Gostman documentation

Gostman is an API client for REST, GraphQL, gRPC and WebSocket that you, your CI pipeline and your coding agent share. These pages cover the desktop app, the web app and the command line, and every feature in them is included in the free download.

Gostman sending a POST request with a JSON body and showing the pretty-printed response

Where to start

Getting started: open Gostman in the browser, install the desktop app or the command line, and send a first request.
What is free in Gostman: the features Postman and Bruno list under paid plans, and where Gostman covers each one.

Send requests

Requests and responses: the request editor, every body and auth type, and the response viewer.
Protocols: REST, GraphQL, gRPC, WebSocket, Server-Sent Events, SOAP and MCP servers.
Variables: scopes, secrets and dynamic values.
Folder and collection settings: headers, auth, variables and scripts shared by a folder.
Variables, scripts and settings: tests, scripts, network settings and the OAuth 2.0 callback.

Test and automate

Runner, load testing and secret scanning: the in-app runner and the dialogs for load tests and scans.
Command line: run, send, mock, capture, docs, load, scan and lint.
Gostman in CI: exit codes, reports and recipes for GitHub Actions, GitLab CI and Jenkins.
Use from a coding agent: the MCP server for Claude Code, Codex and Cursor.

Your data

Collections and Git: the sidebar, tabs, storage and the Git panel.
Folders, mock server and capture: collections as files, saved examples and recorded traffic.
Import, export and specs: supported formats, OpenAPI tools and Open in Gostman links.
Sharing and documentation: encrypted share links and generated HTML documentation.

Settings and security

Secrets and network: secret variables, secret managers, proxy and certificates.
Preferences and shortcuts: the command palette, preferences and keyboard shortcuts.
AI features: the optional assistant, which uses your own key.

Everything Gostman does

Each feature links to the page that explains it.

Send and inspect

Every protocol: REST, GraphQL with a schema browser, gRPC through reflection or .proto files, WebSocket, Server-Sent Events, SOAP and MCP in one window.
Auth for real APIs: Basic, bearer, API key, OAuth 1 and 2 with renewal, Digest, AWS SigV4, NTLM and Akamai EdgeGrid.
Bodies and transport: JSON, XML, form, multipart and file bodies, a cookie jar, proxy and client certificates, and curl commands pasted straight into a request.
Responses: JSON tree, HTML, image and PDF previews, headers, cookies, size and timing. Download any body, including binary, or copy it as code in cURL, JavaScript, Python, Go, PHP or Java.

Variables and secrets

Variables done properly: Secret variables in your OS keychain, plus global, collection, folder and request scopes, dynamic variables and prompts.
Secret managers: Pull values from HashiCorp Vault, AWS, Azure or Google Cloud at send time.

Test and automate

A runner built for CI: CSV and JSON data, parallel runs, HTML and JUnit reports, and a CLI that exits non-zero on failure.
Mock server: Serve saved examples or an OpenAPI spec locally, with rules and a live request log.

Your data and tools

A real Git panel: Diff, commit, push, branches, stash and conflict resolution, in the desktop app.
Plain files: Nested collections, tabs and history, kept as plain YAML files in a folder or in app storage.
Import and export: Import Postman, OpenAPI, Insomnia, HAR, WSDL, Bruno collections and curl commands. Export to Postman, OpenAPI, Markdown or a backup.
Agent-ready, and in the browser: An MCP server with secret redaction and a host allowlist, and a web version with nothing to install.
AI features, bring your own key: Off by default. Bring your own key for Anthropic, OpenAI, Gemini, OpenRouter, Ollama or any compatible URL. Keys stay on your device, in the OS keychain on desktop, and each request is previewed with secrets masked.