This month’s challenge is all about creative, effective testing using Postman’s newest features.
Complete 5 guided tasks in our Public Workspace and then share how you used an external package (like chance, joi, or jsonwebtoken) in your Pre-request or Post-response Script.
Post your script, approach, or learnings in this topic to enter and have a shot at winning.
First time trying this? Don’t worry, each task includes helpful examples and walkthroughs.
const zod = pm.require('npm:[email protected]');
const response = pm.response.json();
//The schema to check the todos schema in the response body
const userSchema = zod.object({
userId: zod.number(),
id: zod.number(),
title: zod.string(),
completed: zod.boolean()
});
try {
const parsedData = userSchema.parse(response);
pm.test("The response data is valid against the schema", () => {
pm.expect(parsedData).to.be.an('object');
});
} catch (error) {
pm.test("The response data is invalid against the schema", () => {
console.error("Validation errors:", error.errors);
pm.expect.fail("Check console for errors");
});
}
This is the script to validate the json schema of the todos using Zod npm package that is fetched using the GET request in postman using this endpoint - https://jsonplaceholder.typicode.com/todos/1.
I’ve been really excited about this challenge and can’t wait to see the creative ways people use external packages in their Collections!
With so many options available on npm and JSR, the possibilities are truly endless.
The examples provided are just a starting point to spark ideas and show what’s possible. What we’re really looking for are fresh, unique, and innovative uses of external packages.
So, how will you stand out and show off what you can do?
Nice @jyesh - Just ensure that you’re following the instructions in the Folder for the correct request name. You will receive an error for your overall submission as it is now
This is the code I have created. I played with the platform a little haha. I used crypto.js to encrypt the message that is being received and made some ascii art using mapping method of that hashed message. (Used AI).
Overall I learned to test API. It is very easy to test and validate an API which is very useful to me. Then I learnt how to visualize with postman and also how to import modules using postman. It is quite a bit but was very easy to work with.
lodash – to easily pick random words from arrays to build creative, natural-sounding captions. compromise - used to generate and transform the caption (not just analyze it)
Post-response Script:
const _ = require('lodash');
const compromise = pm.require('npm:[email protected]');
// Get image data from response
const image = pm.response.json()[0];
const imageUrl = `https://picsum.photos/id/${image.id}/400/300`;
const author = image.author;
// Word banks
const adjectives = ['serene', 'vivid', 'mystical', 'dramatic', 'picturesque', 'timeless'];
const scenes = [
'a glimpse into nature',
'urban beauty',
'a peaceful escape',
'an architectural wonder',
'a dreamlike sky',
'a glowing horizon'
];
// Step 1: Seed raw caption
const seedCaption = `The scene is ${_.sample(adjectives)} and shows ${_.sample(scenes)}.`;
// Step 2: Use compromise to smartly transform the caption
let doc = compromise(seedCaption);
// Use NLP to enhance sentence style
doc.verbs().toPresentTense();
doc.replace('The scene is', `Captured by ${author}, this moment feels`);
doc.replace('shows', 'offers');
// Final AI-generated caption
const caption = doc.text();
// NLP analysis just for fun
const nouns = doc.nouns().out('array');
const adjs = doc.adjectives().out('array');
// Set up the visualizer
pm.visualizer.set(`
<div style="text-align:center; font-family: sans-serif; padding: 20px;">
<img src="{{img}}" style="max-width:100%; border-radius:10px; box-shadow: 0 4px 10px rgba(0,0,0,0.1);" />
<h3 style="margin-top: 20px;">📝 AI-Generated Caption</h3>
<p style="font-size: 18px;">"{{caption}}"</p>
<p style="color:gray;">📸 Author: {{author}} | 🆔 ID: {{id}}</p>
<hr style="margin: 20px 0;" />
<p><strong>🔤 NLP Analysis (from compromise):</strong></p>
<p><strong>Nouns:</strong> {{nouns}}</p>
<p><strong>Adjectives:</strong> {{adjs}}</p>
</div>
`, {
img: imageUrl,
caption,
author,
id: image.id,
nouns: nouns.join(', ') || 'None',
adjs: adjs.join(', ') || 'None'
});
Visualization:
Used pm.visualizer.set() to create a clean UI showing:
While APIs and captioning are widely used in AI and web apps, they’re rarely visualized inside Postman. Postman is often used for testing and debugging APIs — not for creative or dynamic frontend-style visualizations.
