Postman GraphQL Testing

GraphQL is an API style where the client asks for exactly the fields it needs. A REST endpoint returns a fixed shape, while a GraphQL endpoint answers custom questions. Postman includes a dedicated GraphQL request type with schema loading, auto-complete, and variable support.

REST and GraphQL Compared

A restaurant with a fixed menu serves set meals. A restaurant with a build-your-own counter serves exactly what you choose. REST resembles the fixed menu, and GraphQL resembles the build-your-own counter.

  REST                               GraphQL
  ────                               ───────
  GET /users/1                       POST /graphql
  GET /users/1/posts                 One query asks for
  GET /users/1/followers             user, posts, and followers together

  3 requests, extra fields           1 request, only chosen fields

Key Vocabulary

Term	Meaning
Query	A request that reads data
Mutation	A request that creates, changes, or deletes data
Subscription	A live feed of updates
Schema	The full description of available types and fields
Variable	A value passed into a query from outside

Create a GraphQL Request

1. Click New and choose GraphQL.
2. Type the endpoint URL of the GraphQL server.
3. Open the Schema tab and click Use GraphQL introspection to load the schema.
4. Write a query in the Query editor. Press Ctrl+Space for field suggestions.
5. Click Send.

Introspection asks the server to describe itself. Some servers disable introspection in production, so load a schema file instead.

Write a Query

query {
  user(id: 1) {
    name
    email
    posts {
      title
    }
  }
}

The response mirrors the query shape. Only name, email, and post titles come back, nothing more.

Use Variables

Variables keep queries reusable.

Query:
query GetUser($id: ID!) {
  user(id: $id) {
    name
    email
  }
}

Variables panel:
{ "id": 1 }

The exclamation mark after the type means the variable is required.

Send a Mutation

mutation {
  createPost(title: "Hello", body: "First post") {
    id
    title
  }
}

A mutation returns the fields you list, so ask for the new id to use it in later steps.

Understand GraphQL Errors

GraphQL servers often answer with status 200 even when something fails. The body carries an errors array instead.

{
  "data": null,
  "errors": [
    { "message": "Cannot query field 'nam' on type 'User'" }
  ]
}

Status code checks alone miss these failures. Write tests that inspect the body.

Test a GraphQL Response

pm.test("Status is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("No GraphQL errors", function () {
    const body = pm.response.json();
    pm.expect(body.errors).to.be.undefined;
});

pm.test("User name is a string", function () {
    const body = pm.response.json();
    pm.expect(body.data.user.name).to.be.a("string");
});

Authentication

GraphQL endpoints use the same authentication methods as REST. Set Bearer Token or API Key on the Authorization tab, and Postman attaches the header to every query.

Debugging Checklist

• Confirm the endpoint ends with the correct path, often /graphql.
• Reload the schema after the server changes.
• Check spelling of field names, since GraphQL is strict.
• Request nested fields explicitly, because nothing returns by default.
• Read the errors array before suspecting the network.

Key Points

• GraphQL lets the client choose exactly which fields to receive.
• Postman offers a dedicated request type with schema-aware editing.
• Queries read data and mutations change data.
• Variables make queries reusable.
• Tests must check the errors array, since failed queries often return status 200.