Postman CLI request commands (postman request)

The HTTP method (GET, POST, PUT, DELETE, PATCH, HEAD, or OPTIONS).

The target URL for the request, or the path to a local HTTP request file (*.request.yaml or *.request.yml). A request file is the file a collection uses to store a single request on disk, as defined by the Postman Collections schema. If the path matches an existing file, the command loads it as a request. Otherwise, it treats the value as a URL. You can put a method before either one.

A request file runs only the request it holds, and the request is sent to the URL saved in that file. You can’t override the saved URL separately.

The request also inherits authentication, variables, and scripts from the collection and folders the file sits in. The command resolves files that the saved request body references relative to the request file.

The options you pass override the saved values:

• Headers override saved headers with the same name, ignoring case. Other saved headers remain.
• Body and form options replace the saved body.
• Authentication options override matching credentials and keep other credentials of the same authentication type.
• Script options replace the request’s own script. Scripts from its collection and folders still run.
• Redirect and TLS options override the saved settings.
• The --environment option selects the environment.

The command resolves body and script file paths that you pass as options from the current working directory.

Specifies the authentication type and parameters. Supports the basic, bearer, digest, oauth1, oauth2, hawk, aws, ntlm, and apikey authentication types.

For example: --auth-basic-username user --auth-basic-password pass or --auth-apikey-key "X-API-Key" --auth-apikey-value "abc123" --auth-apikey-in header

Specifies request body content. Pass the content inline, @filepath to read a UTF-8 file, or - to read from standard input. The command sends the content of a file or standard input as a raw body and keeps its whitespace. To upload a file as multipart form data, use --form instead. A JSON body uses the application/json content type unless you set one with --header.

For example: --body '{"name": "John"}', --body @data.json, or --body -

Specifies the file path for a JSON cookie jar to load cookies from before the request runs. This uses the tough-cookie library to deserialize the file.

Loads one or more local .dataset.yaml files, or directories of them, for the request to use. Pass --dataset more than once to load multiple datasets.

Shows detailed information in debug mode, including retry attempts, redirects, and timing breakdowns.

Specifies an environment file path or UUID. Resolves variables in the URL, headers, and body.

Specifies the path where the Postman CLI outputs the final cookie jar file after the request completes. This uses the tough-cookie library to serialize the file.

Specifies multipart/form-data in key=value format. Use @filepath syntax for files. Can be used multiple times.

For example: -f "name=John" or -f "avatar=@photo.jpg"

Specifies a header in key-value format. Can be used multiple times.

For example: -H Content-Type:application/json

Turns off SSL verification checks and enables self-signed SSL certificates.

Saves the complete response to a JSON file, including status, headers, body, and more. Use for debugging or further processing.

Events are reported to the API Catalog and Application Inventory by default, whether you pass --report-events. To turn reporting off, pass --report-events=false. You can also use --no-report-events.

Suppresses all output except the response body. This is useful for piping to other commands.

A hidden alias for --response-only. Suppresses all output except the response body. You can’t use it with --verbose or --debug.

Preserves the original HTTP method when 3xx redirect responses. Redirects are followed with the GET method by default.

Prevents the Postman CLI from automatically following 3xx redirect responses. Redirects are followed by default.

Specifies the maximum number of 3xx redirect responses to follow. There is no limit by default. Useful for preventing redirect loops.

Removes the Referer header when following 3xx redirect responses. The Referer header is sent with redirects by default.

Specifies the number of retry attempts for failed requests, like a 400 Bad Request code. Useful for unreliable endpoints or rate limited APIs.

Specifies the time (in milliseconds) to wait to retry the request.

Adds JavaScript that runs after the request runs. Supports inline JavaScript or @filepath syntax for files. Learn more about writing post-response scripts.

For example: --script-post-request "console.log(pm.response.json());"

Adds JavaScript that runs before the request runs. Supports inline JavaScript or @filepath syntax for files. Learn more about writing pre-request scripts.

For example: --script-pre-request "pm.environment.set('timestamp', Date.now());"

Specifies the path to a client certificate (PEM).

Specifies the path to a client certificates configuration (JSON).

Specifies the path to a client certificate private key.

Specifies the client certificate passphrase (for a protected key).

Specifies more trusted CA certificates (PEM).

Specifies the time (in milliseconds) to wait for the request to complete.

Shows detailed information for the request and response, including headers, body, and metadata.