November 2022 Summaries

As Salesforce has grown, the company has focused on developing a strategy for sharing its APIs, particularly by leveraging the Postman API Platform to enhance collaboration among developers. Previously utilizing another tool that lacked collaborative features, Salesforce transitioned to Postman, which enables developers to work across different environments without installing software, thus streamlining onboarding and adhering to strict security policies. The platform also supports managing multiple API versions and authentication methods, addressing the challenges of diverse customer-specific API signatures. Postman facilitates improved collaboration by allowing developers to share resources, maintain a single source of truth, and engage with the open-source community, thereby maximizing API visibility and fostering a scalable API development strategy. Salesforce developers are encouraged to start small with API development, iterating based on feedback and collaborating with community members, while publishing APIs in a public workspace to invite contributions and maximize community engagement.

API-first is a burgeoning concept that has sparked much discussion, particularly within the realm of businesses that commercialize APIs or offer them as a product. It pertains not only to selling APIs but also to an approach where APIs and schema are defined and designed before development begins. The application of API-first can vary, raising questions about whether using tools like OpenAPI solely for documentation qualifies as API-first. Theoretical discussions have evolved into practical insights, revealing four main categories of API-first implementation: contract-first, requirements-first, code-first, and API-last, each adapted to fit the unique constraints and workflows of different organizations. These implementations illustrate the diverse interpretations and adaptations of API-first methodologies in 2022.

Hackathons are valuable opportunities for honing API skills, and Postman has hosted events like "Visualize for the Prize" and "The Postman API Hack" to encourage participation. Beginners can find suitable hackathons by utilizing platforms like Devpost with features that filter events based on skill level and eligibility. Teaming up enhances networking and skill development, with tools like Discord and Slack facilitating team formation and communication. Effective teamwork and time management are crucial, with Postman’s collaboration and version control features aiding in organization and efficiency. Additionally, Postman offers resources like the Classroom Program and Student Expert certification to support learning and skill enhancement, and students are encouraged to engage with the Postman Student Community for further opportunities and support.

Phyllo offers a universal API designed to simplify data access for developers working within the creator economy, addressing challenges such as fragmented and unreliable data. By providing a unified API that aggregates user-permissioned data from major platforms like YouTube, TikTok, Instagram, and more, Phyllo enables developers to build solutions for creators without the need to establish individual platform connections. It supports various applications including influencer marketing, financial services, and social identity verification, and provides distinct API products for accessing data on identity, engagement, income, audience, and comments. Phyllo's integration with Postman allows developers to easily test and explore its API capabilities, and the platform has been successfully utilized by various companies to enhance their services for creators.

At the API Specifications Conference, Arnaud Lauret, Postman's OpenAPI Technical Lead, advocated for upgrading from Swagger 2 to OpenAPI 3, emphasizing that OpenAPI 3 is a newer iteration of the same specification. Lauret highlighted several enhancements in OpenAPI 3, including improved hosting and security definitions, flexible data serialization, and support for callbacks and webhooks. He acknowledged the challenges in transitioning, such as tool compatibility, and suggested using OpenAPI 3 as the primary reference while converting back to Swagger 2 when necessary during migration. Lauret stressed the importance of tool support for new specification versions and encouraged collaboration among software vendors to streamline adoption. With comprehensive support, developers can leverage new features and innovate more effectively, making the transition from Swagger 2 to OpenAPI 3 both necessary and beneficial.

Postman has introduced Postman Flows, a low-code, visual programming language designed to simplify the building of API applications by allowing users to create programs using blocks rather than traditional code. This tool enables developers to easily construct applications by dragging and dropping task, data, and logic blocks, which streamline processes like sending HTTP requests and managing data. Initially released in beta with over 150,000 users testing the platform, Postman Flows has garnered valuable feedback to refine its features. The latest release includes improvements like a reduction in block types and cloud execution capabilities via webhooks, enhancing usability and integration with other services. Postman aims to empower its extensive user base by simplifying API application development and fostering a more accessible, API-first world.

Postman has been recognized as a Visionary in the 2022 Gartner® Magic Quadrant™ for Full Lifecycle API Management for the second consecutive year, highlighting its innovative approach to API management. The Postman API Platform is distinguished by its collaborative tools, such as Postman Collections and workspaces, which enhance developer collaboration, and its integration with multiple gateways like Azure API Management, AWS API Gateway, and Apigee, which is seen as the future of enterprise API operations. The platform's Private API Network and Partner Workspaces further advance API discovery and collaboration beyond traditional boundaries, while the growing demand for interoperability with GraphQL, gRPC, and WebSockets reflects a broader trend in API development. Postman's new features in API Security, Governance, native Git support, and the Postman CLI aim to provide a consistent API lifecycle and are designed to integrate seamlessly with existing enterprise tools, thereby enabling high-quality API delivery. As more enterprises adopt an API-first strategy, the Postman API Platform is positioned as a crucial component in digital transformation efforts, underscoring APIs as foundational elements of modern applications.

