}/auth/logout
├── Posts/
│   ├── Get All Posts      — GET    {{baseUrl}}/posts
│   ├── Get All (filtered) — GET    {{baseUrl}}/posts?tag=mern&page=1&limit=5
│   ├── Get Post by ID     — GET    {{baseUrl}}/posts/{{postId}}
│   ├── Create Post        — POST   {{baseUrl}}/posts
│   ├── Update Post        — PATCH  {{baseUrl}}/posts/{{postId}}
│   └── Delete Post        — DELETE {{baseUrl}}/posts/{{postId}}
├── Posts — Error Cases/
│   ├── Get Post — Invalid ID format
│   ├── Get Post — Non-existent ID
│   ├── Create Post — Missing title
│   ├── Create Post — No auth token
│   ├── Delete Post — Not owner
│   └── Update Post — Expired token
└── Users/
    ├── Get User Profile — GET   {{baseUrl}}/users/{{userId}}
    └── Update Profile  — PATCH {{baseUrl}}/users/{{userId}}

Auto-Setting the Auth Token After Login #

// Postman → Login request → Scripts tab → Post-response tab
// Paste this script — it runs automatically after every login response

const response = pm.response.json();

if (response.success && response.token) {
  pm.environment.set('authToken', response.token);
  pm.environment.set('userId',    response.data._id);
  console.log('Token saved to environment variable authToken');
} else {
  console.warn('Login failed — token not saved:', response.message);
}

// Now in every protected request, set the Authorization header to:
// Bearer {{authToken}}
// Postman replaces {{authToken}} with the saved token automatically

Auto-Setting postId After Creating a Post #

// Postman → Create Post request → Scripts → Post-response
const response = pm.response.json();

if (response.success && response.data._id) {
  pm.environment.set('postId', response.data._id);
  console.log('Post ID saved:', response.data._id);
}

Writing Test Scripts #

// Postman → Any request → Scripts → Post-response tab
// Tests run automatically after every request when using Collection Runner

// ── Test: successful POST /auth/login ──────────────────────────────────────
pm.test('Status is 200', () => {
  pm.response.to.have.status(200);
});

pm.test('Response has success: true', () => {
  const json = pm.response.json();
  pm.expect(json.success).to.be.true;
});

pm.test('Response contains token', () => {
  const json = pm.response.json();
  pm.expect(json.token).to.be.a('string');
  pm.expect(json.token.length).to.be.above(10);
});

pm.test('Response time under 500ms', () => {
  pm.expect(pm.response.responseTime).to.be.below(500);
});

// ── Test: GET /api/posts — paginated list ──────────────────────────────────
pm.test('Status is 200', () => pm.response.to.have.status(200));

pm.test('Response shape is correct', () => {
  const json = pm.response.json();
  pm.expect(json).to.have.property('success', true);
  pm.expect(json).to.have.property('count');
  pm.expect(json).to.have.property('total');
  pm.expect(json).to.have.property('page');
  pm.expect(json).to.have.property('pages');
  pm.expect(json.data).to.be.an('array');
});

// ── Test: GET /api/posts/invalid-id — 400 bad request ─────────────────────
pm.test('Status is 400 for invalid ID', () => {
  pm.response.to.have.status(400);
});

pm.test('Error response shape', () => {
  const json = pm.response.json();
  pm.expect(json.success).to.be.false;
  pm.expect(json.message).to.be.a('string');
});

// ── Test: DELETE without auth — 401 ───────────────────────────────────────
pm.test('Status is 401 without token', () => {
  pm.response.to.have.status(401);
});

Running the Full Test Suite #

Method 1 — Postman Collection Runner (GUI):
  1. Click the "▶" button next to your collection name
  2. Select environment: "MERN Blog — Development"
  3. Click "Run MERN Blog API"
  4. Postman runs all requests in order
  5. Green = test passed, Red = test failed
  6. Summary shows pass/fail count and any failed assertions

Method 2 — Newman (CLI — for CI/CD):
  npm install -g newman

  # Export collection from Postman: Collection → ... → Export → v2.1
  # Export environment: Environments → ... → Export

  newman run "MERN Blog API.postman_collection.json" \
    --environment "MERN Blog — Development.postman_environment.json" \
    --reporters cli,json \
    --reporter-json-export results.json

  # Exit code 0 = all tests passed, 1 = failures
  # Use in GitHub Actions CI to block merges if API tests fail

Common Mistakes #

Mistake 1 — Only testing the happy path #

❌ Wrong — testing only successful requests:

POST /api/posts with valid body → 201 ✓ (only test)
// Missing: what about missing title? invalid ID? no auth? wrong role?

✅ Correct — for every endpoint test at least: success case, missing auth, validation failure, and resource not found.

Mistake 2 — Hardcoding tokens and IDs in requests #

❌ Wrong — copying a JWT token directly into the Authorization header value:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
// Token expires → every request fails → manually copy new token → tedious

✅ Correct — use environment variables and the post-login script to auto-update the token.

Mistake 3 — Not testing with multiple user roles #

❌ Wrong — only testing as an admin user who can do everything:

All tests pass as admin... but regular users can also delete any post!
→ The authorisation bug is never caught because tests only run as admin

✅ Correct — create separate environments or variables for admin, regular user, and no-auth states. Test ownership checks by logging in as user A and trying to delete user B’s post.

Quick Reference #