Postman is an API platform for designing, sending, documenting and testing HTTP requests. Its object model is small and everything else builds on it: a request carries a method, URL, headers, body and authorisation; requests are organised into collections and folders; variables resolve from a layered set of scopes; and each request can run a pre-request script before it is sent and a test script after the response arrives. Those scripts execute in a JavaScript sandbox with the pm API, so `pm.test`, `pm.expect`, `pm.response` and the variable setters turn what looks like a manual request tool into an executable regression suite.
The features that matter in a real team sit around that core. Environments hold per-stage configuration so the same collection runs against local, staging and production. The Collection Runner executes an ordered set of requests, optionally iterating over a CSV or JSON data file, which is how a single request becomes a data-driven test. Authorisation helpers cover Basic, Bearer, API key, OAuth 2.0 and AWS Signature so token acquisition stops being hand-rolled. Mock servers return example responses before a backend exists, monitors run a collection on a schedule from Postman's infrastructure, and OpenAPI import keeps a collection aligned with a specification instead of drifting from it.
Newman is what makes Postman a pipeline tool rather than a desktop one. It is the command line collection runner: the same collection, environment and data file executed in CI, emitting JUnit XML, HTML or JSON reports that a build system can gate on. That is also where Postman's main failure mode shows up — collections that live only in a shared workspace become untracked shared state, and exported environments leak secrets into version control. The disciplined pattern is to keep collections in Git, keep secrets out of them, and run them with Newman on every build.
Why this skill matters now
Almost every system is now assembled from APIs, and the API layer is where integration defects actually live. Contracts change, a field becomes nullable, a status code changes from 200 to 202, an authorisation scope is tightened — and none of it is visible from a user interface test until something downstream breaks in production.
API testing is also the highest-leverage layer in a test suite. An API test runs in milliseconds where a browser test takes seconds, it is deterministic where a UI test is timing-dependent, and it localises failure to a single endpoint. Teams that move checks down from the browser layer to the API layer routinely cut pipeline time by an order of magnitude while catching more, and Postman is the shortest path there because the same tool used to explore an endpoint by hand produces the automated test.
The demand is for the engineering half rather than the clicking half. Sending a request is not a skill. Designing a collection that runs unattended across four environments, chaining authentication and resource creation through variables, asserting against a JSON schema rather than a hard-coded string, keeping secrets out of exported files, and running the whole thing in a pipeline with reports a build can fail on — that is what organisations are hiring and training for.