apitoolsautomation

API tools for QA in 2026 — Postman, Bruno, Insomnia, Hurl: which to pick when

For five years Postman was the unspoken default, and saying «I’ll send it as a Postman collection» in a QA team meant something concrete. By 2026 that fell apart: Postman aggressively pushes everything to the cloud (login required, local collections without sync degrade, free plan capped at 3 collections), Insomnia first went cloud-only and quickly walked it back, Bruno grew from zero into a serious alternative in two years, and Hurl found its niche in CI. QA teams now have a real choice — and real reasons to rethink the stack.

This article is a comparison of four tools across the dimensions that matter in real QA work. Not marketing features, but things you do with your hands every week.

1. Postman — what’s left and what’s gone

Where it’s strong: huge ecosystem (Newman for CI, mock servers, observability dashboards, enterprise-grade API governance), monitor-runner, schema validation, collection version history, code generation for 15+ languages.

Where they tightened the screws: the free plan now caps at 3 collections, account required even to look at local collections, scratch-pad local collections without cloud degraded, scripting tab locked behind a paid plan for teams > 3 people, request history lives in the cloud (not locally).

Who it fits: enterprises already wired into a Postman pipeline; teams that need built-in monitoring and API governance; teams publishing public API documentation through Postman.

2. Bruno — the git-friendly alternative

The key architectural decision in Bruno: collections are .bru files in an open text format, living in your git repo next to the application code. No cloud, no account, no sync. Bru DSL is simple, human-readable, merges cleanly in git. bru run is the CLI for CI pipelines.

Strengths: open-source (MIT), no cloud as a concept, environment variables sit in files next to collections, secrets via .env (or secret env-files outside git), native GraphQL and REST support, JS test scripts like in Postman.

Downsides: the built-in mock server is still beta, the scripting API is smaller than Postman’s (parts of pm.* need to be ported by hand), no monitors as a class, fewer plugins.

Who it fits: any QA or team where the collection should live in git alongside the code; teams that don’t want a dependency on an external service; CI pipelines where the collection is part of the repository.

3. Insomnia — between worlds

After the 2023 cloud-only experiment they walked it back; local workspaces are supported again. Strong on OpenAPI/GraphQL — built-in schema validation, request generation from a spec, one-click Swagger import. Inso CLI for CI. Plugins out of the box, plugin marketplace.

Downsides: after the Kong acquisition the ecosystem leans more towards enterprise API gateway than a QA tool; community smaller than Postman’s; team sync is via Insomnia Cloud or Git Sync (the latter paid).

Who it fits: OpenAPI/GraphQL-heavy stacks, teams that value plugins, microservice developers with heavy spec work.

4. Hurl — CLI-first for CI

A fundamentally different approach: a single .hurl file with a plain-text DSL describes a request plus asserts plus request chains. Runs with one command hurl, prints results as curl + assertions with a colored diff. Ideal for smoke tests and contract tests in CI pipelines — merges in git, reviewed as code, versioned as code.

Example .hurl file:

POST https://api.example.com/login
Content-Type: application/json
{
  "email": "[email protected]",
  "password": "{{password}}"
}

HTTP 200
[Asserts]
jsonpath "$.token" exists
jsonpath "$.user.email" == "[email protected]"
[Captures]
auth_token: jsonpath "$.token"

GET https://api.example.com/me
Authorization: Bearer {{auth_token}}

HTTP 200
[Asserts]
jsonpath "$.role" == "qa"

Downsides: no UI at all (uncomfortable for ad-hoc debugging — you’ll want curl or Postman/Bruno), small community (~12k stars), no plugins, no built-in mocks.

Who it fits: CI smoke tests, contract tests, synthetic monitoring of production endpoints, any workflow where «one file = one test case» like unit tests.

5. Comparison matrix

Legend: ✅ — out of the box, ⚠️ — present with limits, ❌ — unavailable / not on free plan.

  • Fully offline: Postman ❌ (login required) · Bruno ✅ · Insomnia ✅ · Hurl ✅
  • Collections in git: Postman ⚠️ (JSON export) · Bruno ✅ (.bru native) · Insomnia ⚠️ (Git Sync paid) · Hurl ✅
  • Environment variables: all ✅
  • Built-in mock server: Postman ✅ (paid) · Bruno ⚠️ (beta) · Insomnia ❌ · Hurl ❌
  • Pre/post-request scripts (JS): Postman ✅ · Bruno ✅ · Insomnia ✅ · Hurl ❌ (has captures and asserts instead)
  • OpenAPI import: Postman ✅ · Bruno ✅ · Insomnia ✅ (best in class) · Hurl ❌
  • CLI for CI: Postman → Newman · Bruno → bru · Insomnia → inso · Hurl → hurl (native)
  • Team sync: Postman ✅ (paid) · Bruno → git · Insomnia ✅ (paid) · Hurl → git
  • Free plan enough for solo QA: Postman ⚠️ (3-collection cap) · Bruno ✅ · Insomnia ✅ · Hurl ✅
  • Onboarding difficulty: Postman low · Bruno low · Insomnia low · Hurl medium (need to learn the DSL)

6. When to pick what

  • Solo QA on any project: Bruno. Free, git-friendly, no cloud dependency, everything local.
  • Small team without CI: Bruno (everything in git) or Postman free (3 collections is usually enough).
  • Team with CI focus: Bruno for UI debug + Hurl for CI regression. Bruno exports or you copy the request into .hurl by hand.
  • Enterprise with governance and monitoring: Postman team — built-in monitoring, dashboards, API governance, audit log.
  • OpenAPI-heavy stack (microservices with spec): Insomnia — best schema work.
  • Smoke tests for production endpoints: Hurl. One .hurl file = one test case, reviewed in PR as code.

7. Migration: Postman collection → Bruno

Bruno has a native importer for Postman collection v2.1, migration in three commands:

# 1. Export from Postman: File → Export → Collection v2.1
#    Save as collection.json

# 2. Install Bruno CLI
npm install -g @usebruno/cli

# 3. Import + run
bru import postman --source collection.json --destination ./api-tests
bru run ./api-tests --env dev

Conversion pitfalls:

  • pm.environment.set(key, value) → bru.setEnvVar(key, value)
  • pm.test(name, fn) → Bruno uses a separate tests block in the .bru file with a different syntax
  • pm.sendRequest (nested requests from a script) → in Bruno this is done via a chain of pre-request hooks
  • Postman dynamic variables ({{$randomEmail}}) → Bruno faker-equivalents have different names, verify each
  • Pre-request scripts that touch request.headers directly — Bruno syntax differs slightly, review after import

Takeaway

Postman remains a strong enterprise tool if you’re already inside its ecosystem — monitors, dashboards, API governance, code generation. For everyone else in 2026 the answer is increasingly Bruno: free, local, in git, no cloud dependency. Hurl covers the CI niche and contract-tests-as-code. Insomnia is still a good pick for OpenAPI-heavy stacks. «It’s always worked in Postman» isn’t an argument anymore — you have a real choice, and in most cases it isn’t Postman.