Postman mocks the API your collection describes, generates random Faker data per call, and keeps your mocks on its cloud — single-user-only until you pay per seat to share them. Gostly is a self-hosted platform in your own perimeter — a Rust proxy plus its control plane and dashboard — that records what your upstream actually returned and replays it byte-for-byte. Your recorded traffic never leaves your infrastructure, and every replay is deterministic — the exact bytes the upstream sent, every run. Seed day one from your existing Postman collection, a HAR, or an OpenAPI spec.
Postman’s mock server is bundled with the dominant API client. If your team already lives in Postman collections, the mock server is a one-click upgrade — examples become endpoints, Faker.js fills in random data, and the spec is the source of truth. For exploratory API work and design-first workflows, that is genuinely the right ergonomic.
Two things eventually break the fit. First, the data: a mock filled with random Faker values is a plausible guess at the shape of the response, not the response your production API actually serves — and OpenAPI specs lie often (missing required fields on oneOf / discriminator, no signal at all about 429/ partial-5xx behaviour or the exact shape of the GET-after-POST). Postman’s own 2025 State of the API report puts contract testing at just 17% — most teams never check that the API still matches its spec. Second, the location: Postman mocks live on Postman’s cloud, and the free plan is single-user only — the moment a second person needs to share them you are paying per seat.
Gostly comes at mocking from the opposite direction. You put its Rust proxy in front of your upstream and run the self-hosted stack in your perimeter (Docker Compose); in LEARN mode it records for an hour, then replays the recorded traffic byte-for-byte in MOCK mode — including HTTPS. The replayed bytes are exactly what your real upstream returned, not Faker output. Your recorded traffic stays in your perimeter; sensitive headers are redacted before anything is written to disk. There is no LLM in the request path — the match cascade is deterministic, and AI gap-fill is opt-in and grounded by your own recordings.
Postman shipped a Git-backed localmock server in 2026 — worth knowing if you were about to ask. It’s a single-developer desktop feature (Local View only, requires a connected Git project) still seeded from saved examples and hand-written JavaScript. Gostly is a self-hosted server you run in CI and share across the team, seeded from real recorded traffic — and it stays in sync by re-recording, not by you editing examples by hand.
And because it runs as your own single-tenant deployment, the controls a security review asks for are built in: SSO via SAML or OIDC, role-based access control, and an append-only audit log on Team — none of it on someone else’s cloud. Each deployment is single-tenant, so your state never shares a database with another customer; per-tenant RLS policies are defined as defense-in-depth. Your recorded traffic never leaves the perimeter you control.
Postman fills responses with random Faker data. Gostly replays the bytes your real upstream actually returned — byte-for-byte, inside your own perimeter.
take the upstream offline — the recorded library still serves, 0 live calls
| Feature | Postman | Gostly |
|---|---|---|
| Hosting model | SaaS (mocks on Postman cloud) | Self-hosted platform in your perimeter (Docker Compose) |
| Traffic stays inside your perimeter | No | Yes |
| Mock source | Spec / collection + Faker.js | Recorded from real traffic |
| Fixture realism | Faker.js + handlebars in examples | real upstream payloads (PII-scrubbed) |
| Captures real HTTPS / TLS traffic | Capture proxy breaks on HSTS sites (most of the web); becomes authored examples | In-perimeter TLS MITM → deterministic byte-for-byte replay |
| Deterministic byte-for-byte replay | No | Yes |
| Bundled with API client / collection runner | Yes | No |
| Team collaboration on free plan | single-user only | Self-hosted, shareable across the team, no per-seat gate |
| Stateful flows across requests | examples-driven; limited | shipping (statecharts) |
| AI gap-fill grounded in your real traffic | AI features generate from spec / prompt, not your traffic | Opt-in, grounded in your recordings |
| No model in the request path | n/a (hosted) | Deterministic match cascade — no LLM in the hot path, ever |
| Library on day one (no recordings yet) | Spec / collection becomes Faker-filled examples | Seed from your Postman collection / HAR / OpenAPI — real library before you record |
| Live drift detection vs the real upstream | No | Re-record + compare — emits drift events + a freshness score |
| Latency / status-code injection | No | Yes |
| Outbound TLS the upstream accepts | n/a (hosted) | JA4-accurate browser-fingerprint impersonation (Pro+) |
| SSO, RBAC, audit log | Hosted account controls (paid) | SAML + OIDC SSO, RBAC, append-only audit log on Team |
Postman’s collection runs are unlimited on every plan, and its API client is excellent — none of that changes here. AI gap-fill on Gostly is opt-in and grounded by your recordings, not a free-text prompt, and the deterministic match cascade never calls a model in the request path.
Choose Postman when
Choose Gostly when
| Tier | Postman | Gostly |
|---|---|---|
| Free | Single user · unlimited runs · no team collaboration | OSS proxy (FSL) · unlimited services, self-hosted |
| Pro / Solo | Solo $9 / mo · single user | $10 / mo single user · unlimited mocks |
| Team | Team $19 / user / mo · Enterprise $49 / user / mo | $79 / seat / mo (3-seat min) |
| Self-host / Enterprise | SaaS only — no self-hosted mock server | $499 / mo Self-host · $25K+ Enterprise |
Postman’s free plan is single-user only; team collaboration starts at $19 / user / month.Gostly Pro is unlimited mocks at $10 / mo (single user); Team is $79 / seat / mo with a 3-seat minimum. The honest framing: Postman charges for the API client and bundles the mock, so if you already pay for Postman the mock is “free.” The comparison only changes shape when your constraint becomes “the traffic can’t leave our network” or “the mock has to match what the real API actually returned.” At that point self-hosting and recording stop being features and start being the requirement.
“Either the entire team pays for collaboration features, or you regress to a primitive state where everyone manages APIs locally.”— a developer on Postman’s March 2026 pricing change
The objection that kills most Postman switches is “I have no recordings yet, so I’d be starting from zero.” You aren’t. Import your existing Postman collection in the dashboard — or drop in a HAR capture or an OpenAPI spec — and Gostly seeds a working mock library before you proxy a single request. It’s the same library your recorded traffic lands in, so real traffic then sharpens those seeded mocks to ground truth. A Faker-filled example is only ever as right as the random value it generated; a recording is the response itself.
In the dashboard, open Cold-start seeding, drag in your Postman collection (or a HAR / OpenAPI file), pick the service, and commit. The mocks land in the same library your recorded traffic does — flip the proxy to MOCK and they serve immediately. Then run your real test suite through the containerized proxy in LEARN mode to sharpen it to ground truth — replacing the seeded shapes with the bytes your upstream actually returns.
Self-hosted, recorded from real traffic, deterministic in CI. Run it against your staging upstream for an hour and see whether it produces a mock you trust.
Evaluating for a team of 3+? We’d love to talk before you commit.