June 2021 Summaries

Postman has demonstrated a strong commitment to securing its platform and safeguarding customer data by initiating a series of System and Organization Controls (SOC) examinations to align with SOC’s Trust Services Criteria. In 2019, Postman adopted the Adobe Common Controls Framework (CCF) and customized it to meet their security objectives, resulting in a successful SOC 2 Type 1 audit. Following this achievement, the Postman security team spent nine months implementing modified controls and activities for the SOC 2 Type 2 audit, which commenced in September 2020 and concluded in February 2021 with a favorable outcome. The company plans to incorporate valuable insights gained from these audits to enhance and simplify their control environment, focusing on control automation to reduce operational burdens. Looking forward, Postman aims to continue elevating service and confidence for customers, monitoring technological advancements, and maintaining compliance with relevant regulations while attentively addressing customer feedback.

During a recent livestream with Postman Co-founder and CTO Ankit Sobti, the Postman community engaged in an interactive session where Ankit discussed the company's engineering challenges and insights gained since its inception in 2014, along with how Postman has evolved into its current API platform. Ankit shared personal anecdotes, like automating meal plans for Postman's Chief Happiness Officer Cooper, and addressed a variety of questions from the community, including topics on API-first development, opportunities for new developers, fun APIs to experiment with, and Postman's involvement with open source projects. Additionally, he touched on future prospects for product managers and the integration of gRPC with Postman. For those interested, Postman hosts weekly livestreams on platforms like YouTube, Twitch, Twitter, and LinkedIn, where subscribers can stay updated on new developments and engage directly with the team.

The Postman Student Expert Program, launched earlier this year, has attracted thousands of students worldwide eager to enhance their API literacy. Completion of the program not only provides valuable knowledge but also awards students with an Open Badge via the Badgr platform, which can be shared on social media and added to LinkedIn profiles. This badge has proven beneficial to students' professional growth, aiding in securing job interviews and salary increases. Initially, the badge processing was manual and time-consuming, but the integration of the Badgr API has streamlined the process, allowing automatic badge awarding within minutes upon verifying training completion. This automation has eased the workload for the Student Programs team and expedited badge distribution, with additional use of the Badgr API for badge verification on Discord and other workflows. The program encourages students facing challenges to join the Postman Student Community Discord for support.

Open technology extends beyond open source to include open specifications, practices, and people, which are crucial elements in the Postman Open Technologies program. Open specifications like OpenAPI and JSON Schema provide structured solutions that facilitate collaboration and innovation, while open practices encourage the adaptation and improvement of shared learnings for communal benefit. The concept of open people emphasizes curiosity and empathy, advocating for a mindset that prioritizes learning over fixed expertise, which is essential in navigating the uncertainties of modern business environments. This approach fosters a culture of collaborative conversations, leading to healthier and more resilient ecosystems. The Postman Open Technologies initiative invites participation and sharing of experiences to enrich the API economy, encouraging individuals and organizations to engage with these open principles and share their stories using the #PostmanOpenTechnologies tag.

Postman offers team admins the ability to manage user access more efficiently through SCIM (System for Cross-domain Identity Management), an open standard that automates user identity management across applications. While SSO self-provisioning allows users to join teams manually, SCIM streamlines this by automatically provisioning and deprovisioning users, thus reducing the manual effort and potential errors associated with managing large teams. This feature, available on Postman’s Enterprise plan, enables organizations to maintain compliance and security policies while optimizing the use of Postman licenses. By integrating SCIM with identity providers like Okta, organizations can quickly and easily add new employees to their Postman teams, centralizing control of user information and account status to enhance operational efficiency.

Postman, committed to supporting the API-driven economy, has evolved from a Google Chrome extension to a comprehensive API platform, focusing heavily on API design and lifecycle management. A significant feature of Postman is the ability to store API schemas, enabling users to utilize tools like the API Builder, monitors, and documentation for streamlined collaboration. A recent enhancement is the inclusion of security warnings alongside validation errors in the Define tab, specifically for APIs in the OpenAPI 3.0 format. These warnings, which point out potential security vulnerabilities without being errors, allow developers to address security issues early in the API development lifecycle, promoting a security-first approach. Users can access detailed information and potential fixes for each warning through Postman's Learning Center, and ongoing improvements aim to expand these security checks and validation features across more API formats.

