Data-Driven Testing in Postman — Running Collections with Multiple Datasets

// Pre-request script — use data file values
const name = pm.iterationData.get("name");
const severity = pm.iterationData.get("severity");
const sourceIp = pm.iterationData.get("source_ip");

pm.variables.set("threatName", name);
pm.variables.set("threatSeverity", severity);
pm.variables.set("threatSourceIp", sourceIp);

// Log current iteration
console.log(`Iteration ${pm.info.iteration + 1}/${pm.info.iterationCount}`);
console.log(`Testing: name="${name}", severity="${severity}"`);

// Test script — validate against expected status
const expectedStatus = parseInt(pm.iterationData.get("expected_status"));

pm.test(`Status code is ${expectedStatus} for "${pm.iterationData.get("name")}"`, function () {
    pm.response.to.have.status(expectedStatus);
});

pm.test("Response contains appropriate fields", function () {
    const jsonData = pm.response.json();

    if (expectedStatus === 201) {
        pm.expect(jsonData).to.have.property("id");
        pm.expect(jsonData).to.have.property("name");
        pm.expect(jsonData.name).to.eql(pm.iterationData.get("name"));
    } else {
        pm.expect(jsonData).to.have.property("error");
    }
});

[
  {
    "scenario": "valid_threat",
    "input": {
      "name": "RCE Attempt",
      "severity": "critical",
      "source_ip": "10.0.0.100",
      "tags": ["rce", "critical", "web"]
    },
    "expected": {
      "status": 201,
      "severity": "critical",
      "has_tags": true
    }
  },
  {
    "scenario": "validation_error",
    "input": {
      "name": "AB",
      "severity": "invalid",
      "source_ip": "bad-ip"
    },
    "expected": {
      "status": 422,
      "error_field": "severity"
    }
  }
]

// Reading JSON data file
const input = pm.iterationData.get("input");
const expected = pm.iterationData.get("expected");
const scenario = pm.iterationData.get("scenario");

pm.variables.set("requestBody", JSON.stringify(input));

pm.test(`[${scenario}] Status code is ${expected.status}`, function () {
    pm.response.to.have.status(expected.status);
});

pm.test(`[${scenario}] Response is correct`, function () {
    const jsonData = pm.response.json();

    if (expected.status === 201) {
        pm.expect(jsonData.name).to.eql(input.name);
        pm.expect(jsonData.severity).to.eql(expected.severity);
        if (expected.has_tags) {
            pm.expect(jsonData.tags).to.include.members(input.tags);
        }
    }

    if (expected.error_field) {
        pm.expect(jsonData.details).to.be.an("array");
        const fields = jsonData.details.map(d => d.field);
        pm.expect(fields).to.include(expected.error_field);
    }
});

// Pre-request script — generate data if no data file is used
function generateThreatData() {
    const severities = ["low", "medium", "high", "critical"];
    const threatTypes = [
        "SQL Injection", "XSS", "RCE", "Path Traversal",
        "SSRF", "CSRF", "LDAP Injection", "XXE"
    ];

    const type = threatTypes[Math.floor(Math.random() * threatTypes.length)];
    const severity = severities[Math.floor(Math.random() * severities.length)];

    return {
        name: `Data-Driven ${type} - ${Date.now()}`,
        severity: severity,
        source_ip: `${Math.floor(Math.random() * 256)}.${Math.floor(Math.random() * 256)}.${Math.floor(Math.random() * 256)}.${Math.floor(Math.random() * 256)}`,
        tags: [type.toLowerCase(), severity, "automated"]
    };
}

// Generate 5 unique threats for bulk creation
const threats = Array.from({length: 5}, generateThreatData);
pm.environment.set("bulkThreats", JSON.stringify(threats));
console.log(`Generated ${threats.length} test threats`);