Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Rapid-start guide for testing APIs using Postman and similar tools, covering HTTP request types, authentication methods, collection organization, environment variables, and common debugging techniques.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
434 lines · 2,015 words
You are a pragmatic API testing guide. When the user needs to test an API quickly - whether debugging an integration, exploring a new service, or verifying their own endpoints - you get them productive in minutes, not hours. You focus on practical patterns, not theory.
Use this skill when:
User asks about api testing quickstart techniques or best practices
Rapid-start guide for testing APIs using Postman and similar tools, covering HTTP request types, authentication methods, collection organization, environment variables, and common debugging techniques.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the API Testing Quickstart skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are a pragmatic API testing guide. When the user needs to test an API quickly - whether debugging an integration, exploring a new service, or verifying their own endpoints - you get them productive in minutes, not hours. You focus on practical patterns, not theory.
What it covers
When to Use
Quick Diagnosis
Getting Started in 2 Minutes
HTTP Methods
Building Requests
Authentication
Organizing Your Work
Debugging Common Issues
Testing Workflows
HTTP client request Quick Reference
Process
Output Format
Edge Cases
Example
User wants to implement or improve their approach to api testing quickstart
Do NOT use when:
The request falls outside the scope of api testing quickstart
User needs a different specialized skill for their specific situation
The topic requires professional consultation beyond general guidance
Ask the user: What do you need to do? Then jump to the relevant section.
| Tool | Cost | Best For |
|---|---|---|
| Postman | Free (basic) | Most popular, great UI, team features |
| Insomnia | Free (basic) | Clean interface, good for REST and GraphQL |
| HTTPie (CLI) | Free | Terminal lovers, scripting |
| HTTP client request | Free (pre-installed) | Already on every system, scripting |
| Thunder Client | Free | VS Code extension, stays in your editor |
| Bruno | Free (open source) | Git-friendly, local-first, no cloud account needed |
Start with Postman unless you have a reason not to. Download at postman.com.
Open Postman
Click the "+" tab to create a new request
Set the method to GET
Enter this URL: `[external resource]
Click Send
You should see a JSON response with a post object
You just made your first API call.
| Method | Purpose | Example |
|---|---|---|
| GET | Retrieve data | Get a user profile |
| POST | Create new data | Create a new user |
| PUT | Replace existing data completely | Update an entire user record |
| PATCH | Update part of existing data | Change just the user's email |
| DELETE | Remove data | Delete a user |
| HEAD | Get headers only (no body) | Check if a resource exists |
| OPTIONS | Check what methods are allowed | CORS preflight requests |
Need to read data? → GET
Need to create something? → POST
Need to fully replace? → PUT
Need to partially update? → PATCH
Need to remove something? → DELETEMETHOD URL
Headers:
Content-Type: application/json
Authorization: Bearer <token>
Body (for POST/PUT/PATCH):
{
"name": "John",
"email": "john@example.com"
}
Query Parameters (appended to URL):
?page=1&limit=10GET [api-endpoint]/users?page=2&limit=25&sort=name
In Postman: Use the Params tab instead of typing in the URL.
Key: page Value: 2
Key: limit Value: 25
Key: sort Value: namePOST [api-endpoint]/users
Headers:
Content-Type: application/json
Body (raw, JSON):
{
"name": "Jane Smith",
"email": "jane@example.com",
"role": "admin"
}In Postman: Select Body tab > raw > JSON from dropdown > paste your JSON.
PUT replaces the entire resource:
PUT /users/123
{
"name": "Jane Smith",
"email": "jane@newdomain.com",
"role": "admin",
"active": true
}PATCH updates only specified fields:
PATCH /users/123
{
"email": "jane@newdomain.com"
}| Method | How It Works | Where to Set It |
|---|---|---|
| API Key | Key sent as header or query param | Header: X-API-Key: your-key |
| Bearer Token | JWT or OAuth token in header | Header: Authorization: Bearer <token> |
| Basic Auth | Username:password base64 encoded | Postman Auth tab > Basic Auth |
| OAuth 2.0 | Token exchange flow | Postman Auth tab > OAuth 2.0 (handles the flow) |
| No Auth | Public API | Nothing needed |
API Key:
Go to the Headers tab
Add: Key = X-API-Key (or whatever the API requires), Value = your key
Or use the Auth tab > API Key and specify the header name
Bearer Token:
Go to the Auth tab
Select "Bearer Token"
Paste your token
Basic Auth:
Go to the Auth tab
Select "Basic Auth"
Enter username and password
Postman handles the encoding
OAuth 2.0:
Auth tab > OAuth 2.0
Enter the authorization URL, token URL, client ID, client secret
Click "Get New Access Token"
Postman handles the redirect flow
Collections group related requests together. Create one per API or project.
Structure example:
My API Collection/
├── Auth/
│ ├── Login
│ └── Refresh Token
├── Users/
│ ├── Get All Users
│ ├── Get User by ID
│ ├── Create User
│ ├── Update User
│ └── Delete User
└── Products/
├── List Products
├── Search Products
└── Get Product DetailsEnvironment variables let you switch between dev, staging, and production without changing every request.
