| Requests | HTTP methods (GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS) | FULL | any verb sent; method free-form on the request model + GUI method picker |
| Requests | Send request | FULL | reqwest blocking send + GUI Send button |
| Requests | Cancel in-flight request | PARTIAL | per-request timeout self-cancels an in-flight send (GUI timeout field); interactive mid-flight cancel needs an async transport |
| Requests | URL with query string | FULL | raw `?query` preserved + structured params merged |
| Requests | Query param table (enable/disable rows) | FULL | per-row enabled toggle honoured at prepare time + GUI params table |
| Requests | Path variables (/:id) | FULL | `:name` and `{name}` URL tokens substituted from a path-variable table (boundary-aware) + GUI Path tab |
| Requests | Request description / docs | PARTIAL | stored on every node; rendered read-only, no Markdown editor |
| Collections | Collections (create/list/delete) | FULL | collection CRUD commands + GUI sidebar |
| Collections | Folders (nested tree) | FULL | arbitrary folder nesting + recursive id assignment + GUI tree |
| Collections | Save request into collection/folder | FULL | add into a collection or a target folder + GUI save |
| Collections | Collection-scoped variables | FULL | collection vars merged at highest precedence + GUI variables table |
| Collections | Collection-level auth (inherited) | FULL | request → folder → collection inheritance walk + GUI auth tab |
| Collections | Reorder / drag requests | PARTIAL | move up/down controls reorder requests + persist via collection.update; HTML5 drag-and-drop not implemented |
| Environments | Environments (create/list/delete) | FULL | environment CRUD + GUI environment manager |
| Environments | Activate environment | FULL | active environment swaps variable resolution + GUI selector |
| Environments | Global variables | FULL | global scope persisted + GUI globals editor |
| Environments | Variable resolution {{var}} | FULL | tokenized substitution with scope precedence |
| Environments | Scope precedence (collection>env>global) | FULL | documented precedence, unit-tested |
| Environments | Dynamic variables ({{$guid}}, {{$timestamp}}, …) | FULL | guid/timestamp/isoTimestamp/randomInt/randomBoolean/randomUUID/randomAlphaNumeric + the {{$random*}} faker catalog (First/Last/FullName, Email, UserName, JobTitle, UserAgent, Url/DomainName/Protocol/Port/IP/MACAddress, City/Country/CountryCode, Price/CurrencyCode/Color/HexColor/PhoneNumber, Lorem word/words/sentence) |
| Environments | Secret variable masking | FULL | model flags secrets; GUI variable tables mask secret values as password inputs with a per-row toggle |
| Environments | Set variables from a test script (pm.environment.set) | PARTIAL | literal pm.environment/globals/collectionVariables.set() calls applied to the workspace; values derived from response JS are not evaluated (no JS sandbox) |
| Authorization | No auth | FULL | explicit no-auth |
| Authorization | Inherit auth from parent | FULL | resolved by the inheritance walk |
| Authorization | Basic auth | FULL | base64 Authorization header + GUI form |
| Authorization | Bearer token | FULL | Authorization: Bearer + GUI form |
| Authorization | API key (header or query) | FULL | added to header or query per add_to + GUI form |
| Authorization | OAuth 2.0 (attach access token) | FULL | attaches a Bearer token + acquires one via client_credentials/password/refresh_token grants (oauth2.token); interactive auth-code/PKCE redirect is delegated to the host |
| Authorization | Digest auth | FULL | RFC 2617 MD5 digest response computed from the stored challenge params (verified against the RFC example) |
| Authorization | OAuth 1.0 | FULL | HMAC-SHA1 + PLAINTEXT signature; base string verified against RFC 5849 |
| Authorization | AWS Signature v4 | FULL | canonical request + SigV4 signing, verified against AWS's get-vanilla test vector |
| Authorization | NTLM / Hawk | PARTIAL | Hawk MAC signs; NTLM is a connection-bound handshake (not a single signature) and stays unimplemented |
| Request body | None | FULL | no body |
| Request body | Raw (JSON/text/XML/HTML/JS) | FULL | raw text + language→content-type + GUI raw editor |
| Request body | x-www-form-urlencoded | FULL | encoded form fields + GUI table |
| Request body | multipart/form-data (text + file) | FULL | multipart parts incl. file uploads + GUI table |
| Request body | GraphQL (query + variables) | FULL | query+variables packed as application/json + GUI GraphQL editor |
| Request body | Binary file body | FULL | file read at send time |
| Request body | Body content-type auto-set | FULL | default content-type added unless the request set one |
| Headers | Custom request headers | FULL | enable/disable header rows + GUI headers table |
| Headers | Auto headers (User-Agent, Content-Length) | PARTIAL | User-Agent + content-length set by the client; no editable "auto headers" panel |
| Headers | Header presets / bulk edit | FULL | bulk-edit toggle on the params/headers/path tables: edit as `Key: Value` lines (`# ` prefix disables a row) |
| Scripting | Test assertions (pm.test / pm.expect subset) | PARTIAL | native matcher for status/code/responseTime/body-include/header; NOT a JS sandbox |
| Scripting | Pre-request scripts | PARTIAL | native pm.*.set() variable writes execute before the request is prepared (GUI Pre-req tab); no JS sandbox for arbitrary logic |
| Scripting | Full JS sandbox (pm.* API) | MISSING | no embedded JS engine by design (durable-deps rule) |
| Scripting | Test results panel | FULL | response Tests tab lists every assertion with pass/fail icon, name, and the failure/skip message |
| Response | Status code + reason | FULL | captured + GUI status badge |
| Response | Response time | FULL | wall-clock round trip + GUI timing |
| Response | Response size | FULL | byte size + GUI size |
| Response | Response headers | FULL | captured + GUI headers tab |
| Response | Body pretty / raw view | FULL | response body tab toggles between pretty-printed JSON and the raw payload |
| Response | Binary response handling | FULL | non-UTF8 bodies surfaced as base64 |
| Response | Save response to file | FULL | response pane "⤓ Save" downloads the body (base64-decoded for binary) via an anchor download |
| History | Request history log | FULL | capped newest-first log persisted beside the workspace + GUI history pane |
| History | Replay from history | FULL | each history entry captures the full request (headers/body/auth/params); history.replay returns it and the GUI loads it for one-click resend |
| History | Clear history | FULL | clear command + GUI clear |
| Cookies | Cookie jar (persisted) | FULL | cookies modeled + persisted + per-send jar via reqwest + GUI cookie manager (list / add modal / clear) |
| Cookies | Manual cookie set / clear | FULL | set/clear commands |
| Import | curl import | FULL | parses -X/-H/-d/-F/-u/--url + bare URL into a request + GUI paste-curl |
| Import | Postman Collection v2.1 import | FULL | collection variables+auth, folder/request auth, structured query, headers, all body modes (raw/urlencoded/formdata/graphql/file), pre-request+test scripts, descriptions; url-objects without raw are rebuilt; faithful inverse of the exporter |
| Import | OpenAPI 3 import | PARTIAL | paths→requests + query/header params + requestBody with in-document $ref resolution and schema-driven example synthesis; securitySchemes→auth not yet mapped |
| Import | HAR import | FULL | HAR 1.2 log.entries[].request mapped (method/url/headers/queryString/postData), HTTP/2 pseudo-headers dropped |
| Export | Postman Collection v2.1 export | FULL | collection/folder/request auth, variables (with secret flag), method/url/structured query/headers/body (all modes)/pre-request+test scripts emitted; re-import round-trips the whole request |
| Codegen | curl | FULL | method/url/headers/body incl. multipart |
| Codegen | raw HTTP | FULL | request line + headers + body |
| Codegen | JavaScript fetch | FULL | fetch() snippet |
| Codegen | Python requests | FULL | requests snippet |
| Codegen | httpie | FULL | http CLI snippet |
| Codegen | Other languages (Go, Java, C#, …) | FULL | Go (net/http), Java (HttpClient), C# (HttpClient), PHP (curl), Ruby (net/http), Node (fetch) |
| Runner | Run a collection (sequential) | FULL | runner.run sends every request depth-first with resolved auth; per-request tests + history recorded |
| Runner | Data files (CSV / JSON iterations) | FULL | CSV (RFC 4180 subset) + JSON-array data files; each row's columns overlay variables for one iteration |
| Protocols | HTTP / HTTPS | FULL | native-tls transport |
| Protocols | WebSocket | FULL | ws:// and wss:// send-and-collect via tungstenite (sync, native-tls), behind the `ws` feature + GUI WebSocket modal; verified against a local echo server |
| Protocols | gRPC | FULL | unary gRPC via gRPC-Web framing over reqwest (grpc-status read from the body trailer frame, no HTTP/2 trailers needed) + protox/prost-reflect dynamic .proto<->JSON; verified end-to-end against a local server + GUI gRPC modal; streaming RPCs are a host concern (stateless invoke model) |
| Storage | Workspace persistence (JSON) | FULL | collections/environments/globals/cookies persisted as JSON |
| Storage | Multiple workspaces | FULL | named workspaces (list/create/switch/rename/delete) with per-workspace history + GUI switcher; names validated against path traversal |
| Settings | Settings persistence | FULL | settings.json document (settings.get/update/reset/path); unknown keys preserved for host/webui prefs |
| Settings | SSL certificate verification | FULL | toggle drives reqwest danger_accept_invalid_certs on every send + GUI Settings |
| Settings | Follow redirects (+ max) | FULL | redirect policy (limited/none) from settings, configurable max + GUI |
| Settings | Default request timeout | FULL | settings default applied to sends unless a per-request timeout overrides it + GUI |
| Settings | Max response size | FULL | captured body capped at the configured size + GUI |
| Settings | Proxy configuration | FULL | reqwest proxy applied to all schemes when set + GUI Settings |
| Settings | Theme / appearance | FULL | dark/light theme + CRT toggle + 5-scheme colour chooser (cyberpunk/midnight/matrix/ember/arctic) with custom-colour editor and saved presets, applied live and persisted |
| Settings | Client certificates (per host) | MISSING | per-host client TLS identities (reqwest identity) not implemented |