How OpenAPI and Postman files convert

What becomes a request, an environment, a check or a placeholder when you import or export.

In short

When you import an OpenAPI, Swagger or Postman file, each operation becomes a request, servers or variables become environments, and documented statuses or common test shapes become checks. Credentials never come across: they become placeholders to fill. Export writes the same formats back.

Before you start

Who: signed in, with Edit on the project you import into.
Plan: every plan.
First: the OpenAPI, Swagger or Postman file.

Steps

Import the file with "Import OpenAPI or Swagger…" or "Import a package…" in the chevron menu beside "New request" (see /help/api-testing/import-export-packages).
In the preview, read how many requests, environments and checks it makes, and which values are listed to fill.
After importing, fill each placeholder in an environment or connect an authentication profile.

Result: requests that run against each environment, with the checks the file described.

OpenAPI and Swagger

OpenAPI 3.0 and 3.1 and Swagger 2.0 are read. References to other files or addresses are never fetched, and a YAML document that expands to an enormous size is refused.
Each operation becomes a request named by its summary, else its operation id, else method and path, grouped by its first tag or path part. Deprecated operations are imported and say so. Webhooks and callbacks are left out.
Addresses are {{baseUrl}} plus the path, with {petId} written as {{petId}}. A parameter's example or default is its value; one without is listed to fill. Required query parameters join the address, and required header and cookie parameters join the headers.
Servers with a full address become environments, the first the default. The tier is set from words such as staging, qa or localhost, production winning; otherwise Custom.
Security becomes placeholders to fill, such as Authorization: Bearer {{SECRET_BEARER_TOKEN}}. OAuth 2.0 and OpenID Connect become a bearer token to paste; connect an authentication profile instead.
One documented success status is checked exactly, several become a range, and 2XX becomes 200-299.
Export writes OpenAPI 3.0: base URLs as servers, one operation per request, credential headers as security schemes (never their values) and status checks as documented responses. Suites, extraction rules and non-status checks have no place in OpenAPI.

Postman

Collections v2.0 and v2.1 are read: folders become groups, collection variables a default environment, :name path segments {{name}}. Bearer, API key, basic and inherited authentication come across; OAuth 2.0 becomes a bearer token to fill.
Test scripts are never run, but their common shapes become checks: status, response time, headers, body text and JSON fields. A pm.environment.set call on a JSON field or header becomes an extraction rule. The preview says how many tests of each request converted.
An environment or globals file imports as one environment. Secret or credential-like values stay secret, and disabled values are reported.
Export writes a Collection v2.1 with checks and extraction rules as Postman tests.

If something goes wrong

A request is missing after an OpenAPI export: a second request for the same method and path is left out and reported.
A Postman test did not convert: only common shapes become checks. Add the check by hand.
Requests fail with 401 after import: fill the SECRET_ placeholders, or connect an authentication profile.

/help/api-testing/import-export-packages
/help/api-testing/har-and-openapi-imports
/help/api-testing/authentication-profiles