This collection shows that Postman can be fun, interactive, and artistic — pushing the boundaries of what’s traditionally expected from API tools. It’s not common because most developers don’t think of Postman as a canvas for storytelling, but this proves it can be.
pm.test(' Should return a 200 status code', function () {
pm.response.to.have.status(200);
});
const schema = {
"type": "object",
"properties": {
"userId": { "type": "number" },
"id": { "type": "number" },
"title": { "type": "string" },
"body": { "type": "string" },
"author": { "type": "string" }
},
"required": ["userId", "id", "title", "body"],
"additionalProperties": false
};
const response = pm.response.json();
const title = response.title?.toLowerCase() || "";
const body = response.body?.toLowerCase() || "";
const blacklist = ["damn", "hell", "stupid", "idiot", "dumb", "kill"];
const violations = blacklist.filter(word =>
title.includes(word) || body.includes(word)
);
pm.test(" Response is culturally appropriate", function () {
if (violations.length > 0) {
console.warn("Offensive words:", violations);
throw new Error("Inappropriate language detected.");
}
});
const franc = pm.require('npm:franc');
const langs = pm.require('npm:langs');
pm.test("Response language should be English", function () {
const combinedText = `${title} ${body}`.trim();
if (!combinedText || combinedText.split(' ').length < 5) {
console.warn("Skipping language detection (text too short)");
return;
}
let langCode;
try {
langCode = franc(combinedText);
} catch (err) {
console.warn("Language detection failed:", err.message);
return;
}
const langName = langs.where("3", langCode)?.name || "Unknown";
console.log(`Detected language: ${langName}`);
pm.expect(langCode).to.eql("eng", `Detected: ${langName}`);
});
pm.test("Schema is valid", function () {
pm.response.to.have.jsonSchema(schema);
});
I played a lot with all the requests and learned a lot of new stuff!!!
Offensive Content Filter :Automatically scans the response title and body for inappropriate or culturally insensitive words using a custom blacklist. (this is awesome)
Language Detection with franc + langs :Dynamically detects the language of the response content. Fails the test if it’s not English, and smartly skips the test if text is too short or detection fails — avoiding false alarms. (brainstormed a lot on this one!!)
Schema Validation :Ensures the response strictly follows a defined schema — nothing extra, nothing missing.
overall learned a lot, how API testing is done, refreshing is also an option (cause I did not know it existed), and Gaines some more confidence !!!
Hello API-first advocates, my name is Rener Pires and I made this.
QUICKY AUTO TEST API with Postman
QUICKY is a lightweight automated testing setup for Postman collections, built to help ensure consistency and structural integrity in your API responses. It allows developers to validate both the content and structure of responses using simple, declarative request headers.
This approach is ideal for maintaining API stability, especially across test environments, contract changes, and mock servers — with minimal manual effort.
Header-driven automation — no need to write custom scripts per request
Friendly to dynamic and static endpoints
Fast setup — designed for developers who value speed and clarity
How It Works
QUICKY uses custom HTTP headers to control and trigger validation logic. These headers are interpreted in the Postman test script to decide what validation behaviour to execute.
Some actions run automatically; others must be added manually when needed.
Available Headers
X-QUICKY-COMPARE-RES-HASH
Automatically compares the current response against a previously stored hash. If any part of the response body has changed, the test fails — even for the smallest alteration.
Use this when the API is expected to return exactly the same result on each request.
