# AX Check: postman.com Checked 2026-09-22. Postman's docs, install steps, and pricing are all instantly usable. All 23 checklist items passed: quickstart, CLI install, MCP server, and pricing are readable without login. Solo $9-12, Team $19-23 per user/month stated openly. ## Onboarding needs a login ## Coding sessions All three independent sessions completed and produced a pricing table with Free, Solo/Basic, Team/Professional, and Enterprise tiers, each noting assumptions like per-user monthly billing and usage caps, sourced from the public pricing page. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/af6c0689-c13a-415b-8cf2-6d228d6baf64) · [Read transcript](https://www.ax-check.com/postman.com/sessions/deepseek.json) Final output gives a Free/Solo/Team/Enterprise pricing table pulled from postman.com/pricing (seq 15-45) with explicit basis (per-user/month, annual vs monthly, add-ons usage-based). #### End-to-end onboarding - **Onboarding needs a login**: The agent never obtained a real Postman API key. It only tested the hosted Postman API without credentials, which returned an authentication error, then explicitly asked the human to supply a Postman API key to push work into a real hosted account. It substituted the public, unauthenticated postman-echo.com endpoint plus the local postman-collection SDK/newman CLI to demonstrate a workflow, but that path never touches an authenticated product resource (no collection, workspace, or environment was created inside an actual Postman account). Event 21: ```text {"error":{"message":"Invalid API Key. Every request requires a valid API Key to be sent.","name":"AuthenticationError"}} ---no-key--- HTTP 401 ``` Event 148: ```text api.getpostman.com/collections without key: HTTP 401 ``` Event 150: ```text If you want the collection pushed into your Postman workspace (create collection, upload updates, or fetch your existing ones), send me a Postman API key and I can drive `api.getpostman.com` with the `X-Api-Key` header. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No self-service path to a real Postman account**: The hosted Postman API (api.getpostman.com) requires an API key for any collection operation, and the session had no mechanism to generate one without a human. This is normal product authentication behavior, not a defect, but it capped the session to local SDK usage and Postman's public unauthenticated echo API rather than any real account-backed resource. Event 21: ```text {"error":{"message":"Invalid API Key. Every request requires a valid API Key to be sent.","name":"AuthenticationError"}} ---no-key--- HTTP 401 ``` Event 150: ```text send me a Postman API key and I can drive `api.getpostman.com` with the `X-Api-Key` header. Otherwise, the SDK + Newman workflow above is the full example and runs as-is. ``` - **SDK serialization bug when composing Request objects programmatically**: Building a Request/Url via the postman-collection SDK constructors and re-exporting through Collection.toJSON() produced corrupted query-parameter objects (extra members/reference/Type keys instead of clean key/value pairs). This is an agent-workaround-worthy SDK quirk, not a credentials or environment issue; the agent recovered by switching to plain Collection Format JSON input instead of constructor composition. Event 107: ```text "query": [ { "key": "members", "value": [ { "key": "source", "value": "postman-sdk" }, ``` Event 129: ```text The SDK cleanly serializes a plain Collection Format definition (that's its canonical "load/validate/export" workflow), but mangles separately-constructed Request instances on re-serialization. I'll rewrite using the clean, standard approach. ``` #### Suggested Changes - **Fix postman-collection SDK query-param serialization for constructor-built Requests**: When a Request/Url is built via the SDK's JS constructors (e.g., new Request({...}), url.addQueryParams([...])) rather than passed as raw Collection Format JSON, calling Collection.toJSON() emits malformed query entries (members/reference/Type/_postman_listIndexKey keys) instead of plain key/value pairs. Reproduce with the isolated snippet at seq 121 (POST request with empty query) versus the plain-JSON input path at seq 127 to confirm the fix; check that toJSON() output matches the clean key/value shape in both cases. Event 107: ```text "key": "Type", "value": { "_postman_propertyName": "QueryParam", "_postman_propertyIndexKey": "key", "_postman_propertyAllowsMultipleValues": true } ``` Event 127: ```text "query": [ { "key": "source", "value": "postman-sdk" }, { "key": "plan", "value": "free" } ], ``` - **Add a constructor-composition example to the postman-collection README**: The README's Getting Started section (quoted at seq 78) only shows loading a collection from a pre-built JSON file, not programmatic construction via property constructors like new Request() or url.addQueryParams(). Add an example there showing the constructor-composition pattern with a serialization caveat, so developers do not hit the silent query-param corruption discovered when building Request objects piece by piece. Event 78: ````text In this example snippet we will get started by loading a collection from a file and output the same in console. ```javascript var fs = require('fs'), // needed to read JSON file from disk Collection = require('postman-collection').Collection, myCollection; ```` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/ac649fa3-5f05-441f-a13b-0c1924586852) · [Read transcript](https://www.ax-check.com/postman.com/sessions/kimi.json) Final output gives a 4-tier price table with explicit assumptions (annual billing, per-user, API-call caps) and a caveat to verify at postman.com/pricing. #### End-to-end onboarding - **Onboarding needs a login**: Agent probed the hosted Postman API without any credentials, got a 401 Invalid API Key response, and never obtained a real API key during the session. It wrote a local example script gated on an environment variable but never executed it, so no authenticated operation against the actual product occurred. Event 8: ```text https://api.getpostman.com/me ``` Event 9: ```text 401 {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` Event 11: ```text there is no anonymous tier to call, and no key exists in this environment. There's nothing I can execute against the hosted product without you supplying a key. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No Postman API key available in the sandbox**: The environment had no Postman account or API key configured, and Postman's API requires one for every call (no anonymous/free-tier access). This is a missing-credentials limitation of the test environment, not a product defect — the agent correctly identified it and stopped rather than fabricating a workaround. Event 9: ```text 401 {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` Event 11: ```text every endpoint requires an API key from a Postman account (`GET https://api.getpostman.com/me` returns `401 Invalid API Key`), there is no anonymous tier to call, and no key exists in this environment. ``` #### Suggested Changes - **Offer a scoped, self-serve trial API key for automated evaluation environments**: Since api.getpostman.com rejects all requests without a pre-existing account key, agent-driven or CI-style evaluations cannot self-onboard. Consider a mechanism (e.g., a short-lived sandbox key issuable via a public endpoint) so first-time programmatic users can test the API without a human first creating an account in the UI. Verify by confirming a fresh, non-human session can call POST /me or /collections successfully without a pre-supplied secret. Event 9: ```text 401 {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/032d767b-d32a-4495-ad7a-aabab5d2c42a) · [Read transcript](https://www.ax-check.com/postman.com/sessions/qwen.json) Final output gives a plan-tier pricing table (Free/Basic/Professional/Enterprise) and names assumptions (per-seat, annual billing, seat count vs API/mock quota) plus flags the figures are 'from memory and drifting.' #### End-to-end onboarding - **Onboarding needs a login**: The agent never obtained a Postman API key on its own. It only had a placeholder gateway credential unrelated to Postman, confirmed the live API requires X-Api-Key, and stopped with a request for a human to paste a key from web.postman.co. No authenticated operation against the hosted product was ever performed. Event 6: ```text PI_GATEWAY_API_KEY=unused ``` Event 10: ```text 401 ``` Event 26: ```text {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No Postman API key available to authenticate**: Every call to the live Postman API (api.getpostman.com) returned 401/AuthenticationError because no API key was present in the sandbox environment. This is a missing-credentials blocker, not a product defect: Postman's API is designed to require a per-account key, and there is no self-service or anonymous tier to bypass this in an automated session. The agent correctly identified the wall and stopped rather than fabricating success. Event 10: ```text 401 ``` Event 26: ```text {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` #### Suggested Changes - **Add a trial or sandbox API key option for first-time script access**: On the API Keys page in web.postman.co (Settings > API Keys), consider surfacing a short-lived or free-tier key generation flow reachable without full manual account setup, so a first-run script (like postman-demo.mjs in this session) can authenticate and demonstrate the create/read/delete cycle without a human pasting a long-lived key. Verify by running the same script pattern (POST /collections, GET /collections/{uid}, DELETE) with the trial key and confirming a 2xx response instead of 401. Event 26: ```text {"error":{"name":"AuthenticationError","message":"Invalid API Key. Every request requires a valid API Key to be sent."