September 2022 Summaries

Postman Collections are a versatile tool for organizing and managing API requests, utilized by over 20 million users to streamline API workflows such as mocking, monitoring, testing, and documentation. These collections are structured in an open-source JSON format that provides both machine- and human-readable representations of APIs, allowing for seamless collaboration and lifecycle management. Collections facilitate the creation of comprehensive API workflows by offering a portable, shareable, and executable format that supports various API definition formats like OpenAPI and RAML. They serve as foundational elements for API contracts, enhancing the quality and interoperability of APIs across different environments. With tools like Newman and Postman CLI, collections can be run in various environments, integrated into CI/CD pipelines, and used for automation testing. The open-source nature of the collection schema, available on GitHub, allows developers to further customize and extend their functionalities.

Eli Cohen, co-founder and CEO of Helios, discusses the integration of Helios with Postman to enhance API observability, troubleshooting, and testing for microservices. Helios uses distributed tracing to provide developers with insights beyond HTTP responses, capturing asynchronous operations and dependencies within microservices systems. This integration allows for immediate feedback and visualization of API call traces, offering end-to-end scenario understanding, which saves developers significant time and effort. Helios also facilitates the rapid generation of parameterized Postman Collections from existing API calls, streamlining testing, documentation, and monitoring processes. Implementing this integration involves adding APIs from Postman to Helios via a step-by-step process, ultimately providing comprehensive API lifecycle management and improving cross-team collaboration.

In a recent episode of the Breaking Changes podcast, the director of Postman Open Technologies interviewed Pia Mancini, CEO of Open Collective, discussing the vital role of open source in the API economy. The Open Collective provides essential funding and infrastructure for open source projects, emphasizing the human and community aspects that drive technological advancement. By supporting diverse projects, including those addressing global challenges like COVID-19 and conflicts, Open Collective highlights the broader impact of open source beyond just technology. This approach fosters a globally distributed network that not only sustains open source projects but also integrates social justice into technological development. The conversation underscored the significance of human networks and the evolving, meaningful nature of open source involvement, encouraging listeners to engage with projects that resonate with their values and interests.

A recent Postman livestream titled "How We Built it: gRPC Support" delved into the technical comparison between gRPC and HTTP-based APIs, such as REST and GraphQL, exploring their design, implementation, and efficiency. REST APIs, typically following HTTP 1.1, are widely adopted due to their straightforward request-response model and ease of understanding, though they can lead to over-fetching or under-fetching of data. GraphQL addresses these issues by allowing clients to specify the exact data they need, though it still operates over HTTP 1.1. In contrast, gRPC, developed by Google, leverages HTTP 2.0 and Protocol Buffers for faster, more efficient binary communication, offering benefits like bidirectional streaming and better performance, particularly for low-power and IoT devices. However, gRPC's complexity and need for additional tooling and libraries for browser support can hinder its adoption, relegating it to more internal applications. While REST remains a strong choice for its readability and simplicity, gRPC provides significant advantages for applications requiring high-performance, multi-language microservices communication.

Editing elements in a Postman workspace requires appropriate access, which can be obtained by either requesting an Editor role or creating a pull request. If you don't have editing permissions, you can request the Editor role from someone with Admin or Editor status in your team's workspace. Alternatively, if the element is in a public workspace or outside your organization, you can create a fork of the element, make the desired changes, and then submit a pull request for review. This process involves forking collections or environments and ensuring your reviewers have access to your fork to evaluate the proposed changes. The workflow is further illustrated in a Postman Level Up video, which provides visual guidance on these methods.

Data has become indispensable across various sectors, yet challenges persist in effectively managing and utilizing it due to the lack of accessible, machine-actionable metadata. Current storage methods, such as databases and files, efficiently handle data processing but fall short in providing context, which limits the potential of machine intelligence beyond basic calculations. This gap in data management can be addressed through metadata standards and best practices, like the GoFAIR initiative, which emphasize capturing knowledge in formats accessible to both humans and machines. Postman is tackling these issues with its Open Data and Research Intelligence (ODRI) initiative, aiming to create an infrastructure that facilitates the delivery of both data and metadata through APIs. This initiative will leverage globally recognized standards, open-source tools, and collaborative efforts with scientific and data communities to transform passive data into an intelligent commodity, thereby enhancing scientific research and enabling effective human-machine collaboration.

Postman, a widely-used tool for API testing, has introduced Postman CLI to automate API testing, enhancing the workflow by integrating with CI/CD systems. This development allows users to run API tests from the command line, perform governance and security validations, and seamlessly log results into Postman for easier debugging and analysis. The CLI's functionalities aim to streamline the testing process, reducing human error and manual effort. With Postman v10, users can generate CLI commands effortlessly and integrate Postman APIs directly with Git repositories, enabling direct work on branches without needing to export collections manually. The new Runs tab provides comprehensive test reports, supporting collaboration among team members by allowing them to share and access test results easily. These advancements are designed to simplify automated test execution, ensuring quality and consistency in API development and deployment.

