Stop 13 · Testing the Full StackTopics · 4/6

API Testing

Part of the Full Stack Developer Roadmap

In short

Clicking Send in Postman is fine while you build. But who re-checks all 40 requests after every deploy? Newman runs your Postman collection from the command line, so CI does it for you.

Testing your backend's API directly, independent of any frontend — using Supertest or Postman/Newman to verify every endpoint behaves correctly.

The blob character walks a corridor at night with a torch and a clipboard.

Think of it like this

The night guard's round

A society night guard walks the same route every night with a torch and a checklist: gate locked, lift working, tank lights off. He doesn't wait for a complaint. Newman is that nightly round for your API: the same requests and checks, every time, automatically.

Watch it happen

From Postman to CI

Collection

Environment

newman run

Tests

CI gate

1/5You build requests in Postman and add pm.test scripts to each one.

The big ideas

What you need to know

Postman without the window

Newman is the command-line runner for Postman collections. Same requests, same scripts, no clicking.

Swap environments

Run one collection against local, staging or production by passing a different environment file.

Fits right into CI

A failed test makes Newman exit with a non-zero code, so GitHub Actions or any CI marks the build red.

Reports for humans

Reporters like cli, json and junit turn each run into output your CI can display.

See it in code

Walk through the code

yaml

1name: api-tests2on: [push]3jobs:4  newman:5    runs-on: ubuntu-latest6    steps:7      - uses: actions/checkout@v48      - uses: actions/setup-node@v49        with:10          node-version: 2211      - run: npm install -g newman12      - run: >13          newman run postman/orders.postman_collection.json14          -e postman/staging.postman_environment.json15          --env-var "token=${{ secrets.STAGING_TOKEN }}"16          --reporters cli,junit --reporter-junit-export results.xml

1/4The workflow runs on every push.

Keep real tokens out of the exported environment file. Pass them in with --env-var from your CI secrets instead.

Save yourself the pain

Common mistakes

Oops

Committing environment files that contain real tokens or passwords.

Do this instead

Keep placeholders in the file and pass secrets at run time with --env-var from CI secrets.

Oops

Requests that depend on data someone created by hand last week.

Do this instead

Make the collection create what it needs, like a test user, and clean up at the end.

Your mission

Run your collection in CI

~40 min

Quick check

Why does a failing Newman run block a deploy in CI?

Go deeper

1Write Supertest tests covering both success and validation-error cases for an endpoint.
2Build a Postman collection covering your whole API and run it via Newman.
3Add API tests to CI so a backend regression is caught before it breaks the frontend.