Postman emphasizes a balanced approach to open source and proprietary software in the API community, advocating for a blend of open and commercial solutions that support business growth and innovation. This philosophy is reflected in their commitment to developing and contributing to open source projects, such as their own tools like Newman and Postman Collections SDK, while also utilizing popular open source frameworks like SailsJS, Gatsby, and Electron. Additionally, Postman supports open API specifications, including OpenAPI, RAML, and GraphQL, to ensure interoperability with a variety of API infrastructures. This strategy underscores the importance of open source as an integral part of API development and management, while also providing premium services to enhance functionality and scalability, ultimately nurturing a cooperative ecosystem that benefits both the company and its users.

Webhooks are a mechanism that allows web APIs to send requests to a specified URL when certain events occur, transforming them into a two-way interaction. OneLogin, a cloud-based identity and access management provider, leverages this technology through Smart Hooks, which initiate actions upon user login events to enhance security and streamline the authentication process. These Smart Hooks enable developers to automate tasks and adjust policies based on various factors such as country code, browser type, or IP range, thereby improving application security and user experience. The OneLogin API allows developers to create custom hooks, opening new possibilities for automation and orchestration at the authentication layer, making applications more secure and reducing friction for users. OneLogin offers a public workspace for developers to explore and manage these Smart Hooks, encouraging innovation and customization in handling authentication tasks across different platforms.

Co-authored by Hannah Neil and Meenakshi Dhanani, the text discusses the significance of LGBTQ+ Pride Month and introduces Postman's LGBTQ+ Pride public workspace, which aims to support LGBTQ+ communities through APIs. It highlights the historical context of Pride, including the impact of the Stonewall uprising and the role of Marsha P. Johnson in the LGBTQ+ rights movement. The text also addresses ongoing challenges faced by LGBTQ+ individuals, such as anti-transgender legislation and the need for safe spaces. Postman's public workspace offers various API collections, including the LGBTQ+ Safe Space Assist collection for locating safe spaces, the Open States Legislation collection for understanding laws affecting LGBTQ+ rights, and the LGBTQ+ Opportunities in STEM collection for finding opportunities in tech. The text encourages participation and contributions to the workspace, emphasizing its role as a resource for both LGBTQ+ individuals and allies, while also inviting global input to expand its scope beyond the US.

During the COVID-19 pandemic, the health technology sector experienced rapid growth, driving initiatives like those of Spritely, a New Zealand startup focused on enhancing the health and connectivity of retirees through technology. The company developed a comprehensive ecosystem of interconnected devices and services, including tablets and IoT sensors, to support healthcare management remotely, particularly during lockdowns. Key to Spritely’s success has been the use of the Postman API platform, which facilitates robust documentation, testing, and collaboration among developers, enabling swift adaptation and iteration of their services. As New Zealand's healthcare sector embraces digital transformation, the adoption of standards like HL7 FHIR is set to revolutionize healthcare interoperability, allowing seamless sharing of medical data across platforms. This shift underscores the increasing importance of well-documented and tested APIs in the healthcare industry, where Postman plays a critical role in supporting such technological advancements.

APIs play a crucial role in enabling app-to-app communication and enhancing human interaction, and the Postman platform has highlighted several that are pivotal in the future of communications. Notable entries include Vonage, which offers a scalable cloud communications platform for voice, messaging, video, and data; Courier, which facilitates multi-channel notifications through a single API; and Twilio, known for democratizing communication channels by virtualizing global communications infrastructure. Africa’s Talking focuses on mobile engagement solutions across Africa, while Slack provides an extensive collection of HTTP methods for building custom workflows and integrations. Twitter's API is noted for its richness in functionality, catering to both hobbyists and businesses, with opportunities for developers to preview and influence future API developments. These APIs, featured by Postman, offer robust solutions for information exchange and are readily accessible for exploration and integration within developer toolkits.

