List the API requests saved in this Gostman workspace: id, name, method, URL template, folder, tags, whether each has checks (hasTests) and whether it has saved example responses. Call this first to find a request to send instead of writing a curl command.

Show one saved request in full: URL, headers, body, auth settings, its own variables (vars), assertions, extraction rules, scripts and the names of its saved examples. Credentials are masked; variables appear as {{name}}. options lists only the settings that differ from the defaults.

Send a saved request (give request) or an ad hoc one (give url). Prefer this over curl in a shell: Gostman fills in {{variables}}, auth, cookies and OAuth tokens itself, so no secret has to appear in the command or in the result, and a login made by one call is still in effect for the next. Saved requests also run their scripts, extraction rules and assertions. Returns two parts: a JSON summary (status, duration, size, content type, the address as sent in resolvedUrl with variable values shown as {{name}}, test results, script console output, names of cookies and variables that were set, and body.bytes, body.returnedBytes, body.truncated) followed by the response body as text. When body.truncated is true, narrow the answer with select or raise max_body_bytes. failed is true when the request could not be sent or a test did not pass. unresolved lists placeholders that have no value; withheld lists secrets that were not filled in because none of the developer's requests sends them to this address.

Send every request in a folder, or in the whole workspace, in order, with scripts and assertions, the way the collection runner does. tags and exclude_tags narrow the run to a subset such as smoke tests; data and iterations repeat it. Use it to check that an API still works after a change. Returns the counts and, for failed requests only, the error, the failed checks (failedTests) and the console output.

Show the last response a saved request got in this session, from send_request or run_folder, without sending it again. When the request has saved examples, also compare the response with one: status, content type and, for JSON, the paths that differ.

Create a request in the workspace, or update one by id, so the developer finds it in the Gostman app and it can be re-run later. Only the fields you give are changed. Secrets are refused: a value that matches a variable or a credential must be written as {{name}}. Returns the request's id, name and folder.

Add requests to the workspace from an OpenAPI or Swagger spec, a Postman, Insomnia or Bruno collection, a HAR file, .http requests or a curl command. Nothing existing is changed: the collection settings of a Gostman export are adopted only when the workspace has none. Scripts and OAuth 2.0 settings are removed (listed in leftOut; warnings describe the source document), and an import that holds a credential, reads local files or runs local commands is refused. Returns what was added.

List the environments of the workspace with the names of their variables, which one is active, and the names of the variables that have a value in this session. Values are never returned; reference a variable as {{name}}. Names under secret get their values from the developer; when one is missing from sessionVariables, ask the developer to pass it with --var-from-env.

Choose the environment whose variables fill in {{name}} for the rest of this session, for example to switch from Local to Staging. The environment's variables are read again and variables set by earlier requests are cleared; cookies and OAuth tokens are kept.

Save plain variable values such as baseUrl or userId in an environment file of the workspace, so later requests and the developer's app use them. Credentials are refused, and so are variables the developer marked secret. Values set here never let requests reach a new host.

Check an OpenAPI 3 or Swagger 2 document against Gostman's built-in rules: missing operation ids or descriptions, undeclared path parameters, missing error responses, undefined security schemes, broken $refs and similar. Returns the counts and findings.

Look for credentials typed into the workspace's requests, environments, scripts and saved examples. Findings show where and why, with at most the first four characters of a value. Run it before the developer commits or shares the workspace.

Send one saved request many times at once and report throughput, latency percentiles, status codes and error samples. Limited to 20 at once, 30 seconds and 5000 requests, to hosts this session may call. Only test systems the developer owns.

Start a mock server on localhost that answers each saved request's path with its saved example response. Use it to develop against an API that is not running. Returns the address and, per request, whether it is served and why not.

Stop the mock server started with start_mock.

Report whether the mock server is running, its address, its routes refreshed from the workspace, and the last requests it answered.