05 Requests

title: "Requests: Params, Headers, and Body" description: "Configure Postman requests with query parameters, path variables, headers, and request bodies. Learn URL construction, content types, form data, binary data, and authentication methods." weight: 5 date: 2026-06-28 lastmod: 2026-06-28 tags: [api-development, postman] }

Postman requests consist of URL with parameters, headers, and an optional body. Understanding request configuration is essential for testing all API variations. Postman supports multiple body types, auth methods, and header presets.

What You'll Learn

• URL parameters: query strings and path variables
• Header configuration and presets
• Body types: raw JSON, form-data, x-www-form-urlencoded, binary
• Authentication methods
• Request cookies management

Why It Matters

Proper request configuration tests all API capabilities. Incorrect headers or body types cause confusing errors. Understanding request building helps debug API issues faster.

Real-World Use

Payment APIs use specific headers for idempotency keys. File upload APIs use form-data bodies. GraphQL APIs use raw JSON bodies with a specific query structure.

flowchart LR
    Request[HTTP Request] --> URL[URL Builder]
    Request --> Headers[Headers]
    Request --> Body[Request Body]
    Request --> Auth[Authorization]
    URL --> Params[Query Params]
    URL --> Path[Path Variables]
    Body --> Raw[Raw: JSON, XML, Text]
    Body --> Form[Form-Data]
    Body --> URLEncoded[URL-Encoded]
    Body --> Binary[Binary]

Teacher Mindset

Start with the URL and method. Add required headers (Content-Type, Accept). Choose the correct body type for your data. Use variables for dynamic values. Test with different parameter combinations.

Code Examples

// Example 1: Pre-request script setting dynamic headers
const timestamp = Date.now().toString();

pm.request.headers.add({
    key: 'X-Timestamp',
    value: timestamp
});

pm.request.headers.add({
    key: 'X-Signature',
    value: CryptoJS.HmacSHA256(timestamp, pm.environment.get('api_secret')).toString()
});

// Example 2: Dynamic query parameters
pm.variables.set('page', pm.iterationData.get('page') || 1);
pm.variables.set('limit', pm.iterationData.get('limit') || 20);

// URL: {{base_url}}/api/products?page={{page}}&limit={{limit}}

// Example 3: Request body manipulation in pre-request
const body = {
    name: pm.variables.get('product_name') || 'Default Product',
    price: parseFloat(pm.variables.get('product_price')) || 19.99,
    category: pm.variables.get('product_category') || 'general',
    inStock: true,
    tags: ['new', 'featured']
};

pm.variables.set('request_body', JSON.stringify(body));

Common Mistakes

• Forgetting to set Content-Type header matching the body format
• Hardcoding values instead of using variables
• Not encoding special characters in query parameters
• Using wrong body type (e.g., form-data when API expects raw JSON)
• Including sensitive data (passwords, tokens) in request bodies visible in collections

Practice

1. Create a GET request with path variable and query parameters.
2. Create a POST request with raw JSON body.
3. Create a POST request with form-data (simulating a file upload).
4. Add custom headers for content type and accept.
5. Challenge: Create a request with all parameter types and document each using Postman's description field.

FAQ

Mini Project

Create requests for a complete CRUD API: GET with query params (pagination), GET with path variable (single item), POST with raw JSON body (create), PUT with path variable and JSON body (update), DELETE with path variable. Use variables for all dynamic values.

What's Next

Next, you will learn about variables in Postman: global, environment, and collection scopes.