Vibe code your own Postman — vibecode it yourself

You can vibe code your own Postman as a saved request and a send button. Postman is that product. The catalog line is “A saved request, a send button, the response.”

Solo is $9 a month, billed annually. Team is $19 a user a month on that same annual billing. Monthly is $12 for Solo and $23 for Team. Enterprise quotes are outside the note. The first estimate is 8 hours. The card marks it Weekend, and it scales with the team. The verdict is “Collections are enough”.

Last time I wrote about vibe coding your own SurveyMonkey. That was a teardown. This one is a regular backlog topic. Mock servers, monitors, an API catalog, and Git sync stay on the skip row.

Vibe code your own Postman from a collection

The Postman page splits the work into three rows.

The first row is 8 hours. Collections, a request editor, and a proxied send. You save the calls a project actually uses. You press send. You read the status and the body.

The second row is 3 days. Environments, variables, history, and a JSON import. {{baseUrl}} can wait until the same request already works with the URL typed in.

The third row is a month and up. Mock servers, monitors, an API network, and Git sync. The table labels that row as the part you should skip.

If you tell an agent to “clone Postman”, it aims at the third row. Copy the prompt, then pin it to the first one.

Store Collection, Request, Environment, and HistoryItem. The card names all four. For these 8 hours, Collection and Request are enough. Environment and HistoryItem arrive on the 3-day row.

A collection is a named group of calls, with folders if you want them. A request is the method, the URL, the query, the headers, and the body. An environment is a bag of names you substitute at send time. A history item is the snapshot of what actually left the server, kept after you edit the saved request.

The audience is a developer keeping the HTTP calls one project uses. The goal is to store them, send them, and read the response without a hosted API platform. The same v1 also stands in for Insomnia and Hoppscotch. The card lists both and does not give them prices.

A webhook that runs when something else happens is Zapier at $30–$69 a month, in Build a Zapier alternative. A scheduled pipe between three internal systems is Make at $10–$29 a month. An internal lookup screen on top of a database is Retool at $12–$65 a person a month, in Build a Retool alternative. Those products fire on their own. This one waits for you to press send.

The guardrail is the rule you paste into the prompt. Proxy every outbound request on the server. Use a timeout, a size cap, and a blocklist for private-network addresses.

The public file format is worth knowing so the 3-day import has a target. Collection v2.1 is a JSON document. info names it. item is the list of requests. Each item has one request. Collection variable entries are separate from environments. Newman runs that v2.1 file from the command line. The Postman CLI, on that same page, is what runs newer collections plus mocks, monitors, and Git. You do not need either runner for the 8-hour row. You need a row in D1 and a send button.

How does a Postman alternative work

I am describing the catalog’s model of one saved call. You keep the request. The server sends it. You see what came back.

Your browser talks to one Astro app. Node.js plus Astro is the default. Use TanStack Start if React is your weekday language. The capability line on the card is Astro, Alpine, and D1. A little client script helps the header list. The send itself stays on the server.

Ada keeps the Oak orders API in one collection. The folder is Orders. The request is “Get order 1042”. Method GET. URL https://api.oakandco.test/orders/1042. One header, Authorization, with a bearer token she pasted. No body.

She presses Send. The browser posts that spec to the app. It does not call api.oakandco.test itself. The app checks the host before anything leaves. Loopback, private ranges, and link-local addresses are refused. That includes 127.0.0.1, 10.0.0.0/8, and 169.254.169.254, the address cloud instances use for metadata. A URL that points at your own machine, or at the host’s metadata service, is the bug this guardrail exists to stop. The check has to happen on the server. A check that only runs in the page can be skipped.

If the host is allowed, Node fetches it with a timeout and a cap on the response body. A few seconds, and a body small enough to show on the page, is enough. The pane then shows the status, the response headers, the time, and the body. A timeout shows up in that same pane.

The saved request stays what she typed. On this row you do not also write a history item. The 3-day row does. That snapshot matters once she edits the URL to order 1043 and still wants to see what 1042 returned. Until then, the saved request is the record.

Secrets are the awkward part of even this small version. The token sits in the header she saved. The card does not give you a vault on the 8-hour row. Do not print that header into a shared log. Do not put the collection in a public repo to “back it up”. The non-goal already refuses Git sync. A private SQL row, scoped to her account, is the storage.

Every query is scoped by owner. A guessed collection id from another account returns an empty page. The proxy will not fetch on behalf of a signed-out visitor.

Environments show up on the 3-day row because the substitution is easy to get wrong. Postman’s own variables doc lists scopes from broad to narrow: global, collection, environment, data, and local. One environment is active at a time. {{baseUrl}} in the URL is replaced when you send, not when you save. A missing name should fail the send with the name still visible. It should not silently request the literal braces. Collection variables, in the v2.1 schema, are not a place for secrets. Their note says so. If Ada’s token moves into a variable, treat that as the 3-day work, and still keep it out of a client-side log.

JSON import is the other half of that row. Accept a v2.1 file, show the request names, and write them. Do not also import scripts, tests, or auth helpers on the first pass. Those fields exist in the schema. The card does not ask for a script runner.

Screens of a Postman alternative

v1 needs the collection and the request editor. The response pane lives on the editor. Environments, the history list, and an import button can wait.

Collection

The collection screen is the name, the folders, and the requests. Oak API has one folder, Orders, and one request. Add request is how a second call gets in. Opening “Get order 1042” is the editor.

One collection, one folder, one saved call. The list is the thing you open every time you debug that order route.

Request

The editor is the method, the URL, the header list, and Send. Under that, the pane shows status, time, and body. Order 1042 came back 200 in 180 ms. The body is the JSON the server returned, cut off if it passed the cap. Save writes the request. Send does not write a second copy yet.

Send goes to your app. The pane is the status, the time, and the body that came back.

How a saved request gets sent

Ada opens Oak API, picks Get order 1042, and checks the URL. She hits Send. The app rejects the call if she is signed out, or if the host is private. Otherwise Node performs the GET, applies the timeout, and returns the pane.

She changes the path to /orders/1043 and saves. The next send uses 1043. Nothing in v1 still shows the 1042 response after that save. That gap is the history item on the 3-day row.

A teammate on another account cannot open her collection. The token never travels to the browser as part of a log line. It travels as the header she stored, and the server attaches it on the way out.

The browser never calls the API directly. The saved request and the response pane are two different moments.

D1 keeps the collection. Node performs the call. Mocks and monitors stay dashed.

What the later rows are for

The 3-day row is how one collection survives more than one host. An environment named Local and another named Production each hold baseUrl. The saved request stores {{baseUrl}}/orders/1042. Send resolves the active environment. History then stores the URL that was actually fetched, so a switch from Local to Production does not erase the earlier result.

The month row is the hosted platform. A mock server answers when the real API is down. A monitor sends the collection on a schedule. An API network is a catalog other people browse. Git sync reviews the collection like code. The Postman CLI page lists those next to the runner. Newman stops at executing a v2.1 collection. Your 8-hour app sends one saved call.

The scope post is the same three-row habit. The prompt post is where you paste the private-host rule so the agent does not send the browser straight at the URL.

Start with the first row

Go to Build your own Postman. Copy the Astro prompt, or TanStack Start if that is what you write.

Tell the agent the first estimate only. Collections, a request editor, and a proxied send. Eight hours.

Save Get order 1042, send it, and read the 200. Then point a copy of that request at http://127.0.0.1 and confirm the app refuses before it fetches. If you need {{baseUrl}}, a history list, or a monitor that runs while you sleep, keep the Solo plan for that part.