X-QUICKY-VALIDATE-RES-SCHEMA
Validates the structure of the response body against a stored Zod schema. This is useful for endpoints where content might change (e.g., timestamps or IDs), but the shape of the data must remain consistent.
Ideal for dynamic responses where strict hashing isn’t practical.
X-QUICKY-UPDATE-RES-HASH
This is a manual action. It updates the stored response hash with the value from the current response. Use it:
When running the test for the first time
After intentionally updating the response output
Must be included manually when you want to overwrite the reference hash.
X-QUICKY-UPDATE-RES-SCHEMA
Also a manual action. This generates a new Zod schema based on the current response body and stores it for future validations.
Use this whenever:
The API response structure has changed legitimately
You’re adding a new endpoint to the collection
You want to initialise schema validation for the first time
I also discovered some hidden npm gems through official docs.
What made it special? Postman turned testing into a fun, hands-on learning journey.
From scripting to visualizing, it felt like building something real. Postman wasn’t just a tool—it was my guide.
Let me know what you think — open to feedback
Thanks to Postman for this creative challenge! postmanapitesting#JuneChallenge
API Fort Knox: AES Encryption, JWT Signing, Replay Protection and Multi Hash Integrity All Inside Postman Scripts with External Packages
Hello Everyone i am Aditya D and this is my official entry for june API challenge!!
I did just not create a script but i also weaponized Postman!!!
What I Created:
a fully loaded enterprise grade API request signing + payload encryption + tamper proofing + replay attack protection system running entirely inside Postman’s scripting sandbox and leveraging external packages like a boss. And yes all automated which means no external server, no hacks and no gimmicks.
3. [email protected] What it is?
A powerful modern alternative for Javascript’s native Date object makes handling dates, times, timezones and ISO 8601 formats super clean and reliable.
Why have i used it?
Generate multi timezone timestamps for UTC, IST, Tokyo, New York, London, Sydney.
Convert and format timestamps to ISO 8601 strings.
Add time based expiry for JWT tokens.
Validate timestamp freshness in post response tests.
Why this isn’t just cool and Extremely Useful: Api engineers can prototype enterprise security workflows without needing backend services. Simulates real world secure request signing and encryption flows for banking, fintech, web3 and defense grade APIs. Replay attack protection using Nonce and Timestamp. Verifiable payload encryption via AES. Integrity validation using multi hash signatures. JWT token generation and validation demo without external servers.
TL;DR:
Postman Sandbox + External Packages + Insane Scripting = API Fort Knox
If you’re building APIs that handle sensitive data or want to simulate secured, signed, encrypted API calls entirely in postman this is your toolkit!!.
Signing Off:
If you loved this, drop a like and reply , would love to see what other wild things folks built this month. Big shoutout to Postman team for cooking this beautiful external packages madness in the form of June API Challenge!! . postmanapitesting#JuneChallenge
chance
dayjs
,
Fetches user data from 
The console shows:
or 
based email validation
Final status with emojis
Feedback welcome.
API Used:
Pre-request Script:
External Package Used:
Post-response Script:
Visualization:
QUICKY AUTO TEST API with Postman
Key Features
Available Headers
Dynamic Endpoints
How It Stores Data
Script session
Validated & Generated – My June API Challenge with Zod, Chance & UUID
What I Did:
Screenshot below to show it in action!
What I Learned
API Fort Knox: AES Encryption, JWT Signing, Replay Protection and Multi Hash Integrity All Inside Postman Scripts with External Packages
Generates a JWT token signed with HMAC SHA256.
Computes HMAC SHA256, HMAC 512 and MD5 hashes.
Injects all custom headers automatically.
Generates a tamper detection integrity hash.
Logs everything in console for traceability.
Decrypts the AES payload.
Validates echoed headers (inside response JSON body since postman echo behaves that way).
checks timestamp freshness (within 5 minutes).
Screenshots and script in Action
TL;DR:
Signing Off: