A first request, end to end
- Pick a protocol tab and enter the endpoint. For REST, choose the method and add headers or a JSON body; for GraphQL, the studio can introspect the schema and autocomplete your query; for gRPC, register a .proto or load it by reflection, then pick the method.
- Select an environment so the base URL and variables resolve, and reference any secret by its vault name rather than pasting it.
- Send the request. You get the status, headers, body and the total time measured at microsecond precision.
- Add an assertion on the status, a header, a body path or the response time, so the next run fails loudly instead of returning a wrong body quietly.
- Chain it: extract a token or an id from this response and feed it into the next request in the sequence.
Importing what you already have
Migration Setup accepts Postman, Insomnia, Bruno and Hoppscotch collections, and also JMeter, Selenium, Cypress and Playwright assets for the other modules. Each import produces a per-item report: what mapped cleanly, what needs review, and why. Nothing is dropped silently.
Environments and secrets
Environments hold base URLs and variables. Secrets do not live in environments; they live in the credential vault, are encrypted at rest, and are referenced by name. A request that needs an API key references the vault entry, so the key never appears in an exported collection or a log.
Chaining and assertions
- Extract a value from one response (a token, an ID) and use it in the next request.
- Assert on status, headers, body paths and response time.
- Shape assertions compare a response against the shape you recorded, so a field that disappears or changes type fails the test before it fails a customer.
Timing
Response time is recorded at microsecond precision. If your budget for an endpoint is 20 ms, a regression from 3 ms to 9 ms is invisible at millisecond granularity and visible here. Timings are stored per run so you can trend them.
Protocols
- REST: any method, JSON or form bodies, custom headers.
- GraphQL: queries, mutations, variables and introspection-driven autocomplete.
- gRPC: unary and server-streaming calls, with .proto registration and reflection.
- SOAP: WSDL-driven envelopes.
- Mock server: stand up a stub for an endpoint that does not exist yet and record traffic against it.
Questions people ask about this
- How is this different from Postman?
- The honest answer is on the comparison page: Postman is a deeper API client with a larger ecosystem. Here the API studio shares environments, credentials and results with UI, load, security and accessibility testing under one login. If API testing is the only thing you need, Postman may be the better tool.
- Where do GraphQL and gRPC go deeper?
- The GraphQL and gRPC guide covers introspection-driven queries and unary versus server-streaming calls in more detail.
Source: /documentation/api-testing-studio, updated 2026-09-18. Answers are checked against the shipped product on that date.
Found something out of date? The people who build the module answer the contact form on the home page, and corrections to this guide are dated above. Tell us.