The switching guide
Leaving Postman? Your tests belong in your repo.
Bandura is a Postman alternative built on the opposite bet: API tests as plain-YAML
files in your own Git repository. No account, no cloud workspace, no metered AI, and
the AI can run on a model on your own machine. A graph canvas and a code editor edit
the same file, and one local engine runs it identically in the app, the CLI, and CI.
Your collections, environments, and pm.* scripts come with you, and the
importer shows you exactly what it found before it writes anything.
v1.0.0-rc.8 is out now on Windows and Linux. v1.0.0 final, and signed macOS builds, in August 2026.
- 10
- node types the engine executes on your machine: request, gRPC, WebSocket, assertion, condition, loop, parallel, subflow, script, ai-action
- 6
- formats the importer reads: Postman, Insomnia v4, Bruno, OpenAPI/Swagger, HAR,
and raw
curl - 4
- CLI reporters (pretty, JSON, JUnit XML, GitHub annotations), emitted together if you want them
- 0
- accounts, telemetry endpoints, and metered runs. There is no server on our side to hold any of it
Why people look for an alternative
It usually isn't one thing. It's the direction.
Postman is a capable product. That's not in dispute, and if a hosted platform is what you want, it may still be the right call. People start searching for an alternative when the direction stops matching how they work:
Your tests live in their cloud
An account and workspace sync are mandatory; the offline Scratch Pad was retired in 2023. Collections are records in a database, not files in your repo: not diffable in a pull request, not blameable, not clonable. When AWS's us-east-1 went down in October 2025, the Postman desktop app went down with it.
The meter keeps finding new things to run on
As of July 2026: the free plan covers a single user, the free Collection Runner is capped per month even for runs on your own machine, and AI is billed in credits with per-credit overage. Each squeeze lands on people who thought the tool they learned was theirs.
Security review gets harder every year
A client that syncs collections, environments, and history to a vendor cloud is a data-flow your security team has to sign off on. Some won't: companies have asked staff to uninstall cloud-syncing API clients outright. Local-first isn't a preference in that conversation. It's the requirement.
If that conversation is ahead of you, the answers are already written down: what crosses the network and when, where credentials sit, and the compliance claims we deliberately do not make.
The tool grew away from the job
What most developers need daily (build a request, chain a few, assert, run in CI) sits inside an enterprise platform of monitors, catalogs, and governance. The weight shows up as slower startups, busier screens, and a format nothing else can read.
Details from our July 2026 review of Postman's public pricing and documentation. Corrections welcome at [email protected].
What switching gets you
Everything on this list is shipped, local, and yours.
Files, not records
Every test is a plain-YAML .aether file in your repo. Review it in a
PR, blame it, revert it, grep it. Sharing a suite with a teammate is
git clone.
Graph and code, one file
Postman Flows gives you a canvas and hides the code. In Bandura the canvas and the code editor are two renderings of the same file. Edit either one: nothing to sync, nothing cloud-only.
Multi-step by construction
Capture a token at login, branch on a condition, loop, fan out in parallel, compose flows from flows, all declarative in the YAML rather than a script ritual. Retry and poll-until are one line, not a loop you maintain.
The auth your collection already uses
Basic, bearer, API key, OAuth2 client-credentials and password grants, and AWS SigV4, declared as a block on the flow or one request rather than assembled in a pre-request script. The OAuth2 token is fetched once per run and refreshed before it expires, so ten requests make one token call. Cookies are captured and replayed automatically, which means a login step and a session request are just two nodes. Authentication reference →
Unmetered runs, everywhere
The engine runs on your machine, and the desktop app, the native-binary CLI, and CI all execute the same file identically. No run quotas: we don't meter your own computer. Running the suite in CI →
AI on a model you choose, or host
Three providers: Anthropic and Gemini natively, or any OpenAI-compatible
/chat/completions endpoint with a base URL you set: OpenAI, Groq,
OpenRouter, Together, Ollama, LM Studio. Point it at
http://localhost:11434/v1 and chat, flow generation, the agentic loop,
and the ai-action node all run locally, with no API key and no prompt or
payload leaving your machine. A Test connection button proves it.
