Find every stale variable across your Postman workspaces

Check every Postman variable in one pass

Fetching a collection returns the entire document: thirty-one variables and fourteen requests with their pre-request scripts, tests and auth configuration attached. That answers what people open Postman for. Which requests still point at the retired host. Which environments define a variable no request references. Which of the four auth setups drifted, and when.

Because the answer is a document rather than a screenshot, it can go somewhere: a ticket, a review comment, or a sheet listing every workspace with what is stale inside it. That is data extraction over a tool most people never thought to query, and auditing a team’s estate is the kind of operations chore that stays undone because it is nobody’s deadline.

What executes here, and what gets read?

One thing executes: triggering a monitor, which runs whatever that monitor was configured to run, on Postman’s infrastructure, against whatever it points at. It calls real external services, spends your monitor run quota, defaults to asynchronous, and waits for your approval first, after which the companion fetches the monitor to read the run state.

Everything else is reading, and reading is where this earns its place: a request’s method, URL, headers, body, auth and tests, across every collection in every workspace. For most people Postman means send a request, so it is worth being exact that the runner stays in the app and the estate-wide audit is what happens here.

How careful is the variable merge?

More careful than a blind write, which matters because variables carry hosts and secrets into requests. The collection variable tool reads the remote collection first and then changes only matching keys or appends new ones. It does not replace the collection, and the environment variable tool treats the current remote environment as its source of truth in the same way.

Both merge scalar variables only. Neither rewrites requests, scripts, tests or auth, so a base URL update stays a base URL update. That boundary is what makes this safe to point at a shared workspace, and the calls still ask before they run.

• Read: workspaces, collections in full, environments, API specs, mocks, monitors.
• Write: create a collection, merge collection variables, merge environment variables.
• Execute: trigger a monitor run (asynchronous, quota-consuming, approval-gated).
• Absent: any request or collection runner, and any delete tool at all.

File the ticket the audit produced

The ticket naming the four stale variables.

The sheet listing every workspace with what is wrong inside it. The message to whoever owns the one pointing at a decommissioned host. A companion files all three in the same session, which is the half that never happens when the audit ends in a chat window.

Nothing deletes, which is a reassuring absence on a shared workspace: no collection, environment, mock, monitor or spec can be removed here, environments are not creatable, and API specs are readable rather than editable. Postman’s own AI sits beside the runner with a request in front of it, as of this writing.

Frequently asked questions