/postman Email Testing

Postman is great for exercising your own API, but verification flows depend on an email you can’t normally see from a collection. With the OpenInbox API you create a disposable inbox in one request, poll a second request until the email lands, and pull the OTP out of textBody in a test script. The whole collection then runs in CI with Newman. Everything below uses the real OpenInbox endpoints.

How the flow works

• Request 1 "Create inbox" → POST /api/inbox (no auth); a test script saves the email to an environment variable.
• Request 2 "Trigger" → hit your own app so it sends the verification email to that address.
• Request 3 "Poll for email" → GET /api/inbound/api/emails?inboxEmail={{inbox_email}} with X-API-KEY; the test script loops until an email arrives and extracts the OTP.
• Use the captured {{otp}} variable in the next request to complete verification.

Setup

Create a Postman environment with two variables: base_url = https://api.openinbox.io/api and openinbox_api_key = your premium key. The inbox_email and otp variables are filled in at run time by the test scripts. Never hard-code the key into the collection.

{
  "base_url": "https://api.openinbox.io/api",
  "openinbox_api_key": "your-premium-api-key",
  "inbox_email": "",
  "otp": ""
}

Request 1 — Create inbox

Method POST, URL {{base_url}}/inbox, no auth header. In the request’s Tests tab, save the generated address so later requests can poll it.

// POST {{base_url}}/inbox
const inbox = pm.response.json();
pm.environment.set("inbox_email", inbox.email);
pm.test("Inbox created", () => {
  pm.expect(inbox.email).to.include("@");
  pm.expect(inbox).to.have.property("id");
});

Request 3 — Poll for the email and extract the OTP

Method GET, URL {{base_url}}/inbound/api/emails?inboxEmail={{inbox_email}}, with a header X-API-KEY: {{openinbox_api_key}}. The Tests script below loops by re-running itself via postman.setNextRequest until an email arrives (cap the attempts so it can never loop forever), then pulls the OTP from textBody. Pair it with Newman’s --delay-request so each retry waits ~2 seconds.

// GET {{base_url}}/inbound/api/emails?inboxEmail={{inbox_email}}
// Header: X-API-KEY: {{openinbox_api_key}}
const { emails } = pm.response.json();
const attempts = (pm.environment.get("attempts") || 0) + 1;
pm.environment.set("attempts", attempts);

if (emails.length === 0 && attempts < 15) {
  // Re-run this request; pair with: newman run ... --delay-request 2000
  postman.setNextRequest("Poll for email");
} else {
  pm.environment.unset("attempts");
  pm.test("Verification email arrived", () =>
    pm.expect(emails.length).to.be.above(0),
  );
  const otp = (emails[0].textBody.match(/\b\d{4,8}\b/) || [])[0];
  pm.environment.set("otp", otp);
  pm.test("OTP extracted", () => pm.expect(otp).to.match(/^\d{4,8}$/));
}

Running it in CI with Newman

Export the collection and environment, then run them with Newman. --delay-request spaces out the polling retries, and you inject the API key at run time so it never lives in the exported files.

npm i -g newman

newman run openinbox.postman_collection.json \
  -e openinbox.postman_environment.json \
  --delay-request 2000 \
  --env-var "openinbox_api_key=$OPENINBOX_API_KEY"