December 2022 Summaries

The Postman Student Programs team hosted an "Ask Me Anything" livestream with Arnaud Lauret, Postman's API Governance Lead, to address student inquiries about API design and governance. Lauret, known as the API Handyman, explained his role involves studying API governance, ensuring uniformity in API design, and aiding Postman developers. He shared insights from his experience building the first French open banking API, emphasizing the learning opportunities in API development despite potential failures. The discussion covered critical aspects such as backend and frontend development, particularly for mobile applications, where efficient API design can mitigate bandwidth and battery issues. Lauret highlighted the importance of API governance in maintaining design consistency and security, advocating for API design reviews and workshops to enhance user skills. He also stressed the significance of API security, focusing on controlling access and actions within APIs to prevent unauthorized use and ensure consumer protection.

In 2022, the Postman API Platform experienced significant growth, surpassing 20 million users, which prompted the release of new features and the advanced Postman v10 app to meet the increasing demand. The Postman blog became a hub for diverse content, ranging from tutorials and guest posts to industry stories and commentary, aiming to foster API-first conversations within the global community. The top 10 most-read blog posts of the year covered a range of topics, including the introduction of gRPC support, insights into the API platform landscape, detailed guides on JSON testing and serialization, the release of Postman v10, and celebrating user milestones, all contributed by various Postman team members and partners.

At the API Specifications Conference, Postman Developer Advocate Meenakshi Dhanani discussed the security challenges of designing GraphQL APIs, emphasizing that GraphQL's dual role as both an API and a query language increases its attack surface. Dhanani highlighted the rising number of GraphQL vulnerabilities, as evidenced by searches in the National Vulnerability Database, and identified common attack types such as access control issues, denial-of-service (DoS) attacks, and information disclosure. She stressed the importance of implementing authentication and authorization, using max depth checks to prevent recursive querying, and disabling introspection in production to mitigate these risks. Dhanani also addressed the prevalence of injection attacks, recommending input sanitization and the use of prepared statements to prevent SQL injection, as well as the enforcement of operation name allowlists to avoid log spoofing. Her overarching advice was to ensure robust security measures are in place to protect GraphQL APIs from being compromised, urging developers to prioritize prevention over rectification.

Postman's Guide to API-First highlights the interaction between API producers and consumers throughout the API lifecycle, emphasizing the importance of making APIs readily available for evaluation and integration. Producers can publish a version of their API in Postman, providing a complete, referencable state for consumers to access, evaluate, and integrate into their workflows. The Postman API Network addresses API discovery challenges by cataloging all APIs and their latest versions, streamlining communication and access for both internal and external teams. Consumers can easily discover, evaluate, and integrate APIs by navigating through Postman workspaces or the Private API Network, ensuring they work with the most recent versions while maintaining the ability to review older iterations. The platform facilitates seamless updates and integrations by notifying consumers of new versions, enabling them to incorporate changes into their workflows efficiently. Postman's features collectively simplify the process of making APIs accessible and ensure that consumers consistently engage with the best and latest versions available.

In a recent episode of Breaking Changes, a discussion with Vijay Challa, former CTO and CIO of the Boy Scouts of America (BSA), revealed the organization's sophisticated API-first approach to digital transformation. This strategy is built on a domain-driven design that organizes resources into business domains, facilitating quality, security, and governance. By using APIs, the BSA manages identity and fine-grained access control, striking a balance between accessibility and control while employing "Know Your Developer" to monitor platform interactions. This approach allows the nonprofit to achieve more with fewer resources, highlighting the mainstream adoption and critical role of APIs in enhancing organizational efficiency and innovation.

Chirag Samtani, a product manager at Exotel, introduces their recently published Postman workspace, which includes 10 collections of APIs designed to cater to various communication needs such as calls and SMS. Exotel, a leading customer engagement platform and virtual telecom operator, supports over 50 million daily engagements for more than 6,000 companies. Users can access the Exotel workspace, fork a collection into their personal Postman workspace, and configure environment variables with valid Exotel account details to begin using the APIs. The process involves navigating through the Exotel workspace, forking collections, and setting up the necessary credentials and parameters. The guide emphasizes the importance of keeping collections updated by pulling changes and allows users to suggest improvements through pull requests. Exotel invites feedback and offers a monthly newsletter for updates on their communication APIs.

Postman's Student Programs team collaborated with Senior Developer Advocate Ian Douglas to create a livestream and blog post offering guidance on selecting suitable APIs for student projects. The advice centers on understanding project requirements and goals to determine the appropriate type of API needed, such as a weather API for a weather app. The blog highlights the importance of choosing free, beginner-friendly APIs with good documentation and suggests resources like Twitter’s API v2 and public REST APIs workspace. Additionally, Postman’s Public API Network provides a vast selection of APIs, enabling developers to explore and connect with over 20 million peers. Students can deepen their API knowledge through Postman’s livestreams, YouTube playlists, and certification programs, which can enhance their resumes and professional profiles. Postman also offers educational resources and a supportive Discord community for ongoing learning and engagement.

