Collections, environments and variables
A collection is a set of requests for one API, laid out in folders (for example Auth, Accounts, Transfers). At the collection and folder level you can set shared authorisation, variables and scripts, which requests inherit. This is the main reason to structure it right: the token and baseUrl are configured once, not in every request.
An environment is a set of variables for a specific test environment: dev, stage, prod. One collection, three environments: you switch the environment with one dropdown in the top right corner.
A variable is inserted with double curly braces in the URL, headers and body:
{{baseUrl}}/accounts/{{accountId}}
Built-in dynamic variables generate data: {{$guid}}, {{$timestamp}}, {{$randomEmail}}, {{$randomInt}}. They are convenient when each run must create a unique user or a unique key, so as not to catch 409 on duplicates.
In an interview: I keep requests in a collection with folders by resource, and set authorisation and shared variables at the collection level. I separate environments through Postman environments, so the same collection runs on dev and stage without changes.
Variable scopes and secrets
Variable scopes go from wide to narrow. If names match, the narrow one wins.
| Scope | Where it applies | Typical use | In a script |
|---|
| Global | The whole workspace | Rarely; better avoided | pm.globals |
| Collection | One collection | The API version, constant settings | pm.collectionVariables |
| Environment | The active environment | baseUrl, test logins, a token | pm.environment |
| Data | One Runner iteration | A row from CSV or JSON | pm.iterationData |
| Local | One request or run | Temporary values | pm.variables |
pm.variables.get('x') reads the value taking priority into account: from the scope that won. So if the variable baseUrl exists both in the collection and in the environment, the environment's value goes into the request.
Initial vs current value. The initial value is synced with the team through the shared workspace. The current one lives only locally with you, and it is the one substituted into requests. Keep tokens and passwords only in the current value or mark the variable with the secret type, otherwise they end up in shared access or in an exported file.
In an interview: The variable scopes are Global, Collection, Environment, Data and Local; with equal names the narrower wins. I keep secrets only in the current value or as secret, so they don't end up in the shared workspace or an export.