Prior to April 2018 Release: Verify in Postman > Settings that SSL Certificate verification is disabled.
April 2018 release and higher: In the April 2018 release, port redirection for authentication was disabled in favor of path-based redirects. For not-yet-known reasons, this has been problematic in Postman for NTLM authentication in particular (but not other rest clients/utilities, such as Invoke-RestMethod in Powershell). If you want to use Postman then a workaround is:
Disable auto-follow of redirects.
Make the initial request, Qlik Sense responds with an HTTP 302 and Location header.
Re-enable auto-follow of redirects, and execute request at the URL in the Location header.
You should now have the NTLM session cookie**, proceed with API requests as usual.
Alternatively, locate the following line in both repository.exe and also proxy.exe, change the value to false, and restart all services; this re-enables port redirection for Windows authentication requests: