August 2022 Summaries

Postman, recognizing the increasing importance of APIs, has launched the Postman Ecosystem Partner Program to foster collaboration with companies and independent software vendors (ISVs) in building integrated solutions with the Postman API Platform. This initiative aims to enhance the developer experience and increase visibility among Postman's vast user base of over 20 million. The program offers two pathways: integration partners can create joint solutions and potentially advance to become Strategic Partners, which involves developing a native Postman integration. Various tools and functionalities, such as the "Run in Postman" button and Postman API, facilitate these integrations by enabling seamless interaction with API elements, while Newman and Postman Collections SDK support CI build processes and API format utilization. Integration partners benefit from comprehensive documentation, technical support from Postman’s team, and promotional assistance, while Strategic Partners receive additional support and co-marketing opportunities. Some notable integration partners include APImetrics and Workato, while Strategic Partners feature major players like AWS and GitHub.

Postman Open Technologies and other teams are set to have a significant presence at the API Specifications Conference (ASC 2022) in South San Francisco from September 19-21, where API practitioners and enthusiasts will gather to explore the future of API technologies. The conference will feature keynotes and sessions by Postman representatives, such as Jason Desrosiers discussing JSON Schema vocabularies, Joyce Lin examining the challenges of adopting an API-first approach, and Ben Hutton highlighting the practical use and future of JSON Schema. Other sessions include W. Ian Douglas on API contract validations, Meenakshi Dhanani on securing GraphQL APIs, Arnaud Lauret comparing OpenAPI 3.x with Swagger 2.0, Pascal Heus on open data API best practices, and Elegbede Azeez offering insights into the AsyncAPI ecosystem and event-driven architecture. These discussions aim to address critical industry challenges, share best practices, and explore new advancements in API specifications and standards.

Asynchronous APIs, such as WebSocket and gRPC, differ from synchronous APIs, like REST, by allowing continuous data streaming and parallel request handling, which enhances communication between services. Unlike synchronous APIs, which use HTTP for unidirectional data exchange requiring a new request for each data retrieval, asynchronous APIs utilize bidirectional protocols like HTTP/2, enabling persistent connections for ongoing data transfer. This allows applications to remain responsive, processing other tasks while awaiting API responses. Asynchronous APIs can notify applications of resource availability via callbacks, a feature not present in synchronous APIs. The flexibility of asynchronous APIs makes them ideal for microservices and event-driven architectures, where services communicate through message brokers and event subscriptions rather than constant polling. GraphQL, while typically synchronous, can support asynchronous messaging through WebSockets for real-time updates. The gRPC framework is favored for its efficient data streaming capabilities between internal services, supporting better scalability and performance, especially in high-activity applications.

Postman offers a versatile platform for building complex workflows by leveraging its capabilities to extract and integrate data from multiple APIs, thereby enabling the creation of new applications. The blog post explores three distinct methods for constructing workflows within Postman: chaining individual requests, sending asynchronous requests, and looping over requests. Chaining involves sequentially linking requests using environment variables to pass data between them, while asynchronous requests utilize the pm.sendRequest() method to handle multiple API calls simultaneously, reducing redundancy. Looping over requests employs the postman.setNextRequest() function to execute a sequence of requests based on specific conditions or indices, which is particularly effective for managing large data sets. Each method provides developers with different levels of control and efficiency in handling API interactions, encouraging experimentation and optimization. The post concludes with a challenge for readers to fork the collection, apply the discussed techniques, and contribute their optimized workflows for community feedback.

Postman workspaces are collaborative environments designed to enhance team productivity by providing tools tailored for API-related tasks, allowing users such as developers, quality engineers, and product managers to organize and manage their API work efficiently. These workspaces facilitate real-time collaboration, enabling team members to view and interact with the same collections and environments, which fosters faster shared-context building compared to traditional document sharing methods. They include features like automatic versioned history to prevent accidental data loss and the ability to "fork" collections for individual experimentation while retaining links to the original. By offering such flexibility, Postman workspaces help avoid tool sprawl and ensure organizational knowledge is centralized, making them an essential component for companies aiming to establish a comprehensive API platform. These collaborative spaces are available across all Postman plans, with advanced features accessible through the Enterprise plan, and are increasingly seen as a critical step for companies to unlock organization-wide productivity.

DoorDash's Drive API is a white-label delivery solution that enables businesses to offer same-day delivery services using DoorDash's Dasher network, catering to consumer demands for quick and efficient delivery options. Managed by Bobby Abraham, who focuses on enhancing the developer experience, the Drive API was integrated into the Postman Public API Network, allowing businesses to easily access and utilize the API, significantly reducing development time for partners. The integration into Postman's network has streamlined the onboarding process, enabling developers to make their first API calls on the same day of signing up and complete development in under a week. The Drive API's presence in the Postman API Network not only simplifies the process for developers but also opens up new market opportunities for businesses seeking to expand their delivery capabilities.

Postman highlights the advantages of using gRPC for API-first development, emphasizing its speed and reliability, particularly in scenarios where teams are blocked by dependencies on other teams' API endpoints. By utilizing Postman’s API Platform, developers can instantly create mock servers for new endpoints, allowing work to continue seamlessly without waiting for other teams. This feature mitigates common issues like delayed fixtures and unreliable test environments, as Postman’s mock servers automatically stay up-to-date with changes. Additionally, Postman offers a deterministic random number generator for consistent test data and plans to expand automatic mock servers to other protocols, as well as provide scenario-based mocking for enhanced control. The integration of these capabilities aims to make Postman's mock servers an indispensable tool for developers, akin to the necessity of a package manager.

Over the past decade, enterprise organizations have embraced Git-based workflows and continuous integration and deployment (CI/CD) pipelines, establishing a crucial source of truth for managing complex codebases and software development lifecycles. The integration of social and collaborative layers by platforms like GitHub has modernized source control, reducing both technical and human friction, while the evolution of CI/CD pipelines has fostered a continuous mindset that prioritizes repeatable and reliable code deployment. This synergy has led to a widespread automation culture, enabling developers to streamline tasks, automate API-driven workflows, and enhance team velocity in an API-first world. Collectively, these advancements have culminated in the DevOps philosophy, which combines practices and tools to deliver microservices and APIs with increased speed and quality, ultimately driving enterprise organizations to adapt and thrive in rapidly changing industries.

In a recent livestream event, members of the Postman development team, including Technical Lead Josh Wise and Design Engineer Shobhit Katikia, discussed the introduction of gRPC support in Postman, highlighting its differences from HTTP-based APIs. gRPC is a binary-only protocol used extensively in internal-facing microservices due to its support for streamed data, structured payloads, and its efficiency and low latency compared to traditional HTTP APIs. The team showcased upcoming Postman releases and demonstrated new UI changes and enhancements to the API client, discussing how the integration of gRPC support has influenced their engineering strategies. The event also provided insights into the development of new mock server infrastructure, including mock server support for gRPC and the use of "seed" data to regenerate "pseudo-random" content, offering a preview of future changes in Postman.

The Postman Open Technologies team has been examining the state of healthcare price transparency in the U.S., focusing on the impact of federal rules requiring hospitals and insurers to publicly disclose pricing information. Despite mandates from the Center for Medicare and Medicaid Services (CMS) under the Affordable Care Act, compliance has been low, with significant data quality issues reported. Hospitals and insurers are required to post prices in machine-readable and user-friendly formats, but finding and accessing these files remains challenging. A collaborative effort is underway to explore how APIs and improved standards can enhance data accessibility and quality, facilitating compliance and enabling the development of tools for price comparison. The initiative includes creating a public workspace and repository for research and development, aiming to address issues such as registration, data access, transformation, and validation. This effort seeks contributions from data users, providers, and other stakeholders to improve price transparency and compliance across the healthcare sector.

Postman has joined the GraphQL Foundation, enhancing its commitment to open-source API technologies and strengthening its role within the GraphQL community. This partnership aligns with Postman's core values of creating with curiosity, earning trust, and winning together, and aims to support critical API specifications used by its extensive user base. By participating in GraphQL's development projects and working groups, Postman plans to share insights and learn from other contributors to improve its offerings, such as the GraphQL client, and to advance knowledge on API interoperability. The collaboration reflects Postman's strategy to make open-source API technologies more accessible and to contribute to the evolving landscape of GraphQL, including initiatives like GraphQL 2022, GraphiQL 2.0, and schema stitching efforts.

