DEV Community

Cover image for Still Testing APIs Like It's 2022? Here's Everything That Changed"
Imran Al Munyeem
Imran Al Munyeem

Posted on • Originally published at imranalmunyeem.github.io

Still Testing APIs Like It's 2022? Here's Everything That Changed"

#ai #testing #postmanapi #qa

If you learnt Postman a few years ago and have been coasting on that knowledge, an uncomfortable amount of it is now wrong — not "slightly dated" wrong, but "the tab you're looking for doesn't exist" wrong.

I know because I wrote a Postman guide in 2022 and recently rewrote it as a full book. Here's the changelog of everything that broke, moved, or appeared — the field guide I wish I'd had.

1. The Tests tab is gone

The old Tests and Pre-request Script tabs were merged into a single Scripts tab with two sections: Pre-request (runs before the request) and Post-response (runs after — this is where your tests live now).

Your code is unchanged — same pm.test, same Chai assertions, same snippets — only the geography moved:

// Exactly the same as it ever was, just under Scripts → Post-response
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});
Enter fullscreen mode Exit fullscreen mode

Every tutorial screenshot showing a Tests tab is from the old world. The concepts transfer completely.

2. Newman has an official successor

Newman — the beloved open-source CLI runner — is no longer the only way to run collections from a terminal. The official Postman CLI authenticates with a Postman API key and can run collections straight from your workspace, no export step:

postman login --with-api-key $POSTMAN_API_KEY
postman collection run 12345678-abcd-efgh-ijkl-9876543210ab
Enter fullscreen mode Exit fullscreen mode

It also pushes results back to Postman's cloud as a shareable run report.

Newman still works fine and its htmlextra HTML reports remain unmatched — but there's a hard compatibility line to know: Newman only supports collection format v2/v2.1. Postman v12 introduced a v3 (YAML) format for its Git-native workflows, and Newman cannot run it. New pipeline? Start with the Postman CLI. Existing Newman pipeline? It keeps working — just export v2.1.

3. Your Jenkins tutorial will not work

The classic "install JDK 8, run java -jar jenkins.war" instructions are dead: modern Jenkins requires Java 21 (recent LTS lines dropped Java 17 and older). If you're standing up a CI box today, grab Temurin 21 from adoptium.net first, or Jenkins simply won't start.

Better yet, notice that for many teams the Jenkins box is now optional — a 25-line GitHub Actions workflow runs your collection on every push and every night, with no server to patch:

name: API Tests
on:
  push:
  schedule:
    - cron: "0 2 * * *"
jobs:
  postman-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "lts/*"
      - run: npm install -g newman newman-reporter-htmlextra
      - run: newman run collections/MyCollection.postman_collection.json -r cli,htmlextra
Enter fullscreen mode Exit fullscreen mode

4. There's an AI in the footer

Postbot generates tests from plain-English prompts, adds baseline tests to a whole collection in one action, repairs failing scripts, documents requests, and visualises responses. It's genuinely useful and genuinely dangerous in the same specific way: it writes assertions from the response your API currently gives — so if the current behaviour is a bug, the bug becomes the expected result. Generate freely; review against the spec, not the response. (I wrote a whole piece on this failure mode.)

Postman also added AI request types (test your LLM-backed endpoints like any other), Agent Mode, and an MCP server — the platform is clearly betting that agents will be first-class API consumers.

5. Your practice APIs died

Heroku ended its free tier, taking a generation of tutorial APIs with it. If a guide points you at something.herokuapp.com, expect a dead link. JSONPlaceholder (jsonplaceholder.typicode.com) remains free, signup-less, and reliable — or create a mock server inside Postman itself from your saved examples.

6. The scripting API moved on politely

postman.setNextRequest(null) still works, but the current form is:

pm.execution.setNextRequest(null);   // stop the run
pm.execution.setNextRequest("Delete user");   // or jump to a request
Enter fullscreen mode Exit fullscreen mode

Same story across the pm API: old code keeps running, new code should use the new names.

7. Secrets got first-class treatment

Two things every team should know: variables now have a secret type (masked on screen), and — the one that catches people — initial values sync to Postman's servers and are shared with collaborators, while current values stay on your machine. Real credentials go in current values only, or in Postman Vault (encrypted, local, never synced). The classic leak is a Bearer token pasted into an initial value "just for a second," then synced, then forked into a public workspace.

The takeaway

None of this changed what good API testing is — five layers of assertions, negative cases, deterministic suites, CI enforcement. What changed is the tooling around it, and the tooling changed enough that 2022 muscle memory now produces broken pipelines and missing tabs. Update the muscle memory; keep the principles.

This is the story behind my free, open-source book *API Testing Using Postman: The Practical Guide to Modern API Testing** — a 2022 guide rewritten end-to-end for how we test now. Read online, grab the PDF/EPUB, or contribute on GitHub.*

I'm a PhD researcher in Computer Science at Nottingham Trent University working on cybersecurity and AI-assisted security testing. More at imranalmunyeem.com.

Top comments (0)