Postman workspaces provide a collaborative environment where teams can work together with real-time updates to collections, environments, and tools, using features like comments for sharing ideas and feedback. These versatile workspaces accommodate a range of tasks, from onboarding developers to API design and development, with companies such as Salesforce and Microsoft utilizing public workspaces to share their APIs and streamline developer onboarding. Introducing Partner Workspaces with Postman v10, the platform aims to facilitate collaboration with external partners by providing a secure, access-controlled space, solving challenges posed by organizational boundaries and outdated tools. Partner Workspaces allow organizations to invite select partners who can view or edit workspace elements, send requests, and add comments, while the Partner Manager role oversees partner access and the management of these workspaces. This new feature is designed to ensure that both internal teams and partners remain aligned as APIs evolve, and offers detailed logging of workspace activities to maintain security and compliance.

APIs are widely used across organizations, and their growing adoption has brought about significant security challenges, as highlighted by recent industry reports. Postman's 2022 State of the API report noted a substantial increase in API collections and requests, with the trend expected to continue, yet security remains a major concern. A Gartner report indicated that insecure APIs were a leading cause of security incidents in 2021, while other research showed many organizations lacked a robust API security strategy. In response, Postman has integrated new security features into its platform, aligned with the OWASP API top 10 guidelines, to help organizations manage API security effectively. These features allow developers to follow security policies within their existing workflows, provide tools for monitoring security violations, and include options for customizing security rules as per organizational needs. Postman also offers integration with CI/CD pipelines to automate security rule checks, encouraging a comprehensive approach to API security. The platform's enhancements aim to provide organizations with the resources needed to implement and monitor API security strategies, enabling them to address vulnerabilities proactively.

Postman's latest update, version 10, enhances the discoverability and usability of private APIs within organizations by redesigning the Private API Network. This update aims to mitigate the challenges of API discoverability due to the proliferation of private APIs, which often lead to redundancy and resource wastage. Postman introduces features such as collaborative workspaces and collections, which streamline API organization, reduce developer onboarding time, and enhance API reuse. The new interface allows teams to publish workspaces and collections alongside APIs, providing a comprehensive view of their API ecosystem. Key improvements include human-readable API documentation, dynamic examples, the ability to fork collections directly from the network, and enhanced governance through an expanded approval flow. These features collectively improve the efficiency of API management, enabling developers to navigate, explore, and utilize APIs more effectively.

Postman's journey to integrate gRPC support began with a highly requested feature on GitHub, eventually leading to its inclusion in Postman v10. The development process involved collecting feedback from both internal and external users, which emphasized the need for richer features. Postman now offers comprehensive gRPC support, featuring unary and streaming methods, server reflection, multi-file Protobuf handling, collaboration tools, and testing capabilities. These features are designed to enhance the user experience by allowing automatic generation of example messages, managing metadata, and ensuring robust testing through scripts and Chai assertions. The inclusion of automatic mock servers further simplifies the testing process. Postman's collaborative tools, such as synchronizing .proto files and sharing gRPC request histories, are central to its functionality. The team continues to seek user feedback to drive future enhancements and invites interested users to engage with the development team for early access and further learning opportunities.

API governance is essential for maintaining consistent API behaviors across a company's landscape, traditionally achieved through manual reviews that can be error-prone and inefficient. Postman API Governance offers a solution by enabling a shift-left approach, allowing companies to detect and address issues early in the development cycle, thus improving efficiency and reducing costs. Postman provides configurable governance rules, including an out-of-the-box library and the integration of the Spectral linting engine, which supports custom rule definitions for OpenAPI specifications. This governance initiative is embedded throughout the API lifecycle, offering in-app notifications for rule violations and enabling feedback loops between developers and API architects. Postman also facilitates governance during CI/CD builds, allowing for seamless integration and reporting of governance metrics. As APIs evolve, Postman supports the adaptation of governance controls, enabling developers to manage rule violations dynamically and providing reports to assess governance adoption and effectiveness. The platform caters to both novices and advanced API programs, encouraging a consistent and collaborative API development process.

