Mándalo

Home/Docs/Importing from Postman

Importing from Postman

Point Mándalo at an exported Postman collection and it writes ordinary .http files into your workspace, then tells you exactly what it did — including what it refused to convert.

Running the import

Export your collection from Postman (Collection v2.1 JSON), then import that file into a Mándalo workspace. The importer creates one collection, mirrors the Postman folder structure as directories, writes one .http file per request, and converts any environments contained in the export.

Import is additive: it writes new files and never deletes what is already in the workspace. Because everything lands as files, the safest way to run one is on a clean git tree — then git diff is your import review.

What maps cleanly

  • Folder structure — Postman folders become directories, nesting preserved.
  • Requests — method, URL, headers and description.
  • Bodies — raw bodies come across as-is; URL-encoded form bodies are converted, and a Content-Type is added if the export did not carry one. GraphQL bodies become native GraphQL requests with their query and variables.
  • Auth — bearer, basic, and API key (including whether the key goes in a header or the query string). Collection-level auth is applied to requests that do not override it.
  • Variables — Postman's {{variable}} syntax is identical to Mándalo's, so templates are passed through untouched. Environments in the export become files in environments/.

What does not

Some things are skipped, some are imported with a warning, and the report distinguishes the two.

  • Unsupported body modes are skipped — the request is not written, and the report names it. Multipart file uploads are the common case.
  • Unsupported auth types are downgraded — OAuth 1 and 2, AWS SigV4, NTLM, Digest and friends have no equivalent, so the request is imported with auth set to none and a warning. You will need to supply a token yourself, usually via a login request plus a capture.
  • Scripts are imported verbatim, not translated — a Postman pre-request or test script is copied into the request file with a warning that it has not been executed. Anything using APIs the sandbox does not have — pm.sendRequest, pm.execution, pm.cookies, pm.iterationData, require, timers — will throw an explanatory error when you first run it. The supported surface is listed in Scripts & tests.
  • Mock servers, monitors, and anything cloud-side do not come across, because Mándalo has no equivalent to import them into. Neither do saved response examples or Postman's own test results.
  • gRPC requests — Mándalo's gRPC support is driven by local .proto files, so gRPC requests are set up in the app rather than imported. See gRPC.

The import report

Every import returns a summary rather than a silent success:

  • imported — how many requests were written.
  • collections and environments — how many of each were created.
  • skipped — requests that were not written, each with its reason.
  • warnings — requests that were written but need your attention: downgraded auth, un-run scripts.

Read the skipped list first. Those are the requests you think you migrated and did not.

Reviewing the diff

The real advantage of a file-based importer is that the result is reviewable. After importing onto a clean tree:

git status --short          # every file the import wrote
git diff --stat             # the size of what landed
git diff collections/       # read the requests themselves

Walk the new files looking for three things: literal secrets that were hard-coded in Postman rather than parameterised (move them out before you commit — see Collections & git), URLs that should be {{baseUrl}} instead of a hostname, and the requests flagged in the warnings. Then commit the import as one commit, so any later cleanup is a diff against a clear baseline.

After the import

Two cleanups pay for themselves immediately. Replace imported test scripts with declarative assertions where the check is simple — a status code, a header, a JSON field — because they review better and cannot break on an unsupported API. And replace chained-token scripts with a capture, which is a couple of lines instead of a JavaScript block.