Keeping the model local → Drift detection and
self-healing are deterministic and need no model at all.
An agent that fixes tests locally
The MCP server is a local stdio process, so Claude Code or Cursor can list, run, read, and edit your flows without your tokens or responses transiting anyone's cloud.
You see the import before it lands
The importer shows its work first: the detected format, each flow with its node count and the requests it makes, the environment variables it found, checkboxes to take only what you want, and an editable destination folder. Nothing is written to disk until you press Import.
One payment, not a seat per month
A one-time licence per seat covers commercial use, after 30 days to evaluate; the price is announced when checkout opens at launch. Nothing auto-renews and there's no card on file. It covers every release built in the following 12 months; after that the build you have keeps running unchanged. Postman Team, for comparison, runs a five-person team $1,140 a year, before AI credits, every year.
Your configuration is a file too
A hand-editable settings.json, VS Code style: theme, accent, font,
density, per-token colour overrides, the AI provider block, comments allowed. Delete
a key and its default returns. API keys are deliberately kept out of it, in
OS-encrypted storage.
Head to head
Bandura vs Postman, as of July 2026.
What each one costs
| Bandura | Postman | |
|---|---|---|
| Where tests live | Plain-YAML files in your Git repo | Cloud workspace (account required) |
| Works offline | Fully; no account, no sync, no telemetry | Core features depend on Postman's cloud |
| Reviewable in a pull request | ✓ line-by-line YAML diffs | JSON exports diff poorly; Flows not at all |
| Visual flow editing | ✓ graph and code are the same file | Flows: cloud-only, no code view |
| Multi-step logic | Declarative nodes: condition, loop, parallel, subflow, retry/poll-until | JS scripting and Flows blocks |
| Local test runs | Unlimited: desktop, CLI, and CI | Collection Runner metered monthly on the free plan |
| AI pricing | BYO model (Claude, Gemini, OpenAI-compatible, or local); no credits, no markup | Credit allowance per seat, per-credit overage |
| Where the AI runs | Your choice: a hosted model you pay directly, or a local Ollama / LM Studio where no prompt or payload leaves your machine | Postbot, in Postman's cloud |
| Where your settings and keys live | A hand-editable settings.json on your disk; API keys in OS-encrypted storage, never in that file | In-app preferences, tied to your synced account |
| Self-healing against OpenAPI drift | ✓ deterministic, offline, one-click fixes | ✗ |
| MCP server for AI agents | ✓ local stdio; nothing transits a vendor cloud | ✓ tied to the cloud platform |
| CI story | Native-binary CLI: exit codes, JUnit, GitHub annotations, Action at launch | Newman / Postman CLI |
| Protocols | REST, GraphQL, gRPC, WebSocket, SSE | Broader; adds MQTT and Socket.IO |
| Hosted collaboration, monitors, mock cloud | ✗ planned as an optional hosted tier, post-1.0 | ✓ mature |
| What it costs | Free download; one-time per-seat licence for commercial use, priced at launch, covering 12 months of updates, after which the build you have keeps working | Free (1 user) · $9 Solo · $19 Team · $49 Enterprise, per user/month |
The two ✓-for-Postman rows are real: if hosted team workspaces, monitoring, or a mock cloud are load-bearing for you today, Postman is further along, and switching would cost you something. Bandura's hosted tier comes after v1.0 and will be subscription-priced, because it genuinely runs on servers we pay for. Nothing local ever moves there.
The migration
Five minutes, and your scripts come too.
Switching doesn't mean starting over. The importer is shipped today, and it was built for exactly this trip.
-
Export from PostmanRight-click your collection → Export → Collection v2.1. Export environments the same way. Bandura turns them into
.envvalues, so secrets never enter the flow files. -
Drop the JSON onto Bandura, and read the reviewBefore anything is written, you see what was found: the detected format, every flow with its node count and the requests it makes, the environment variables it picked up, checkboxes to import only some of them, and the folder they'll land in. Press Import and each request becomes its own
.aetherflow, with headers, body, and params as structured fields rather than baked into URLs. Yourpm.*pre-request and test scripts land in the flow'shooksblock, with a readable compatibility shim where they map directly and nothing silently dropped where they don't. -
git add flows/ && ▶ RunYour collection is now code in your repo. Run it in the app, from the CLI, or in CI: same engine, same file, same result.
