Postman Pre-Request Scripts — Automating Setup Before API Requests

// Pre-request script for automatic token management
const baseUrl = pm.environment.get("baseUrl");
const token = pm.environment.get("authToken");
const tokenExpiry = pm.environment.get("tokenExpiry");

// Check if token exists and is still valid
if (!token || !tokenExpiry || Date.now() > parseInt(tokenExpiry)) {
    console.log("Token expired or missing. Refreshing...");

    pm.sendRequest({
        url: `${baseUrl}/api/auth/login`,
        method: "POST",
        header: { "Content-Type": "application/json" },
        body: {
            mode: "raw",
            raw: JSON.stringify({
                username: pm.environment.get("testUsername"),
                password: pm.environment.get("testPassword")
            })
        }
    }, function (err, response) {
        if (err) {
            console.error("Auth failed:", err);
            return;
        }

        const json = response.json();
        pm.environment.set("authToken", json.access_token);
        // Set expiry to 5 minutes before actual token expiry
        pm.environment.set("tokenExpiry",
            Date.now() + (json.expires_in - 300) * 1000
        );

        // Set the auth header for the actual request
        pm.request.headers.add({
            key: "Authorization",
            value: `Bearer ${json.access_token}`
        });
    });
} else {
    // Token is valid — just set the header
    pm.request.headers.add({
        key: "Authorization",
        value: `Bearer ${token}`
    });
}

// Pre-request script for HMAC request signing
const CryptoJS = require("crypto-js");

// Get request details
const method = pm.request.method;
const path = pm.request.url.getPath();
const timestamp = Math.floor(Date.now() / 1000).toString();
const secretKey = pm.environment.get("apiSecret");

// Build the string to sign
const body = pm.request.body ? pm.request.body.toString() : "";
const stringToSign = `${method}\n${path}\n${timestamp}\n${body}`;

// Generate HMAC signature
const signature = CryptoJS.HmacSHA256(stringToSign, secretKey)
    .toString(CryptoJS.enc.Hex);

// Set signature headers
pm.request.headers.add({
    key: "X-Timestamp",
    value: timestamp
});
pm.request.headers.add({
    key: "X-Signature",
    value: signature
});
pm.request.headers.add({
    key: "X-API-Key",
    value: pm.environment.get("apiKey")
});

console.log("Signed request:", {
    stringToSign: stringToSign.substring(0, 50) + "...",
    signature: signature.substring(0, 16) + "..."
});

// Pre-request script for dynamic test data
const faker = {
    randomIP: () => {
        return Array.from({length: 4}, () =>
            Math.floor(Math.random() * 256)
        ).join(".");
    },
    randomName: (prefix) => {
        const names = [
            "SQL Injection", "XSS Attack", "Path Traversal",
            "CSRF Attempt", "LDAP Injection", "RCE Attempt",
            "SSRF Probe", "Buffer Overflow", "Format String"
        ];
        const name = names[Math.floor(Math.random() * names.length)];
        return `${prefix || "E2E"} - ${name} - ${Date.now()}`;
    },
    randomSeverity: () => {
        const severities = ["low", "medium", "high", "critical"];
        return severities[Math.floor(Math.random() * severities.length)];
    }
};

// Set dynamic values for the request
const threatData = {
    name: faker.randomName("PM-Test"),
    severity: faker.randomSeverity(),
    source_ip: faker.randomIP(),
    description: `Automated test created at ${new Date().toISOString()}`
};

// Store in variables for use in the request body
pm.variables.set("threatName", threatData.name);
pm.variables.set("threatSeverity", threatData.severity);
pm.variables.set("threatSourceIP", threatData.source_ip);
pm.variables.set("threatDescription", threatData.description);

// Override the request body
const body = JSON.stringify(threatData);
pm.request.body.update(body);