Two tools, two jobs
Most teams reach for Postman first because it has a friendly UI and great collection management. They reach for k6 (or JMeter, Gatling) when something gets slow in production. The mistake is treating these as alternatives. They solve different problems and you need both.
Postman is for contract testing. Does the API still return what consumers expect? Are status codes right? Are required fields present? Did the schema change without a version bump?
k6 is for performance testing. How does the API behave under realistic load? What's the p95 latency at peak? Where do bottlenecks emerge — DB, app server, external service?
The workflow we use in production
1. Postman collections, version-controlled
Export your collections as JSON. Commit them next to the code they test. Every API change PR includes a collection update — reviewers see contract changes alongside implementation changes. Use environment variables for staging vs prod base URLs.
2. Newman in CI
newman run collection.json --environment staging.json --reporters cli,junit runs your collection on every push. Failures break the build. JUnit output integrates with your CI's test reporter.
3. k6 scripts for the hot paths
Identify the 5–10 most-trafficked endpoints. Write a k6 script per journey:
import http from 'k6/http';
import { check, sleep } from 'k6';
export const options = {
stages: [
{ duration: '2m', target: 100 },
{ duration: '5m', target: 100 },
{ duration: '2m', target: 0 },
],
thresholds: {
http_req_duration: ['p(95)<400'],
http_req_failed: ['rate<0.01'],
},
};
export default function () {
const r = http.get('https://api.example.com/products');
check(r, { 'status 200': (res) => res.status === 200 });
sleep(1);
}
4. Run k6 nightly against staging
Not just before launch. The point is to catch regressions early — when a new feature triples the DB load on /products you want to know tomorrow, not the week before peak traffic season.
What we report
We give clients a single dashboard with:
- Contract pass-rate (Postman) over time
- p95 latency per endpoint (k6)
- Error rate at different load levels
- Top 5 slowest queries (from APM)
That's enough for engineering leadership to make resourcing decisions. Anything more is noise.
Where this breaks down
- GraphQL — Postman handles it, but contract testing requires schema diff tools (Apollo Rover, GraphQL Inspector) on top.
- Asynchronous APIs — webhooks, message queues. Postman/k6 alone don't model them. We use Pact for contract testing async flows.
- Auth-heavy flows — OAuth2 token rotation, mTLS. Worth scripting once and reusing across collections.
If you're starting from zero on API testing, the first month should produce: a Postman collection covering your top 10 endpoints, Newman running in CI, and one k6 script for your busiest journey. That alone catches 80% of the regressions teams ship by accident.