Postman

What it does

Postman is a desktop API client that turns ad-hoc request testing into a repeatable workflow. It sends HTTP, GraphQL, WebSocket and gRPC requests, stores them in collections that can be organised into folders and shared, and lets each request carry pre-request scripts, test assertions and environment variables. Responses are inspected with syntax-highlighted bodies, a cookie and header view, timing breakdowns and a console that shows the exact bytes sent. Around that core it adds mock servers, documentation generation, monitors that run collections on a schedule, and a code snippet generator that emits the same request for a dozen languages and libraries, which is useful when the goal is to hand working code to a teammate.

The workflow

A typical session begins by creating a workspace, then a collection for the service under test. Environments hold base URLs, tokens and identifiers so the same request can run against local, staging and production targets without editing. Authentication is configured once per collection with inheritance, and secrets can be stored as variables marked secret so they do not appear in exports. Tests written in JavaScript assert on status codes, response schema and timing, and those assertions run again during collection runs and monitors. Collections can be exported as JSON for version control, and the built-in runner reports pass and fail counts per request.

Practical settings and limits

The free tier is genuinely usable for individual work and small teams, but it is account-based: signing in is expected, and collaboration, cloud sync and shared workspaces depend on Postman's servers. Local scratch pads exist for offline or confidential requests, at the cost of losing sync features. The application is Electron-based and idle memory use is noticeable. Postman also collects usage analytics, which can be disabled in settings but is on by default, and some organisations restrict the desktop client for that reason. Large collections become slow to search, and scripting runs inside a restricted sandbox with its own library set rather than full Node.js.

Who should choose something else

Bruno and Insomnia keep requests as plain files on disk and avoid mandatory accounts, which suits teams that want API definitions under Git review. HTTPie and curl are the right answer for scripted, one-shot requests and CI checks. For load testing or protocol simulation beyond request-and-response, a dedicated tool is a better fit than stretching an interactive client.