The financial sector, particularly Goldman Sachs, is significantly impacted by the API-first approach, which facilitates innovation while maintaining the stability and predictability that financial institutions require. Chander Shivdasani, vice president at Marcus by Goldman Sachs, highlights the advantages of being "contract-first," enabling the company to leverage legacy infrastructure while remaining agile to develop new business models, reduce friction, and expedite partner onboarding. This approach empowers Goldman Sachs to manage dependencies, standardize processes, and involve both business and technical stakeholders throughout the API lifecycle, fostering a federated approach to API delivery and governance. The investment in a contract-defined API-first strategy helps Goldman Sachs navigate the competitive and regulatory challenges of the financial landscape, offering new opportunities in banking and investment while balancing legacy and next-generation infrastructure. The insights shared by Chander in an episode of the Breaking Changes podcast underscore the transformative potential of APIs in the financial sector, inviting those interested in fintech to explore how this shift is redefining the industry.

Pete Cheslock's guest post explores how AppMap, an open-source tool, can significantly ease the process of managing APIs for applications that were not initially built with an API-first approach. AppMap records an application's runtime behavior to automatically generate OpenAPI definitions, which can be effortlessly imported into Postman Collections, saving developers from the tedious task of manual API definition creation. This functionality allows engineers to see design flaws, security vulnerabilities, and performance issues while also ensuring API compliance by checking that HTTP client requests adhere to the API specifications. AppMap's ability to generate OpenAPI specifications on code branches awaiting review helps developers quickly assess the API impact of proposed changes, reducing the lag in API documentation updates. By integrating AppMap with Postman, development teams can seamlessly transition to an API-first approach, leveraging the comprehensive features of the Postman API Platform to enhance their workflow efficiency.

The survey of over 37,000 developers and industry professionals highlights the critical role of Postman in modern software development, emphasizing its importance for developer satisfaction, efficiency in API-first models, and enhanced collaboration. Postman is noted as indispensable for developers, with 89% expressing dissatisfaction at the prospect of losing access to it, and 81% acknowledging its necessity in enabling API-first development, which correlates with faster production, fewer failures, and quicker recovery from issues. The platform is lauded for facilitating superior collaboration, with 75% of respondents favoring it over other tools, particularly due to its diverse workspaces that enhance team cooperation and efficiency across different stages of API development. Additionally, public workspaces expand the developer experience by allowing global access, feedback collection, and sharing of API projects, with notable usage by companies like Salesforce and Stripe. As API-centric development becomes more prevalent, Postman remains a pivotal tool for over 20 million users worldwide, underpinning happier, more productive development environments.

Postman recently introduced in-place image resizing and caption support in its API documentation editor, following a positive reception of its image storage feature. This enhancement allows users to easily embed images and add captions without relying on markdown or HTML syntax, aiming to improve the documentation editing experience. Postman continues to focus on building a comprehensive API platform, recognizing the importance of effective documentation for API distribution. By incorporating user feedback, Postman aims to help users create more visually appealing and precise documentation, ultimately facilitating better interaction with their APIs.

Peter Shafton, former VP at Twilio and current CTO of ngrok, discusses the transformative role of APIs in modern business during an episode of Breaking Changes. He highlights how APIs have powered significant digital shifts, such as those seen with Uber and DoorDash, by enabling meaningful digital experiences beyond simple API-as-a-Product offerings. Shafton emphasizes the importance of simplicity and robust API contracts, particularly as enterprises navigate regulatory changes like GDPR and CCP. He also shares insights on the necessity for enterprises to adapt to new API standards and the potential of an API-first approach to streamline operations and enhance observability. Looking ahead, he plans to continue empowering developers at ngrok by addressing common challenges like security and scalability, reinforcing the critical role APIs play in industry regulation and digital transformation.

The evolution of payment systems has led to a diverse array of payment options, which businesses can now integrate into their own systems using publicly exposed payment APIs. Postman has curated a collection of high-quality, ready-to-use payment APIs available in their API Network, which businesses can leverage for various financial transactions. Featured APIs include Razorpay for managing payments and financial operations, Stripe Developers for supporting online commerce and payment processing, PayPal for fast and secure money transfers, Dwolla for simplifying connections with multiple payment networks, and Brex for offering credit card and cash management solutions. These APIs enable businesses to enhance their financial processes by incorporating features such as payment processing, expense tracking, ACH transfers, and virtual card creation, allowing for quick and efficient integration into applications.

The Postman API Network is the largest public API hub, and its most popular collection, based on the number of forks, belongs to Salesforce, with over 70,000 forks. The Salesforce Platform APIs collection features more than 230 requests, aiding developers in exploring APIs like GraphQL, Metadata, and Connect. Salesforce's success in achieving a high number of forks is attributed to their active developer community and strategic efforts to enhance the developer experience, such as documenting collections, linking documentation to public workspaces, and engaging their community through various channels. These efforts are complemented by continuous updates and responses to common challenges through explainer videos. The blog post encourages API publishers to emulate Salesforce's approach to improve engagement and optimize learning experiences for developers while inviting API enthusiasts to explore the extensive network of APIs available globally through the Postman platform.