At the API Specifications Conference, Postman Data Lead Pascal Heus highlighted the critical role of open data standards in transforming raw data into digital knowledge, a process essential for informed decision-making across various domains. He emphasized the challenges of managing data, which often lack accompanying metadata, resulting in researchers spending significant time searching for contextual information. To address this, Pascal advocated for the adoption of machine-actionable metadata standards and the FAIR principles, enabling data to be findable, accessible, interoperable, and reusable. He underscored the importance of collaboration between technology experts and data specialists to develop metadata standards and APIs that bridge the gap between data and knowledge. This collaboration is crucial for realizing a data-driven world that supports efficient research and machine intelligence, ultimately benefiting society and the environment.

Effective API governance is not merely about defining and applying standards; its true purpose is to enable people and maximize the value that APIs provide. Without shared standards, inconsistencies arise in API design, leading to inefficiencies for both designers and developers, and financial drawbacks for provider organizations. Proper governance ensures consistency, making design and integration processes more efficient and appealing, thereby enhancing productivity and increasing revenue. Additionally, API governance encompasses various aspects beyond design, including API product definition, security, and implementation, and can involve methods like automation, workshops, and training. This holistic approach prevents inefficiency and enhances the overall value derived from APIs.

Postman has introduced two-factor authentication (2FA) for all users to enhance account security by adding an extra verification step after password entry, using a time-based one-time password (TOTP) from an authenticator app. This security feature helps mitigate the risk of unauthorized access and includes recovery codes for account access in case of device loss, though each code is single-use. Users can enable 2FA by accessing their Account Settings and using a supported TOTP app like Authy or Microsoft Authenticator, while ensuring recovery codes are securely stored. However, 2FA is limited to password-based logins and not available for Google or SSO-based authentication, although two-factor or multi-factor authentication can be set up with an identity provider. Additional resources and details on account security can be found at the Postman Learning Center and Trust Center.

In a recent episode of Breaking Changes, Taki Hasegawa, a senior machine learning engineer at The Trevor Project, discussed their development of the LGBTQ Crisis Contact Simulator, which uses machine learning powered by GPT-2 to train crisis counselors for the LGBTQ crisis hotline. This initiative offers a hopeful perspective on AI by illustrating its potential to positively impact societal issues through transparent development, starting with a Google AI Impact Challenge grant and evolving based on counselor feedback. The Trevor Project's iterative, product-driven approach involves continuous feedback loops to enhance their machine learning models and applications, aligning with the API-first landscape's trend of rapid technological advancement. A Postman case study highlighted how The Trevor Project uses the Postman API Platform for faster onboarding, collaboration, and API testing, demonstrating how AI and API innovation together can significantly strengthen the LGBTQ community and potentially lead to further advancements.

The International Day of Banks, observed annually on December 4th, highlights the significant role of banks and financial institutions globally, acknowledging their transformative impact due to advancements like publicly available APIs. In celebration, a curated list of high-quality banking and finance APIs is available for exploration with Postman, including workspaces from Axis Bank, PayPal, Stripe, and HSBC, each offering unique tools for app development and payment processing. These APIs allow businesses to integrate comprehensive financial solutions and enhance their applications with cutting-edge payment capabilities, inviting developers to incorporate them into their own toolkits.

"The API-First Transformation," authored by Postman Chief Evangelist Kin Lane, explores the strategic importance of APIs beyond their technical aspects, highlighting their role in driving business innovation and transformation across industries. This 260-page book, organized into sections on creating API strategies, assembling technology, and operational implementation, draws on insights from industry leaders and over a hundred conversations from the Breaking Changes podcast. It underscores the necessity of viewing APIs as products with consumer feedback loops, emphasizing their role in digital transformation and regulatory compliance. Initially inspired by Postman CEO Abhinav Asthana, the book evolved through extensive research and rewriting, aiming to make APIs accessible to business leaders. By sharing narratives from companies like 7-Eleven and the NBA, Lane illustrates the diverse applications and transformative potential of APIs, urging a broader appreciation of their impact on modern business dynamics.

Postman has introduced enhancements to user profiles, allowing for greater customization and personalization. Users can now utilize a markdown-supported "About Me" section to share detailed information about their work, interests, and notable contributions within the Postman community. The platform also features a Highlights section for showcasing specific contributions, either selected by the user or automatically highlighted by Postman. Additionally, the Activity feed provides a comprehensive overview of a user's recent activities, enabling both the user and visitors to track ongoing projects. Public profiles now display all contributions to workspaces, collections, and APIs, making it easier for others to follow and engage with a user's work.