API Lab — From scratch beginner course (APIs + Postman)

Full beginner course map

Read in this order. No coding required. Each chapter uses simple words first, then shows the real technical name.

Ch 0 — Internet basics
Client, server, browser, website vs API.
Open →
Ch 1 — What is an API
Restaurant analogy + real life examples.
Open →
Ch 2 — HTTP & URL
How a request travels and how to read a URL.
Open →
Ch 3 — Request parts
Method, headers, body, response, JSON.
Open →
Ch 4 — Methods
GET, POST, PUT, PATCH, DELETE in detail.
Open →
Ch 5 — Practice
Postman-style playground with free APIs.
Open →
Ch 6 — Auth
API key, username/password, Bearer token.
Open →
Ch 7 — Status codes
What 200, 401, 404 mean.
Open →
Ch 8 — Real Postman
Map this lab to the Postman app at work.
Open →
Ch 9 — Mistakes & FAQ
Common errors + beginner questions.
Open →
Ch 10 — Study plan
3-day plan to become confident.
Open →
Glossary
All important words in one place.
Open →

Chapter 0 · From zero

Before APIs: how the internet talks

If “API” feels scary, start here. These 6 words make everything else easy.

1

Client

The side that asks for something. Examples: your phone app, Chrome browser, Postman, or this API Lab page.

2

Server

A computer on the internet that answers. It stores data (users, products, weather) and runs rules.

3

Request

The message the client sends: “Please give me user number 1” or “Please create a new post”.

4

Response

The message the server sends back: success/fail number + data (often JSON text).

5

Website vs API

Website returns a page for humans (HTML, buttons, pictures).
API returns structured data for software (usually JSON).

6

Why not only websites?

Mobile apps, dashboards, and other servers need clean data — not a full webpage. APIs give exactly that.

Everyday example you already use

When you open a weather app:

Your phone (client) sends a request: “Weather for Delhi?”
Weather company’s server receives it.
Server looks up data and replies with temperature, wind, etc. (JSON).
The app draws nice icons for you.

You did not see the API — but the app used an API behind the screen. Postman lets you see that hidden conversation.

What is Postman then?

Postman is a tool (desktop or web) where you manually build API requests, press Send, and read the response. Testers, developers, and support teams use it every day. This website’s playground looks like Postman so beginners can practice without installing anything first.

Chapter 1 · The big idea

What is an API? (from scratch)

API = Application Programming Interface. Plain meaning: a set of rules and URLs that let one program ask another program for data or actions.

Restaurant analogy (keep this forever)

You (customer) → your app / Postman / browser
Waiter → the API (only accepts orders from the menu)
Menu → list of endpoints (/users, /orders, /weather)
Kitchen → server + database
Order ticket → HTTP request (method + URL + auth + body)
Food on plate → response (JSON)

You never walk into the kitchen. You only talk to the waiter using the menu. That is exactly how APIs protect and organize systems.

Real company examples

Payments: your site asks Stripe’s API to charge a card.
Maps: your app asks Google Maps API for directions.
Login: your app asks an Auth API “is this password correct?”
Internal tools: HR system asks Employee API for staff list.
This lab: we ask free public APIs for users, dogs, and weather.

01Client asks

Postman / app builds a request.

02Request travels

Over HTTPS to the server URL.

03Server works

Checks auth, reads/writes data.

04Response returns

Status code + JSON body.

Chapter 2 · HTTP & URLs

HTTP — the language of API calls

HTTP is the rulebook for messages between client and server. HTTPS is the same thing with encryption (the lock icon). Almost all modern APIs use HTTPS.

A

Read a URL like a sentence

https://api.example.com/v1/users/5?active=true

https:// — secure protocol
api.example.com — which server (host)
/v1/users/5 — path (version 1, user id 5)
?active=true — query (filter: only active)

B

Endpoint

One specific URL path the API supports, e.g. GET /users or POST /login. Documentation lists all endpoints like a menu.

C

Base URL

The common starting part shared by many endpoints:

https://jsonplaceholder.typicode.com

Then you add /users, /posts, etc.

Resource = the “thing”

In REST APIs (the most common style), URLs represent resources:

/users → collection of users
/users/1 → one user
/posts → collection of posts
/posts/10/comments → comments belonging to post 10

REST simply means: use HTTP methods + resource URLs in a clear, consistent way.

Chapter 3 · Anatomy

Every API call has these parts

Memorize these five. Postman’s whole screen is just a form for filling them.

1

URL (where)

Address of the resource.

https://jsonplaceholder.typicode.com/users/1

2

Method (action)

GET read · POST create · PUT replace · PATCH edit · DELETE remove

3

Headers (extra info)

Accept, Content-Type, X-Api-Key, Authorization

4

Body (data you send)

Mostly for POST/PUT/PATCH. Usually JSON. GET normally has no body.

5

Response (answer)

Status code + body. Always check the number first (200 good, 401 login problem…).

★

JSON (data format)

Text format computers love. Keys in quotes. Values can be text, numbers, true/false, lists, nested objects.

{
  "name": "Asha",
  "age": 28,
  "skills": ["API", "Postman"]
}

Full request picture (imagine this)

GET /users/1 HTTP/1.1
Host: jsonplaceholder.typicode.com
Accept: application/json

(no body)

---------- server replies ----------

HTTP/1.1 200 OK
Content-Type: application/json

{
  "id": 1,
  "name": "Leanne Graham",
  "email": "sincere@april.biz"
}

Postman hides the raw text and shows friendly tabs — but under the hood it is still this.

Chapter 4 · Methods

HTTP methods — full beginner detail

Think of methods as verbs. Same door (/posts/1), different action. Click each card.

Beginner memory trick

GET = Look / Read
POST = Create new page in the notebook
PUT = Tear out the page and put a full new page
PATCH = Correct one line with a pen
DELETE = Throw the page away

Chapter 5 · Practice setup

How to use the playground (very slow steps)

Do these once. After that, real Postman will feel familiar.

Look left — Collections — ready-made requests. Start with “GET · Users list”.
Method dropdown — must say GET for reading data.
URL bar — the address. You can edit it later when you are confident.
Yellow lesson line — explains what this request teaches.
Params tab — optional filters like _limit=3.
Authorization tab — login style: none / API key / password / token.
Headers tab — usually Accept: application/json.
Body tab — only for create/update. Paste JSON.
Press Send — wait for status badge.
Read status first — green 2xx = success. Then read JSON.

Chapter 5 · Live practice

Postman-style playground (free APIs)

These are real free APIs. No payment. Most need no key. Click left → read the lesson → Send.

First win for beginners: click GET · Users list → Send → look for status 200 and a list of names. That means you successfully called an API.

Step 1 for beginners: list users from a free fake API. No login. No API key. Press Send and look for status 200.

Params = options added after ?. Example: ?_limit=3 means “only 3 results”.

Auth type

Headers are metadata. Auth headers are added from the Authorization tab automatically.

Body = data you send. Needed for POST / PUT / PATCH. Leave empty for GET / DELETE.

Response — —

Press Send.

Beginner tip: always look at the status number first.
200 / 201 = good. 401 = auth problem. 404 = wrong URL.

Chapter 6 · Authorization

How APIs know who you are

Public free APIs often need no login. Company APIs almost always need proof of identity. Here are the 3 types beginners meet first.

Type 1

API Key

Simple idea: the company gives you a long secret password for your app. You send it on every request.

Where do you get it? From that product’s dashboard (after signup) — not from this website.

X-Api-Key: your_real_key_here

Postman: Authorization → API Key → Key name + Value → Add to Header.

Practice here: collection item 10 · API Key demo (fake key, just to see the header).

Never share real API keys in chat, email, screenshots, or GitHub.

Type 2

Username + password (Basic Auth)

Simple idea: like a website login. Username + password are packed into one header.

Authorization: Basic cG9zdG1hbjpwYXNzd29yZA==
# means username:password → postman:password

Safe practice credentials (public test server only):

User: postman
Password: password

Try wrong password once on purpose → you will see 401. That is an important beginner lesson.

Type 3

Bearer Token

Simple idea: login once → server gives a temporary ticket (token) → send the ticket on later requests until it expires.

Authorization: Bearer eyJhbGciOi…

Used by many modern apps (OAuth / JWT). In Postman: Authorization → Bearer Token.

Important for beginners: “Give me the API key”

There is no one global API key for the whole internet. Each service creates keys for your account. Free learning APIs in this course work without a key on purpose.

Chapter 7 · Status codes

Status codes in plain English

The first thing to read after Send. Groups: 2xx success, 4xx your mistake, 5xx server mistake.

Code	Plain English	Beginner action
`200`	OK — it worked	Read the JSON. Celebrate your first call.
`201`	Created	POST created something. Look for new `id`.
`204`	Success, empty body	Common after DELETE. Still success.
`400`	Your request is malformed	Check JSON commas/quotes and required fields.
`401`	Not logged in / wrong secret	Fix API key, password, or token.
`403`	Logged in but not allowed	Ask admin for permission / role.
`404`	Not found	Wrong URL or id does not exist.
`429`	Too many calls	Wait and retry. You hit a rate limit.
`500`	Server broke	Not your JSON. Retry later / tell API owner.

Free APIs used in this course

Yes — these practice APIs are free

Click a card to auto-run in the playground.

Copy-paste cheatsheet

GET  https://jsonplaceholder.typicode.com/users
GET  https://jsonplaceholder.typicode.com/users/1
POST https://jsonplaceholder.typicode.com/posts
GET  https://dog.ceo/api/breeds/image/random
GET  https://api.open-meteo.com/v1/forecast?latitude=28.61&longitude=77.21¤t=temperature_2m
GET  https://httpbin.org/basic-auth/postman/password

Chapter 8 · Real Postman

From this lab → real Postman at work

Install Postman (desktop) or use Postman web. Same ideas, more features for teams.

Create Workspace — place for your team’s API work.
New → HTTP Request — blank request (like our playground).
Method + URL — same as the top bar here.
Params / Authorization / Headers / Body — same tabs.
Send — response panel below (Pretty view for JSON).
Save → Collection — keep requests organized for teammates.
Environments — store {{baseUrl}} and {{apiKey}}. Switch Dev / QA / Prod safely.
Share Collection — export or team workspace so others can run the same tests.

Chapter 9 · Mistakes & FAQ

Common beginner mistakes

If something fails, check this list first.

Wrong method

Using GET when the docs say POST. Always match the documentation.

Typo in URL

/user vs /users → often 404. Copy from docs carefully.

Forgot auth

401 almost always means missing/wrong key, password, or token.

Invalid JSON

Missing comma or quote in Body → 400. Use a JSON validator or Postman format.

Sending body on GET

Most APIs ignore GET bodies. Put filters in Params/URL instead.

Sharing secrets

Pastings keys into public pages or git. Use Postman variables instead.

Beginner FAQ

Short answers to questions new learners ask first.

Do I need to know coding to learn APIs?

No. Start with Postman / this playground. Coding helps later, but understanding requests comes first.

Are the APIs in this course free?

Yes. JSONPlaceholder, Dog CEO, Open-Meteo, and httpbin are free for learning. Most need no API key.

What is an API key in one sentence?

A secret string a service gives your account so their server can recognize your app’s requests.

Why does my company API fail in the browser but work in Postman?

Browsers enforce CORS security rules. Postman desktop is not a browser, so many APIs allow it. That is normal.

GET vs POST — which should I click?

Reading/listing/showing → GET. Creating something new with data → POST. When unsure, read the API documentation line for that endpoint.

What should I learn after this page?

1) Recreate these calls in real Postman 2) Read one internal API doc at work 3) Learn environments/variables 4) Learn how your team stores secrets safely.

Chapter 10 · Become confident

3-day beginner study plan

Share this plan with a teammate who is starting from scratch.

Day 1

Understand + first GET

Read Chapters 0–3
Run GET Users list
Run GET Single user
Run Dog + Weather GETs
Write in notebook: request vs response

Day 2

All methods + status codes

Read Chapter 4 + 7
Run POST, PUT, PATCH, DELETE
Explain PUT vs PATCH out loud
Cause a 401 on purpose, then fix it

Day 3

Auth + real Postman

Read Chapter 6 + 8
Finish API Key + Basic Auth demos
Install Postman and recreate 3 requests
Create a Collection named “API Lab Practice”
Share Collection link/export with a teammate

Glossary (from scratch words)

Keep this open while you practice.

API: Rules + URLs that let programs talk to each other.
Client: Who asks (browser, app, Postman).
Server: Who answers and stores data.
HTTP / HTTPS: Message rules. HTTPS is encrypted HTTP.
Endpoint: One API URL path, e.g. /users/1.
Method: Verb: GET, POST, PUT, PATCH, DELETE.
Header: Extra request metadata (auth, content type…).
Body / Payload: Data you send (usually JSON).
JSON: Popular text format for API data.
Status code: Number saying success or type of error.
API key: Secret string identifying your app/account.
Basic Auth: Username + password packed into a header.
Bearer token: Temporary ticket after login.
REST: Common API style using resources + HTTP methods.
Collection: Saved group of Postman requests.
Environment: Named variables like Dev/QA base URL and keys.
Query param: Filter after ? in the URL.
Path param: Changing part of the path, like id 1.
CORS: Browser rule that can block some API calls from web pages.
Rate limit: Max requests allowed in a time window.

Learn APIs from absolute scratch.

Full beginner course map

Before APIs: how the internet talks

Client

Server

Request

Response

Website vs API

Why not only websites?

Everyday example you already use

What is Postman then?

What is an API? (from scratch)

Restaurant analogy (keep this forever)

Real company examples

HTTP — the language of API calls

Read a URL like a sentence

Endpoint

Base URL

Resource = the “thing”

Every API call has these parts

URL (where)

Method (action)

Headers (extra info)

Body (data you send)

Response (answer)

JSON (data format)

Full request picture (imagine this)

HTTP methods — full beginner detail

Beginner memory trick

How to use the playground (very slow steps)

Postman-style playground (free APIs)

How APIs know who you are

API Key

Username + password (Basic Auth)

Bearer Token

Important for beginners: “Give me the API key”

Status codes in plain English

Yes — these practice APIs are free

Copy-paste cheatsheet

From this lab → real Postman at work

Common beginner mistakes

Wrong method

Typo in URL

Forgot auth

Invalid JSON

Sending body on GET

Sharing secrets

Beginner FAQ

3-day beginner study plan

Understand + first GET

All methods + status codes

Auth + real Postman

Glossary (from scratch words)