Manuel Gerding, a product manager at Steadybit, discusses the evolution of software development from monolithic architectures to distributed systems, emphasizing the importance of robust API testing in such environments. He highlights how distributed systems introduce additional error cases due to their reliance on multiple connected services that may not always function smoothly. The blog post outlines a method for integrating Postman's end-to-end API testing capabilities with Steadybit's chaos engineering tools to explore an online shop system's behavior under both normal and turbulent conditions. Using a practical example involving microservices for different product categories, Gerding explains how to create and run a chaos engineering experiment that tests the system's resilience during a rolling update deployment. The experiment uncovers issues in the API response during disruptions, leading to a fix involving Kubernetes configuration adjustments to ensure continuous readiness and functionality. This integration demonstrates the value of combining chaos engineering with API testing to assess and improve system reliability under adverse conditions.

Leibing Guo, a developer advocate at Covalent, discusses the challenges of accessing blockchain data and how Covalent simplifies this process with its unified API. The Covalent API converts unstructured JSON-RPC data from blockchains like Ethereum, Polygon, and Avalanche into structured formats accessible via public REST APIs, enabling developers to easily obtain information about tokens, balances, transactions, and liquidity. This API supports over 40 blockchains and is utilized by more than 40,000 developers, particularly those new to Web3. Covalent has also developed a Postman Collection that allows developers to quickly issue API requests without worrying about parameters and configurations, making it easier to access structured blockchain data. The post concludes by offering guidance on setting up and using the Covalent API within Postman, emphasizing the importance of environment variables for efficient data retrieval and providing additional resources for those new to Web3.

In a conversation with Viktor Farcic, a developer advocate at Upbound, the discussion focused on the concept of "Heroku-like experiences" for developers within enterprises, aiming to simplify and abstract away application and API deployment infrastructure. Viktor advocates for an enterprise environment where digital resources are made available as a buffet of APIs, allowing teams to access infrastructure needs via self-service microservices rather than traditional methods like submitting Jira tickets. This approach emphasizes flattening all services used across cloud and infrastructure providers into standardized internal APIs, facilitating provisioning and automation. The conversation also highlighted the potential of API-automated operations, underscoring APIs as crucial for managing the expanding technological landscape over the next two decades. The insights shared in this discussion can be further explored on the Breaking Changes podcast available on major streaming platforms.

GraphQL, initially developed by Facebook in 2012 to enhance the mobile experience by efficiently delivering data to its iOS app, emerged from the challenges of mobile network constraints and the need to optimize data delivery for mobile applications. The project's inception involved key engineers like Nick Schrock, Lee Byron, and Dan Schafer, who, leveraging Facebook's collaborative engineering culture, created an object graph API that later became GraphQL 1.0. Following its successful implementation in Facebook's News Feed and iOS app, GraphQL gained traction within Facebook and was eventually made public in 2014 at the React.js Europe conference. Although Facebook initially published only a specification document in 2015, the release of GitHub's public GraphQL API in 2016 marked a pivotal moment in its adoption and expansion beyond Facebook, signaling the beginning of what is referred to as "The GitHub Years" in the evolution of GraphQL. This series aims to explore the complete history and development of GraphQL through its different phases, leading to the modern specification known today.

As companies increasingly adopt the "API-as-a-Product" strategy, ensuring the quality and reliability of APIs through rigorous testing has become crucial for maintaining user trust and business value. Postman offers tools to manually validate APIs and automate testing processes to enhance productivity and minimize human errors. With the introduction of Postman Cloud, users can now schedule automated test executions via the Collection Runner, which allows for running entire test suites at specified times and frequencies, leveraging Postman's infrastructure for reliability. This feature supports the use of different environments and data files to test APIs across various stages, such as beta, staging, and production. Users can customize the order of request executions and receive email notifications for any test failures, thereby streamlining the testing process and ensuring consistent API performance. This development is part of Postman v10, which includes new features like gRPC support and API governance, aiming to further empower API developers with enhanced automation capabilities.

In a recent episode of the Breaking Changes podcast, the host conversed with Arun Narayanaswamy from Amadeus Labs about the evolving interplay between APIs and cloud technologies, emphasizing the transformative impact of cloud-native operations on enterprise organizations. Arun shared insights on how companies are increasingly replacing traditional datacenter investments with cloud infrastructures, discussing the challenges and benefits of being cloud-native, multi-cloud, and the importance of FinOps in managing cloud expenses. He also highlighted how a cloud-based approach enhances security and requires a different operational mindset compared to on-premises solutions. This discussion inspired the host to explore Amadeus' innovations and delve into personal projects utilizing APIs from major cloud providers like AWS, Azure, and Google to automate and optimize the API lifecycle and team billing practices. The episode underscores the dynamic nature of digital transformation in enterprises and invites listeners to engage with the content through various podcast platforms and YouTube.

APIs have become crucial to application operations, but they also present significant security risks, as evidenced by a 681% increase in API attacks in 2021. Many of these are zero-day attacks, exploiting APIs that were not security-tested before release, largely due to a shortage of specialized security personnel and inadequate security knowledge among developers. Pynt aims to address this gap by offering an integration with Postman that enables dynamic API security testing, allowing vulnerabilities to be identified and addressed early in the development process. Pynt’s approach focuses on dynamic rather than static tests, using a machine learning-based analysis module to transform API traffic into security tests with a high rate of critical findings and minimal false positives. This integration allows developers to treat security vulnerabilities like any other bugs within their familiar Postman environment. Pynt can be integrated with Postman or the Newman CLI, enabling seamless incorporation of security tests into the CI/CD pipeline without requiring additional configuration.