Postman compatibility
Restura runs scripts in a QuickJS WASM sandbox built around a native rs.* API. pm is a live alias of the same object, so existing Postman scripts run unchanged — and full Postman v12 sandbox parity means most of the surface is present. Here’s the mapping.
What works
Section titled “What works”| Postman API | Restura support |
|---|---|
pm.request | Read access to method, URL, headers, body. |
pm.response | .code, .status, .text(), .json(), .responseTime, .headers.get(...), .to.have.status/header/body/jsonBody, .to.be.ok/json/html/info/success/redirection/clientError/serverError/error. |
pm.environment / pm.collectionVariables / pm.globals / pm.variables | Full get/set/unset/has. pm.collectionVariables reads/writes the request’s actual owning collection and persists mutations back to it. |
pm.test(name, fn) | Test assertions with named scope. Sync or async. |
pm.expect(value) | chai-style assertions: .to.equal, .to.be.a, .to.include, .to.have.property, etc. |
pm.iterationData | Data-driven runs (CSV / JSON rows) — .get/.set/.has/.toObject() reflect the actual current row during a collection run (single-send: empty). |
pm.info | .requestName, .requestId, .iteration, .iterationCount, .eventName ('prerequest' / 'test') — populated from the real request during a send or collection run. |
pm.execution.location | .collectionName, .currentRequestName, .folderPath — always a real object (never undefined), populated during collection/folder runs. |
pm.cookies | Cookie jar lookup, plus an async .jar() for get/set/clear. |
pm.sendRequest(input, cb?) | Fire an ad-hoc request through the SSRF-guarded proxy. Returns a promise. Works from every script surface — the interactive Send button, gRPC, and collection/CLI runs. |
pm.execution.setNextRequest / skipRequest | Runner flow control. |
pm.visualizer.set(template, data) | Custom HTML response visualizations. |
pm.vault | Encrypted secret vault (await pm.vault.get(...)). Restura-native. Desktop only. |
require(name) | Bundled library set: ajv, chai, cheerio, crypto-js, csv-parse/sync, lodash, moment, postman-collection, tv4, uuid, xml2js. |
console.log/warn/error | Output to the script panel. |
postman.setEnvironmentVariable / getEnvironmentVariable / clearEnvironmentVariable | Legacy pre-pm API — aliases for pm.environment.*. |
postman.setGlobalVariable / getGlobalVariable / clearGlobalVariable | Legacy aliases for pm.globals.*. |
postman.setNextRequest(name) | Legacy alias for pm.execution.setNextRequest(name). |
tests["assertion label"] = true/false | Legacy object-literal test style — equivalent to pm.test(label, () => ...). |
Inline helpers (in {{...}})
Section titled “Inline helpers (in {{...}})”| Helper | What it returns |
|---|---|
{{$randomUUID}} | UUID v4 per request. |
{{$guid}} | Alias for $randomUUID. |
{{$timestamp}} | Epoch seconds. |
{{$isoTimestamp}} | ISO 8601 timestamp. |
What doesn’t work
Section titled “What doesn’t work”- Raw
fetch/XMLHttpRequest— usepm.sendRequest(...)for network access. - Arbitrary
require('...')beyond the bundled set above — no reaching into npm or Node core. - DOM globals and the filesystem — the sandbox has neither.
Why the limits
Section titled “Why the limits”The sandbox is intentionally narrow:
- Shared collections are everywhere. Scripts from a downloaded collection should never be able to exfiltrate data or escape the request context — hence no raw network and no arbitrary modules.
- Predictable runtime. Memory and execution-time caps mean a malformed loop can’t take down the app.
Related
Section titled “Related”- Scripts — the script editor, the
rs.*API, and examples. - Workflows — declarative chaining where you’d otherwise script.
- Import & export — importing Postman v2.1 collections.