Postman, widely recognized as an API testing tool, offers a diverse array of features that extend far beyond its primary function, enhancing the efficiency and capabilities of users. The Postman API enables users to perform CRUD operations on account data, while the webhooks feature allows triggering collection runs via API calls. Postman Echo serves as a sanity checker and learning tool by echoing back requests, thus facilitating testing of REST clients. The Postman Visualizer allows users to create customizable visual representations of response data using HTML, CSS, and JavaScript. Built-in libraries such as Moment.js, Lodash, and Faker.js are available to simplify scripting tasks. Workflow control is achieved through the postman.SetNextRequest method, enabling conditional logic for request sequencing. Collaboration is enhanced with features like commenting, forking, and shared workspaces, while collection-level settings support the DRY principle. Monitors provide ongoing regression testing by running collections against various environments, and built-in GraphQL support caters to the growing popularity of this query language. Additionally, Postman documentation allows for creative expression through Markdown, enabling the inclusion of images and gifs for a more engaging user experience.

Postman's latest featured list highlights several promising young startups offering innovative APIs that have the potential to disrupt their respective industries. Notion's recently launched public API in beta facilitates workflow automation for pages and databases, while Binance, the largest cryptocurrency exchange by trading volume, offers APIs for spot trading. Symbl.ai provides APIs to integrate AI and machine learning into communication workflows without needing custom models. VideoAsk, from Typeform, uses APIs to enhance interactions through real-time video responses, and Belvo's open banking API enhances secure access to financial data in Latin America, backed by recent Series A financing. These APIs are accessible for free exploration in their respective Postman public workspaces, alongside other featured APIs in the Public API Network.

Postman has enhanced its pull request (PR) experience to streamline collaboration and review processes in API development. Initially launched to facilitate asynchronous contributions via forks and PRs, the tool has seen improvements such as approval capabilities, enforced merge checks, and enhanced navigation. The new PR experience offers a unified view by combining the description and diff tabs, allowing users to efficiently address and resolve comments during reviews. A comments pane in the context bar provides a comprehensive list of all requested changes, enabling users to resolve comments, which then become hidden but remain accessible through filters. Enhanced notifications and direct links to specific comments improve engagement and communication among team members. These updates are designed to support effective collaboration in both private and public workspaces, and further information on version control in Postman can be found in their Learning Center.

The establishment of federally regulated API standards in the U.S. by the Center for Medicaid and Medicare Services (CMS) requires states to implement Fast Healthcare Interoperability Resource (FHIR) APIs to comply with federal healthcare regulations. This initiative, driven by the Interoperability and Patient Access Final Rule and the Interoperability and Prior Authorization Proposed Rule, presents both opportunities and challenges for healthcare providers unfamiliar with API technologies. As states work towards compliance, Postman, renowned for its expertise in APIs, offers support in building FHIR-compliant APIs through the use of the OpenAPI specification. OpenAPI serves as a crucial tool, providing developers with essential documentation, testing frameworks, security protocols, and compliance checklists. It has become a standard across various industries, including healthcare, to ensure APIs meet the CMS's stringent regulations. By leveraging OpenAPI, healthcare providers can enhance the interoperability of their systems, making patient data more accessible and applications more reliable. Postman emphasizes the importance of using OpenAPI to facilitate collaboration, education, and the seamless integration of APIs, ultimately supporting the broader goal of advancing healthcare technology and improving patient experiences.

Setting up a public workspace on Postman involves more than just toggling visibility; it requires following best practices to increase engagement and API adoption. Public workspaces are created to enhance developer onboarding, collaborate with partners, gather feedback, and boost visibility through organic search. Successful workspaces, such as those by Salesforce and Microsoft, use strategies like professional profile pages, dedicated documentation, and promotional methods including blog announcements and demo videos to reduce the "Time to First API Call." Engaging the community through webinars, social media, and contributions to Postman’s blog can also increase a workspace's chances of getting featured by Postman. The Postman team continuously refines its recommendations based on community feedback, encouraging users to share their experiences and insights to optimize their workspaces further.