skip to content

Variable Stores

Named stores a request pulls a value from instead of carrying it literally, and the rules that decide which store answers. Interviewers ask because a wrong guess explains most surprise failures.

part ofAPI & DB clientsoverview, primer and where to startread it →
on this pageshow

explore

questions

23

In an exported Postman collection file, where do collection variables live and how do scripts read them?

level: juniorimportance: must knowfreq 72%

answer

  1. It is text in the file
  2. Sits beside info and item
  3. An array named for what it holds
  4. Scripts reach it as pm.collectionVariables

basics

~10 s

Collection variables live in the collection document's own variable array, a field of the file itself, so they travel with every export and every commit. Scripts read them through the sandbox object pm.collectionVariables.

solid answer

~50 s

The collection **format** declares a top-level array named `variable` on the collection document, and each entry is an object with a `key` naming the value and a `value` holding it. Because that array is a field of the file, it is part of whatever you export, import or commit — the store and the collection are the same artefact. When the SDK parses the document it reads that array into a variable scope, and the sandbox hands that scope to scripts as `pm.collectionVariables`, so a script simply reads a value the file already carried. The array is not confined to the top level either: a folder inside `item`, or a single request, may declare one too. Contrast it with `pm.globals`, which no collection schema describes at all and which therefore sits outside the file entirely.

code

json · 7 lines
json
{
  "info": { "name": "Orders" },
  "item": [],
  "variable": [
    { "key": "baseUrl", "value": "https://api.example.test" }
  ]
}

go deeper

for a junior

Be ready to say where a collection variable is kept: inside the collection document itself, in its own variable array, and read from a script as pm.collectionVariables.

for a middle

Explain the ownership chain out loud: the format declares the variable field, the SDK parses it into a variable scope, and the sandbox hands that scope to scripts.

for a senior

Show what the placement buys you: the store ships with the artefact, so anyone who imports the file runs with the same values and every change to one is visible as a diff.

for a principal

Own the standard. Decide what your teams may bake into a committed collection's variable array, what has to live outside it, and how that rule is enforced at review time.

## The store is a field of the collection document A Postman collection is a JSON document, and the **collection format** — the schema that says what a collection file may contain — declares a top-level array named `variable`. Every entry in it is a variable object: a `key` that names the value and a `value` that holds it. None of this is runtime state. It is text in the file, sitting beside `info` and `item`, saved, exported, imported and committed exactly the way the requests are. That single fact carries most of the answer. **The collection variable store and the collection are the same artefact.** You cannot hand somebody the collection and hold back its `variable` array, and you cannot change the store without producing a change in the file. ## What a script sees When the SDK parses a collection document, it reads that array into a variable scope object. The sandbox — the environment a pre-request or test script runs inside — hands that scope to your code as **`pm.collectionVariables`**: ```javascript const baseUrl = pm.collectionVariables.get('baseUrl'); ``` Three names, three different owners, and the distinction is exactly what a careful interviewer listens for: - `variable` is a **field name**, and it belongs to the collection **format**; - the variable scope is a **class**, and it belongs to the **SDK** that parses the file; - `pm.collectionVariables` is a **sandbox** member — the handle a script is given. Saying that the app *lets you make* collection variables is the weak answer. Saying that the collection document *declares* them, and that the sandbox merely exposes what the document already carried, is the strong one. ## The array is not only at the top The same `variable` array is available in more than one place inside the document. A folder in the `item` list may declare one, and so may an individual request. Wherever it sits, it is still a field of the file: | Where the array sits | Written into the file | Comes with an export | |---|---|---| | The collection itself | Yes | Yes | | A folder in the `item` list | Yes | Yes | | A single request | Yes | Yes | | The store behind `pm.globals` | No | No | The last row is the contrast this topic exists for. `pm.globals` is a real sandbox handle, but **no collection schema describes a globals store at all**; it is kept outside the file, which is why a global does not travel with a collection you share. ## Why the shape matters in practice Because the store is part of the document, several things follow that people otherwise learn the hard way: - an import gives a teammate the same `variable` entries you ran with, with no extra step; - a change to a value appears as a diff in the collection file, so somebody can review it; - a run on a machine that holds only the file still has those values available; - and anything you did **not** put into the document is, from the file's point of view, simply not there. That is also the honest limit of the store. A value that genuinely differs per person or per deployment is a poor fit for an array everyone receives identically, and a real credential has no business sitting in a document you pass around. ## What this does not settle Keep the boundary clean when you answer: 1. **Which store answers a name** that appears in more than one of them at run time is resolution mechanics — a separate subject with its own rules. 2. **Per-deployment values kept in their own file** are the environment store's subject, not this one. 3. **Keeping a credential out of a shared file** has its own mechanism and its own question. 4. **Carrying a value from one request to the next** during a run is a flow question, not a storage question. Answer the one you were actually asked: the collection's own `variable` array is declared by the format, lives inside the document, appears on the collection and on the folders and requests within it, and reaches scripts as `pm.collectionVariables`.

  • Is that `variable` array only allowed at the top of the collection?
    No. The same array is declared on a folder inside the `item` list and on an individual request as well, so an entry can be written next to the part of the document it belongs to. All three placements are fields of the same file, so all three are exported and committed with it.
  • You export the collection and hand the file to a teammate — what arrives with it?
    Everything the document declares, including its `variable` array, because that array is a field of the file rather than state beside it. What does not arrive is anything you only ever held in `pm.globals`: no collection schema describes that store, so there is nothing in the file to carry it.

saying these in an interview costs you the question

  • Says collection variables are stored in an environment file
  • Thinks the store exists only at run time, not in the document
  • Assumes a global travels with an exported collection
  • Believes only the collection root may declare a variable array
  • Credits the app rather than the format for declaring the field
open as a page

In a Postman request, what does a dollar-prefixed placeholder like {{$guid}} or {{$timestamp}} produce on each send?

level: juniorimportance: must knowfreq 62%

basics

~20 s

Postman's dollar-prefixed placeholders are generators supplied by the collection SDK: {{$guid}}, {{$timestamp}}, {{$isoTimestamp}} and {{$randomInt}} manufacture a value while the request is assembled. Nothing is read from a saved store and nothing is kept afterwards.

open as a page

In Postman, what does an environment file contain, and how does a run read those values?

level: juniorimportance: must knowfreq 76%

basics

~20 s

A Postman environment file is a separate JSON document holding an id, a name and a values array of key, value, type and disabled entries. A run is pointed at one file and loads it as a variable scope.

open as a page

When several Postman stores define the same variable name, which value does pm.variables.get return?

level: juniorimportance: must knowfreq 68%

basics

~10 s

pm.variables walks a fixed chain and returns the first non-disabled match: its own local values, then iteration data, then the environment, then collection variables, then globals. An environment value therefore beats a collection variable.

open as a page

A Postman request goes out with the literal text {{baseUrl}} still in its URL — what happened?

level: juniorimportance: must knowfreq 70%

basics

~20 s

Nothing supplied a usable value for that name. The substitutor replaces a double-brace match only when the lookup yields a string, number or boolean; otherwise it returns the matched text unchanged, so the token itself is sent.

open as a page

Why does a value held in Postman's pm.globals not reach a teammate who imports your collection?

level: middleimportance: must knowfreq 60%

basics

~10 s

No collection schema describes a globals store at all. It is held outside the collection document, so an export carries the file's own variable array and nothing whatsoever from pm.globals.

open as a page

In Postman, what happens to {{$timestamp}} if a variable literally named $timestamp exists in a run's scopes?

level: middleimportance: must knowfreq 50%

basics

~20 s

The saved variable wins and the placeholder stops generating. Postman's dollar-prefixed generators are registered as substitution defaults consulted last, so a same-named variable is found first and {{$timestamp}} returns its stored value on every send, silently.

open as a page

In a Postman script, how do pm.environment.unset and pm.environment.clear differ?

level: middleimportance: must knowfreq 58%

basics

~10 s

pm.environment.unset(key) removes one named entry from the run's environment scope. pm.environment.clear() takes no argument and empties the whole scope, including every entry the environment file supplied.

open as a page

In Postman variable resolution, how does a disabled entry affect which store's value a script reads?

level: middleimportance: must knowfreq 46%

basics

~20 s

A disabled entry counts as absent. Postman's VariableScope requires a match to be present and not disabled, so the search steps over it and continues into the next layer, letting a farther store supply the value.

open as a page

In a Postman variable, how is a value marked as secret, and does the collection format's schema declare it?

level: middleimportance: must knowfreq 45%

basics

~20 s

Postman's collection SDK marks a secret with a Boolean secret property on a Variable, and it is the variable scope's only tracked property. The collection format's schema never declares it, and there is no variable type called secret.

open as a page

In a Postman script, what does pm.vault.get('apiKey') return, and how must the script consume it?

level: juniorimportance: should knowfreq 34%

basics

~20 s

It returns a Promise, so a Postman script must await it or chain then; the value never arrives synchronously. The vault interface offers get, set and unset, all promise-returning, unlike a variable scope's synchronous get.

open as a page

In a Postman collection file, which nodes besides the collection root can declare their own variable array?

level: middleimportance: should knowfreq 36%

basics

~20 s

A folder and an individual request can each declare a variable array of their own, exactly as the collection root does. All three placements are fields of the collection document, so all three travel with the file.

open as a page

In a Postman collection, how does a token like {{host-{{env}}}} resolve, and what may a name never contain?

level: middleimportance: should knowfreq 42%

basics

~20 s

Innermost first. The extraction pattern excludes braces from a captured name, so only the inner token matches on the first pass; substitution then repeats and the composed name resolves later. A name may never contain a brace.

open as a page

In a Postman script, what does pm.variables.replaceIn('{{base}}/orders/{{id}}') return, and when would you use it?

level: middleimportance: should knowfreq 32%

basics

~20 s

The template with every token it can answer already replaced, and any it cannot left literal. It runs the same expansion the runtime runs over a request, on a string the script hands it, and returns the expanded result.

open as a page

Which Postman variable store would you commit to version control with the collection, and why?

level: seniorimportance: should knowfreq 45%

basics

~20 s

Commit the collection document's own variable array: it is a field of the file the repository already tracks, so its entries diff and review like any other change. Nothing in pm.globals is committable, since it lives in no file.

open as a page

Every iteration of a Postman run sends an identical X-Request-Id although the header is set to {{$guid}}. Why?

level: seniorimportance: should knowfreq 38%

basics

~20 s

Something in the run holds a variable keyed literally $guid. Postman's dollar-prefixed generators are registered as substitution defaults consulted last, so that saved value answers the name first and the header repeats unchanged, with no error raised.

open as a page

Does pm.environment.set during a Postman run change the environment file the run was given?

level: seniorimportance: should knowfreq 44%

basics

~20 s

No. The run reads the environment file once into a variable scope, and script writes are tracked mutations against that in-memory scope. The file on disk is never rewritten; capturing the end state is a separate, explicit step.

open as a page

When one Postman variable store holds two entries with the same key, which one does a script read?

level: seniorimportance: should knowfreq 30%

basics

~20 s

The last enabled entry wins. Postman's SDK resolves a duplicated key by scanning the stored list in reverse for the first entry that is not disabled, so later definitions shadow earlier ones within the same store.

open as a page

In a Postman run, why can a script read an environment variable as undefined while the request still sends its value?

level: seniorimportance: should knowfreq 26%

basics

~20 s

Postman's runtime clones the environment, globals and collection scopes for a script and blanks any flagged secret the host declined to expose, while the request keeps substituting from the untouched originals. Script and request are deliberately given different views.

open as a page

At what point in a Postman or Newman run is a {{token}} in the request URL actually expanded?

level: seniorimportance: should knowfreq 36%

basics

~20 s

Immediately before the send. The runtime resolves the item and its auth in the request step, after the pre-request script has finished, so a value the script has just written is already visible to the expansion.

open as a page

What does keeping Postman values in a separate environment file rather than the collection buy and cost?

level: principalimportance: should knowfreq 37%

basics

~20 s

It buys one collection artefact that runs against many targets, since only the value file changes. It costs self-sufficiency: the collection alone will not run, the two files drift, and a missing key surfaces only at send time.

open as a page

In the Postman SDK, what does VariableScope.set do when the existing entry for that key is disabled?

level: seniorimportance: nice to knowfreq 24%

basics

~20 s

It appends a second entry rather than editing the existing one. Postman's SDK updates in place only when the entry it finds is enabled, so a disabled entry is left untouched and a new enabled entry joins it.

open as a page

In a Postman run, why might a vault secret resolve into one request's URL but not into another's?

level: seniorimportance: nice to knowfreq 17%

basics

~20 s

A vault variable can carry a domains array of URL match patterns. The runtime compiles them and offers the variable only to requests whose URL they match, so a non-matching URL keeps the token literal.

open as a page