July 2020 Summaries

APIs are rapidly expanding across the business landscape, unlocking new commercial opportunities while simultaneously presenting challenges for both consumers and producers, such as finding and managing the most current versions and ensuring proper usage and adoption. The Postman API Network addresses these issues by offering a centralized platform for discovering, exploring, and sharing APIs, which is divided into a Public API Network, open to the entire API community, and a Private API Network, exclusive to individual teams. With over 2,000 APIs and more than 5,000 templates available in the Public API Network, users can easily find and import APIs using the "Run in Postman" button. Meanwhile, the Private API Network serves as a team's single source of truth for approved APIs, simplifying the process of discovering, publishing, and staying updated with the latest versions without the need for extensive communication. This initiative aims to enhance the accessibility and adoption of APIs among a global community of 17 million developers, providing a streamlined experience for both API consumers and producers.

Postman, committed to fostering creativity through user-friendly software tools, has strengthened its alignment with the OpenAPI Initiative by enhancing its support for the OpenAPI Specification (OAS), which is increasingly adopted within the API ecosystem. Over the years, Postman has evolved from supporting Swagger 2.0 to incorporating OAS, addressing key workflow challenges through improvements in four areas: validating and syncing collections with API specifications to prevent redundant asset recreation, validating API responses against schemas for efficient debugging, utilizing the 'tags' feature from OAS for better request organization, and supporting multi-file schemas to accommodate developers' needs for clarity and composability. These updates aim to streamline API development and reflect Postman's commitment to adapting based on user feedback, as it continues to contribute to the evolution of the OpenAPI Specification.

Postman has joined the OpenAPI Initiative to enhance the development and adoption of the OpenAPI Specification (OAS) by engaging in the education, marketing, and evolution of this crucial API framework. As a member alongside other tech companies, Postman aims to support the API community by promoting a shared, machine-readable format that standardizes API descriptions, which fosters collaboration and integration across tools and services. Postman emphasizes the transition from Swagger 2.0 to OAS 3.0 to unlock additional benefits, and it maintains open-source tools to facilitate this shift, empowering API providers and consumers. By participating in the OpenAPI Initiative, Postman is not only contributing to the specification's advancement but also supporting the ecosystem of open-source tools that enhance the capabilities of APIs across their lifecycle. Postman is actively involved in discussions about the future of OAS, with a focus on understanding the needs of its extensive user base and the wider API community, while also promoting upcoming versions like OAS 3.2.

Postman has evolved its microservices approach since its initial challenges, now implementing a system that emphasizes domain-driven squads and consumer-driven contract testing. The engineering team, consisting of over 100 engineers across multiple global locations, organizes itself into squads following domain-driven design principles, each focusing on specific domains like Identity, while independently managing their roadmaps and processes. This structure, influenced by Conway’s Law, promotes API-first design and development, and each squad operates with a degree of autonomy, choosing their tools and processes. The development process involves creating a team workspace for new services, drafting Postman Collections as blueprints, and engaging stakeholders for feedback, leading to a contract for parallel development. Consumer-driven contract tests are integrated into continuous integration pipelines to ensure robust deployments, complemented by continuous monitoring to detect issues post-deployment. This iterative process allows Postman to quickly adapt and improve their services while addressing coordination challenges between squads and managing domain responsibilities.

Postman has introduced a beta version of its web-based platform, overcoming the limitations of browser architectures that hinder cross-origin resource sharing (CORS) for API requests. This new version utilizes the Postman agent, a micro-application that runs on a user's local desktop, to bypass browser restrictions by routing API calls from the web interface through the user's local network. This approach allows developers to make API requests as if they are originating locally, thus maintaining the full functionality of Postman on the web. While the beta version of Postman includes fully encrypted connections, encryption is not yet activated to simplify the initial setup for users. Postman seeks feedback from users to optimize the integration of web and desktop experiences, encouraging exploration of separating various aspects of API operations to enhance automation and orchestration across different environments.

Postman has launched a beta version of its web-based platform, Postman on the web, aimed at enhancing user accessibility and collaboration by allowing instant browser access without the need for manual updates. This web version simplifies onboarding by offering easy access and enabling deep-linking to share and navigate API elements through URLs, thereby improving team collaboration. The platform addresses the challenge of sending large volumes of HTTP requests from browsers by introducing a unique agent architecture that ensures reliable request handling. This development reflects Postman's efforts to create a robust online environment for API management and usage, promising a seamless experience for its community.

OAuth 2.0 is an open standard authorization framework used to securely grant access to resources across unrelated services, commonly without sharing sensitive user details. Historically, the Implicit flow was used for native, mobile, and browser-based apps because it directly issued access tokens without authenticating the client, which posed security risks. The Authorization Code flow with Proof Key for Code Exchange (PKCE) is now the recommended approach for these apps, as it enhances security by eliminating the need to store a client secret, using a one-time code challenge instead. PKCE is particularly effective for public clients like mobile and JavaScript apps, as it mitigates potential attacks by securely linking the authorization request to the token request. This setup can be implemented in tools like Postman, which supports PKCE by allowing users to select it as a grant type and follow a series of steps to generate access tokens, ensuring a more secure OAuth exchange.