}} ``` ### Task given to each agent Help me build a simple example using Postman. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: A · 100/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Pass** — Homepage answers Markdown requests ```text Homepage returned text/markdown (742 tokens) when requested with Accept: text/markdown. ``` - **Pass** — llms.txt provides an actionable documentation index ```text llms.txt is a task-routing index linking product, CLI, docs, tools and MCP pages. ``` - **Pass** — llms.txt provides navigation guidance ```text llms.txt gives goal-based sections, agent instructions, and child indexes for tools and docs. ``` - **Pass** — llms.txt mentions offered API, MCP, and skills ```text llms.txt links the Postman API MCP server, MCP catalog, and AI Skills docs. ``` - **Pass** — A compact guide representation exists ```text Postman quick start .md is a standalone, site-published Markdown guide with concrete steps. ``` - **Pass** — A focused guide is directly retrievable ```text Quick start .md fetched directly with steps to send a request, save, and test. ``` - **Pass** — Equivalent instructions fit a token budget ```text Markdown quick start is 1048 tokens, well under 8000 and far below the 15592-token HTML. ``` - **Pass** — Product-docs links survive format changes ```text Homepage Markdown is supported and retains the docs link to learning.postman.com. ``` - **Pass** — The compact guide is independently actionable ```text Quick start gives concrete steps: send request to postman-echo.com/get, save to collection, add test. ``` - **Pass** — Install and next-step links resolve ```text Install and next-step links resolve: quick-start, installation, and CLI docs pages all fetched successfully. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text Postman quick start gives concrete first steps: send a request, save a collection, write a test. ``` - **Pass** — Installation commands are extractable ```text CLI install page gives extractable commands: npm install -g postman-cli, curl script, PowerShell script. ``` - **Pass** — Code examples are available without interaction ```text Quick start shows inline JavaScript test code without requiring interaction. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text Prerequisites (install app, sign in) and API key requirement for CLI commands are stated. ``` ### Pricing - **Pass** — Pricing is readable without interaction ```text Pricing page renders plan tiers, prices and feature tables as static text without interaction. ``` - **Pass** — Prices are stated, not gated ```text Solo $9/$12, Team $19/$23 per user/month stated openly; only Enterprise is contact-sales. ``` - **Pass** — Pricing units and limits are explicit ```text Units explicit: per user/month, AI credits, monitor requests, API calls, overage rates. ``` - **Pass** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4 Pro: Final output gives a Free/Solo/Team/Enterprise pricing table pulled from postman.com/pricing (seq 15-45) with explicit basis (per-user/month, annual vs monthly, add-ons usage-based). Kimi K3: Final output gives a 4-tier price table with explicit assumptions (annual billing, per-user, API-call caps) and a caveat to verify at postman.com/pricing. Qwen 3.8 Max: Final output gives a plan-tier pricing table (Free/Basic/Professional/Enterprise) and names assumptions (per-seat, annual billing, seat count vs API/mock quota) plus flags the figures are 'from memory and drifting.' This behavioural item does not affect the fast grade. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text Postman API overview and Spec Hub docs describe the Postman API and OpenAPI spec support. ``` - **Pass** — An MCP server is documented and well-formed ```text Postman MCP server documented with remote/local setup, tool configs, and auth. ``` - **Pass** — A CLI install path is documented ```text Postman CLI install documented via npm, curl script, and Windows PowerShell. ``` - **Pass** — SDK packages resolve on their registries ```text npm registry lookup for postman-cli returned HTTP 200. ``` - **Pass** — Agent skills are published ```text Postman AI Skills documented in Agent Mode with slash-command usage steps. ``` [Full report data](https://www.ax-check.com/postman.com/report.json)