# One collection in, one .aether file per request out
bandura import my-collection.postman_collection.json
# Environments become .env values, so secrets never enter the flow files
bandura import my-env.postman_environment.json
The CLI imports the same formats as the app. The full walkthrough, including
exactly how pm.* scripts are carried, is in the
migration guide.
Who should switch
Who should switch, and who shouldn't yet.
Switch if…
- You want API tests versioned next to the code they test, reviewable in PRs
- Your CI runs API regressions and you'd rather maintain files than a Newman setup
- Security review keeps flagging cloud-synced collections and credentials
- You're paying per seat monthly for what is, for you, a local tool
- You want AI agents (Claude Code, Cursor) to run and fix tests without a cloud relay
- Your policy rules out sending API payloads to a hosted model; point the AI at a local Ollama or LM Studio and nothing leaves the machine
Stay on Postman if…
- Hosted real-time collaboration across a large team is load-bearing today
- You depend on Postman's monitoring or mock-server cloud
- You need MQTT, Socket.IO, or SOAP, which Bandura doesn't speak yet
- Non-developers work in your collections through the hosted UI daily
Bandura isn't the only alternative worth knowing. Bruno is plain-text and local too (no graph canvas, no drift healing, subscription for teams); Insomnia has a local mode behind a Kong account; Yaak is a fast, file-based client without a test runner; Hoppscotch is open-source and web-first. If one of those fits you better, use it. The point of local-first is that your files stay yours either way, and Bandura imports Bruno and Insomnia exports if you land here later.
The questions a switch raises
FAQ
Is Bandura a good Postman alternative?
If what you want from an alternative is local files instead of a cloud workspace, yes. That is the exact trade Bandura is built around. Your tests are plain-YAML .aether files in your own Git repo, edited on a graph canvas or as code (two renderings of the same file), run by a local engine that works fully offline, with a CLI for CI and a local MCP server for AI agents. If what you want is a hosted team workspace, built-in monitoring, or a mock cloud, Postman is further along and honesty says so.
Can I import my Postman collections and environments?
Yes, both are shipped. Export a collection as Collection v2.1 and drag the JSON onto the Bandura window. You get a review step before anything is written, showing the detected format, every flow with its node count and requests, and checkboxes to take only what you want. Each selected request then becomes its own .aether flow with headers, body, and params carried over as structured fields. A bulk import lands in a subfolder named after the collection, which you can rename in the review step or skip entirely with the flat option. Names collide safely, so nothing you already have is overwritten. Postman environment exports import too, becoming .env values so secrets never live in the flow files.
What happens to my pm.* pre-request and test scripts?
They come with you. Postman's event[] scripts land in the flow's hooks block, pre-request scripts as before and tests as after, in the order Postman ran them. Where every pm.* call has a direct equivalent, your code arrives as you wrote it, above a small generated compatibility shim you can read, edit, or delete. Where a script uses something Bandura's sandbox doesn't have (pm.sendRequest, CryptoJS, require), the whole script is kept commented out under a banner rather than silently dropped, so nothing is lost.
Will importing overwrite my files or dump the whole collection into my repo?
Neither, and you get to see that before it happens. Import opens a review step first: the detected format, every flow it found with its node count and the requests it makes, the environment variables it picked up, checkboxes to import only the ones you want, an editable destination folder, and a flat option if you'd rather skip the subfolder. Nothing is written to disk until you press Import, and existing files are never overwritten: names collide safely. One exception worth knowing: a HAR file is a recording of one session, so it imports as a single chained flow rather than one flow per request.
Can Bandura's AI run on a local model instead of a vendor cloud?
Yes, and this is often the deciding difference in a security review. Bandura has three providers: Anthropic and Gemini natively, plus OpenAI-compatible, meaning any /chat/completions endpoint with a base URL you set, which covers OpenAI, Groq, OpenRouter, Together, Ollama, and LM Studio. Point it at http://localhost:11434/v1 and chat, the agentic tool loop, flow generation, and ai-action nodes all run against a model on your own hardware: no API key, and no prompt, request payload, or response body leaves the machine. A Test connection button confirms it. Postman's Postbot runs in Postman's cloud on metered credits. The CLI and MCP server take the same provider settings from the environment, so CI matches your desktop.
Do I need an account or an internet connection?
No account, ever. There is nothing to log into. Editing, running, importing, drift detection, and the CLI are fully local and work offline, and the commercial licence is verified on your machine against a public key compiled into the app. Two features reach the network on their own, and both can be switched off: the AI ones call whichever provider you configured, and once a day the app asks our public releases list whether a newer version exists. That check carries no information about you, your machine, or your flows, and installs nothing on its own: fetching a new version is a button you press. Point the AI at a local Ollama or LM Studio and even the prompts stay on your machine, with no key at all.
Did Postman's free plan become single-user in March 2026?
We can confirm the state, not the date. As of our July 2026 review of Postman's published pricing, the free plan covers a single user, and the free Collection Runner is capped per month even for runs on your own machine. The practical question behind that search is what a small team pays next: $19 per user per month on Postman Team as of the same review, so five people are $1,140 a year before AI credits. Bandura's answer for the same five people is a one-time licence each, priced when checkout opens at launch, after each person's 30-day evaluation, and free indefinitely for personal projects. If the Postman figures have changed, tell us at [email protected] and this page gets corrected.
How much does Bandura cost compared to Postman?
The Bandura download is the complete app, free indefinitely for personal projects, learning, and open source. Commercial use is a one-time per-seat licence after a 30-day evaluation, priced when checkout opens at launch, covering 12 months of new releases, after which the version you have keeps working. It is not a subscription and nothing auto-renews. Postman (as of July 2026) is per-seat monthly: free for one user, then $9 Solo, $19 Team, and $49 Enterprise per user per month, with AI metered separately by credits. A five-person team on Postman Team pays $1,140 per year, before AI credit overages; on Bandura the same team buys five seats once and then pays nothing again.
Do Postman dynamic variables like {{$guid}} survive the import?
The common ones convert to Bandura's own dynamic value helpers at import time: {{$guid}} becomes ${{ $uuid() }}, {{$randomEmail}} becomes ${{ $randomEmail() }}, and the same for $timestamp, $isoTimestamp, $randomInt, the name helpers, $randomIP and friends. They arrive as function calls rather than frozen values, so each reference keeps regenerating exactly as it did in Postman. Postman's list is longer than the mapped set; a {{$something}} with no counterpart comes through as an ordinary variable reference with an empty value, so it surfaces as an unset variable instead of disappearing.
Keep reading
What changes once the tests are files.
Tests as files in your repo
What a collection becomes once it stops being an export: flows that diff in the same pull request as the API change they test.
Run the suite in CI
One command, deterministic exit codes, JUnit XML, and GitHub annotations, with no Newman setup to maintain.
Let an agent run the flows
A local MCP server hands Claude Code or Cursor the same tests, over stdio: no cloud relay, and no AI credits metered per prompt.
Keep the AI local
Point the model at Ollama or LM Studio and no prompt, payload, or credit meter is involved. The opposite of Postbot.
No account, and nothing collected
The row-by-row answer for a security review: which file holds which piece of your data, and the one feature that can call out.
Postman vs Bruno, without us in row one
A sourced comparison of the two tools people leave Postman for, strengths conceded. The Insomnia and Bruno switching pages are written the same way.
v1.0.0-rc.8 is out now. v1.0.0 final in August 2026
Your collections are ready to become files.
Four steps, and the third one is a review screen you can walk away from: export a collection, drop it on the window, read what was detected, press Import. The Windows and Linux builds ship with the importer in them, and your Postman workspace is untouched either way. On a Mac, leave an address and you get the signed build the day it is notarized.
Want to see the trip before you take it? The
migration guide walks a real collection through, pm.* scripts included.