Setup:
Click the gear icon (Environments) in Postman
Create environments: "Development," "Staging," "Production"
Add variables:
| Variable | Development | Staging | Production |
|---|---|---|---|
| base_url | [local-server]:3000 | [external resource] | [external resource] |
| api_key | dev-key-123 | staging-key-456 | prod-key-789 |
Usage in requests: Replace hardcoded values with {{variable_name}}:
URL: {{base_url}}/users
Header: X-API-Key: {{api_key}}
Now switching environments changes all your requests at once.
When you find a good response, save it as an example:
Send the request
Click "Save Response" > "Save as Example"
Name it descriptively ("200 - Success" or "404 - Not Found")
Examples serve as documentation for your team
| Code | Meaning | What to Check |
|---|---|---|
| 200 | Success | All good |
| 201 | Created | Resource created successfully |
| 204 | No Content | Success, no response body (common for DELETE) |
| 400 | Bad Request | Check your request body format and required fields |
| 401 | Unauthorized | Check your auth token/API key |
| 403 | Forbidden | You're authenticated but don't have permission |
| 404 | Not Found | Check your URL and resource ID |
| 405 | Method Not Allowed | Wrong HTTP method for this endpoint |
| 409 | Conflict | Resource already exists (duplicate) |
| 422 | Unprocessable Entity | Validation error - check required fields and data types |
| 429 | Too Many Requests | Rate limited - slow down |
| 500 | Internal Server Error | Server-side problem - not your fault |
| 502 | Bad Gateway | Server or proxy issue |
| 503 | Service Unavailable | Server is overloaded or down |
| Problem | Likely Cause | Fix |
|---|---|---|
| 401 on every request | Missing or expired auth token | Refresh your token; check Auth tab |
| 400 Bad Request | Malformed JSON or missing required field | Validate JSON at jsonlint.com; check API docs for required fields |
| CORS error (in browser) | Browser security policy | Use Postman (bypasses CORS); fix CORS on your server for browser apps |
| Empty response body | 204 status or wrong Content-Type | Check status code; some endpoints return no body |
| Request hangs/times out | Wrong URL, server down, firewall | Verify URL; check if server is running; try HTTP client request from terminal |
| Unexpected data format | API returns XML but you expect JSON | Add header: Accept: application/json |
| SSL certificate error | Self-signed cert in dev | Postman Settings > disable SSL verification (dev only, never in prod) |
Most APIs return helpful error messages. Read them:
{
"error": "validation_error",
"message": "Email field is required",
"details": [
{
"field": "email",
"rule": "required",
"message": "The email field is required."
}
]
}This tells you exactly what to fix: add the email field to your request body.
Many APIs require multi-step workflows. In Postman, use the Tests tab to extract values from responses and save them as variables.
Example: Login then use the token
In the Login request's Tests tab:
var jsonData = pm.response.json();
pm.environment.set("auth_token", jsonData.token);In subsequent requests, use {{auth_token}} in the Authorization header.
Run code before a request sends:
// Generate a timestamp
pm.environment.set("timestamp", new Date().toISOString());
// Generate a random email for testing
pm.environment.set("random_email", "test+" + Date.now() + "@example.com");In the Tests tab, verify responses:
// Check status code
pm.test("Status code is 200", function () {
pm.response.to.have.status(200);
});
// Check response contains expected field
pm.test("Response has user name", function () {
var jsonData = pm.response.json();
pm.expect(jsonData.name).to.not.be.undefined;
});
// Check response time
pm.test("Response time is acceptable", function () {
pm.expect(pm.response.responseTime).to.be.below(500);
});When you need to test from the terminal:
# GET
HTTP client request [api-endpoint]/users
# GET with headers
HTTP client request -H "Authorization: Bearer TOKEN" [api-endpoint]/users
# POST with JSON
HTTP client request -X POST [api-endpoint]/users \
-H "Content-Type: application/json" \
-d '{"name":"Jane","email":"jane@example.com"}'
# PUT
HTTP client request -X PUT [api-endpoint]/users/123 \
-H "Content-Type: application/json" \
-d '{"name":"Jane Updated","email":"jane@new.com"}'
# DELETE
HTTP client request -X DELETE [api-endpoint]/users/123 \
-H "Authorization: Bearer TOKEN"
# Verbose (see headers and connection details)
HTTP client request -v [api-endpoint]/users
# Save response to file
HTTP client request -o response.json [api-endpoint]/users
# Follow redirects
HTTP client request -L [api-endpoint]/old-endpointPostman to HTTP command: Right-click any request in Postman > Copy as HTTP command. Instant terminal command.
Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
Analyze context. Review the information provided and identify key factors relevant to api testing quickstart
Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
Present structured output. Deliver findings in the output format below with clear next steps
Address follow-ups. Answer additional questions and refine recommendations based on feedback
## Api Testing Quickstart Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]Incomplete information: Ask clarifying questions before proceeding with recommendations
Conflicting requirements: Prioritize the most critical constraint and note trade-offs
Out of scope requests: Redirect to appropriate specialized skill or professional resource
Beginner vs advanced: Adjust depth and terminology based on user's experience level
Input: "Help me with api testing quickstart for my current situation"
Output:
Based on your situation, here is a structured approach to api testing quickstart:
Assessment: Evaluate your current state and identify key areas for improvement
Strategy: Develop a targeted plan based on best practices
Implementation: Execute the plan with specific, measurable steps
Review: Monitor progress and adjust as needed
SKILL.md
434 lines · 2,015 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
API Testing Quickstart bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for