Postman has enhanced its support for gRPC APIs by introducing a robust testing capability, enabling users to write test specifications for all use cases within its familiar interface, similar to testing REST APIs. This development aims to streamline API development and testing processes by providing a user-friendly environment that incorporates a Javascript-based scripting feature, allowing for the creation of both standard and custom tests. Users can easily navigate through the testing process with the help of pre-curated code snippets for common scenarios, while more complex tests can be crafted using the full range of pm.* APIs, including the capability to validate messages against JSON schemas. The improvements extend across various gRPC methods, facilitating comprehensive test specifications within Postman, and further developments are anticipated, including the introduction of saving examples, automatic mock servers, and automated testing workflows.

Successful organizations are increasingly adopting the "shift-left" approach in software development, which emphasizes integrating quality-focused activities early in the process to reduce defects, improve customer satisfaction, and boost team morale. Despite its benefits, many organizations hesitate to implement this strategy due to misunderstandings of its advantages or perceived challenges in altering existing processes. Key to successful implementation is management support, allowing development and quality teams the freedom to experiment and access necessary tools. Postman, a leading API platform, enables organizations to effectively shift left in API development and testing, offering benefits like increased efficiency, reduced software defects, and better application performance. Its features, such as authoring API specifications, generating mock servers, facilitating collaboration on test cases, and monitor-driven API tests, support teams in enhancing productivity and quality. By adopting these practices, companies can achieve significant quality improvements, enhance customer experiences, and foster better employee morale by focusing more on developing new features rather than maintaining defective code.

Postman has enhanced its API documentation process by introducing a new access-control system aimed at improving governance for enterprise users. This system includes a role called Community Manager, responsible for managing the public visibility of workspaces, team profiles, and now, API documentation. API producers and developers can no longer independently publish collection documentation; instead, they must submit a request to community managers, who will receive notifications and can view and manage requests through the Postman app. Community managers have the ability to modify settings and decide whether to approve or deny documentation publication requests, offering increased security and oversight. This feature, available to Postman Enterprise plan users, aims to ensure tighter governance and data privacy on the platform.

Postman public workspaces have become a crucial tool for promoting the adoption of public APIs, with over 75,000 workspaces and 150,000 collections available to more than 20 million users on the Public API Network. Users create these workspaces to boost API adoption and reduce the time to first call (TTFC). To enhance visibility and assess the success of these workspaces, Postman has introduced public workspace summary emails, offering weekly and monthly updates with metrics such as the number of active forks, watchers, and overall views. These insights allow users to evaluate their workspaces' performance and make informed decisions to increase API adoption. Additionally, the summary emails facilitate easy sharing of workspaces on social media platforms like Twitter and LinkedIn, encouraging broader engagement and community involvement.

Intesar Shannan Mohammed, founder and CTO at APIsec, introduces EthicalCheck, a free and automated API penetration testing service designed to integrate seamlessly with development workflows using tools like Postman. EthicalCheck aims to address the shortcomings of traditional, infrequent security testing by enabling continuous and automated security testing, which is crucial as development teams release updates more frequently. By integrating with Postman, EthicalCheck allows developers to run extensive security tests on their API elements by using Postman Collections, covering a wide range of modern attack types as listed in the OWASP API security list. The integration facilitates easier identification and resolution of vulnerabilities, with detailed reports provided to help developers quickly address security issues. This approach not only saves time and resources but also promotes a shift-left mentality, ensuring API security is prioritized throughout the development process.

Postman has introduced a new editor feature that allows users to enhance their API documentation by incorporating rich media such as images and gifs directly from local storage or the clipboard, eliminating the need for external hosting. This feature aims to simplify the creation of visually appealing and informative documentation by storing, retrieving, and displaying media within the Postman editor. It is available across all Postman plans, with reasonable limits on image size and storage to ensure security and prevent misuse. Postman plans to expand this functionality with future updates to include options for resizing images, adding captions, and managing shared media within teams, catering to the growing needs of large teams and organizations for efficient image sharing and management.