In a Postman run, why might a vault secret resolve into one request's URL but not into another's?

## A vault variable can carry a domain list Most variables in a Postman run are offered to whatever is being substituted, and the only thing that decides the outcome is whether a key matches. **Vault variables are different**: one can carry a piece of metadata named `domains`, an array of URL-match-pattern strings, and that array narrows where the value is allowed to appear. So the answer to "why did it fill in here and not there" is usually not a typo, a scope problem or a timing problem. It is that the *request's URL* did not match the *variable's* pattern list. ## How the list becomes a matcher Before the run walks its items, the runtime prepares the vault scope once and mutates it in place: 1. It visits every variable in the scope and reads the `domains` array off the variable's metadata. 2. A variable with no array, or an empty one, is left exactly as it is. 3. For a variable that has one, each entry is parsed as a URL and rewritten into a normalised pattern of the form *protocol, remote, any port, any path* — the **path is deliberately ignored**, and a missing protocol defaults to a secure one. 4. Those patterns are compiled into a **`UrlMatchPatternList`** — the same list type the SDK uses for a proxy's bypass list and a client certificate's `matches` — and stored back on the variable. 5. The scope is marked as having domain patterns, and a helper is attached to it that returns, for a given URL string, the sub-list of variables whose patterns test true. The scope is only prepared once; a second call sees the marker and returns immediately. ## When the match runs The matching happens as the runtime resolves the request's URL, and it can happen **twice**: - First, the raw URL string of the request is tested — with a protocol forced onto it if the URL has none — and the matching vault variables are collected. - Substitution then runs over the URL. - If substitution actually changed the URL, the resolved URL is tested **again** and the matching set is recomputed, because a brace token in the host could have moved the request to a different origin. Only vault variables are re-applied in that second pass; the other scopes are already resolved. That second pass is the detail worth knowing. A vault secret gated to one host will not leak into a request whose host only *becomes* that host after another variable is substituted in — the check is re-run against what the URL actually became. ## What that means in practice | variable | domain list | offered to | |---|---|---| | ordinary vault variable | absent or empty | every request URL | | gated vault variable | one or more patterns | only URLs its patterns match | - **No domains means no filter.** An absent list is permissive, not restrictive; the helper returns the variable unconditionally. - **The path does not matter.** Patterns are normalised to any port and any path, so gating by a path prefix is not a thing you can express. - **The comparison is against the URL string**, so a host reached by two different spellings is two different matching decisions. - **A non-match is silent.** The token is simply left unresolved rather than raising an error, which is why this presents as a request going out with a literal brace token in it. ## Diagnosing it Start from the URL, not from the variable. Take the request's URL exactly as it is about to be sent — after any pre-request script has rewritten it — and ask whether the variable's patterns cover that protocol and host. If the URL is itself built out of variables, resolve it first; the runtime does the same thing, and it is the resolved form that decides the second pass. If the value fills in for one request and not its neighbour, compare the two hosts before you compare anything else. The interviewer is checking whether you know that a vault value has a **reach**, and that the reach is expressed as URL match patterns rather than as folders, environments or collections. Anyone who answers "check the environment you selected" has the wrong model.