February 2023 Summaries

Postman has been exploring how developers author or generate API contracts by collecting publicly available OpenAPI artifacts from GitHub and the open web. To tackle the challenge of harvesting open APIs from the web, where not everything has an API, they turned to an API-first scraping solution using the Postman Public API Network. They discovered ScrapingBee, a tool that facilitates data scraping from web pages, including those with JavaScript, and found it effective for parsing OpenAPI files. By utilizing ScrapingBee's features, including a Google Search API folder, Postman was able to efficiently locate OpenAPI artifacts and automate the process, drastically reducing the time needed for their research. This initiative allows Postman to discover new APIs and understand their structures by studying their OpenAPI definitions, with plans to share their findings from this ongoing exploration of the API landscape in the coming months.

Postman, a tool for managing the API lifecycle, significantly enhances developer productivity and accelerates feature release timelines and testing cycles for enterprises. Western Governors University experienced a dramatic reduction in testing time, with sprint cycle testing cut from 96 hours to just five to six hours per Scrum team, and multi-team testing time reduced by 75%. Extend, a product protection platform, saves an hour daily in testing time, while Werner Enterprises in the U.S. saves three hours weekly by streamlining workspaces and workflows. Additionally, Toast saves 95 minutes per engineer weekly, equating to 10 days annually, and Visma has reduced API bug-fixing time from an hour to under 10 minutes. SEI Novus, a global portfolio analytics company, releases new features multiple times a day, a process that previously took weeks, demonstrating how Postman facilitates increased focus on innovation and creative problem-solving across various industries.

Postman has extended its support for examples to its gRPC client, enhancing API documentation and providing a more engaging API experience. This addition allows users to create and store examples of requests and responses, visually representing API functions under different scenarios, which is particularly beneficial when API design is ready but development is pending. Examples enable efficient documentation of both new and existing APIs by capturing real request/response pairs, thus reducing the need for lengthy explanations and allowing users to interactively test potential scenarios. This is especially useful for gRPC requests, as examples preserve the utility seen in HTTP requests while adapting to gRPC's schema-driven nature, supporting various communication patterns like unary and streaming. Postman's features, such as the Generate Example Response button, facilitate faster documentation by creating example responses based on Protobuf definitions, making the documentation process more streamlined and intuitive.

Postman has launched an open beta for its new GraphQL client, designed to simplify and enhance the development environment for GraphQL users by applying insights gained from previous projects like WebSockets, Socket.IO, and gRPC. Recognizing GraphQL's rapid growth and increasing complexity, the new client aims to reduce the learning curve and facilitate easier testing and debugging of queries, mutations, and subscriptions. It features a schema explorer that leverages introspection for effortless schema navigation, allowing users to build queries without additional overhead, and supports both consumers and producers by providing capabilities such as schema loading, test script writing, and team collaboration. The query builder is designed to generate code-ready operations with readable errors for manual entries, while a "split pane" view offers a comprehensive interface with the schema explorer, query builder, and response displayed side by side. Postman encourages users to update to the latest version (10.10) for access and invites feedback from the GraphQL community to enhance the client further, emphasizing its commitment to supporting GraphQL's growth through collaboration with the GraphQL Foundation and ongoing updates aligned with the latest specifications.

Postman has introduced support for server-sent events (SSE) in its platform starting with version 10.10, addressing a popular request from its community. SSE is a protocol that enables real-time communication between a client and server over HTTP/S, which is particularly useful for applications needing low-latency updates such as chat applications and live sports updates. This new feature allows users to test and debug SSE endpoints within the same environment as their other APIs, requiring no additional setup beyond creating a new HTTP request. Postman automatically manages the connection and streams events, displaying them in an accessible format for client-side consumption and inspection. Additionally, an SSE endpoint has been added to the Postman Echo service for users to explore and experiment with the feature. Through this enhancement, Postman continues to solidify its position as a leading API client, offering a seamless experience for developers working with various protocols, including HTTP, WebSocket, and gRPC.

Postman has enhanced its app by introducing customizable keyboard shortcuts, allowing users to create personalized shortcuts for common actions, thereby aligning the experience with their other preferred tools and supporting fully keyboard-operated workflows. Users can customize these shortcuts by navigating to Settings and selecting Shortcuts, where they can modify default actions like using tabs, sending, and saving requests. If errors occur during customization, users have the option to restore individual shortcuts to their default settings or reset all at once with the Restore Defaults button.

The once-contentious API design landscape has largely settled in favor of the OpenAPI format, originally known as Swagger, which emerged victorious in the API specification battles of the early 2010s. OpenAPI's widespread adoption is attributed to its open-source ecosystem, tooling agnosticism, and support from major industry players through the OpenAPI Initiative. While RAML and API Blueprint still exist, their adoption rates lag significantly behind, with OpenAPI being the most widely used due to its ability to both design and document APIs effectively. Companies like MuleSoft and Apiary continue to support their respective formats alongside OpenAPI, though the latter's dominance is reinforced by its rich ecosystem, community backing, and inclusion in platforms like Postman. The OpenAPI Initiative remains open to community involvement to shape its future, emphasizing collaboration over competition to avoid reigniting past specification battles.

Postman has introduced the Private API Network API to enhance automation and efficiency in managing APIs, collections, and workspaces within their centralized Private API Network. This new API allows users to automate tasks such as adding existing APIs to the network, organizing APIs based on tags or specifications, and integrating organizational workflows with the network's elements. By automating these processes, Postman aims to help teams save time and minimize errors when overseeing a large number of API resources, ensuring that resources remain up-to-date and organized. This development is particularly beneficial for growing organizations seeking to maintain smooth operations within their Private API Network.

The Postman API Platform serves as a hub for over 25 million developers to build and integrate APIs, emphasizing collaboration, quality, performance, and security across the API lifecycle. In 2021, Postman launched the Public API Network, which quickly became the largest public API hub globally, supporting over 122,000 public workspaces and 260,000 API collections. This platform facilitates global collaboration and innovation, with notable API collections like Salesforce and Notion being forked tens of thousands of times. Postman's vision of an API-first world is supported by its vast network, enabling developers to create groundbreaking solutions using APIs as foundational building blocks, and ensuring continuous support and resources for those working with APIs.

Historically, hacking referred to making a system perform unintended functions, but today it can also mean creating inelegant solutions or workarounds to problems. Despite its negative connotations, hacking can be a productive way to utilize public APIs for customizing solutions when standard user interfaces fall short. Developers often seek methods to reuse tests and scripts in Postman, a popular API development tool, even though Postman does not provide a direct feature for storing reusable scripts. This article explores using OpenAPI's reusable components to store and execute scripts within Postman. It involves creating custom components in an OpenAPI definition, storing scripts within these components, and using the Postman API to retrieve and execute them, albeit with security risks associated with using functions like eval(). The strategy allows for organizing script groups and sharing them within a team but lacks syntax highlighting and poses potential security vulnerabilities. Other alternatives for storing and accessing scripts, such as using global variables or accessing local files, are also discussed as potential solutions.

An API-first strategy prioritizes the development and design of APIs to maximize value, save time, and reduce costs for organizations. It involves creating APIs that are aligned with the organization's goals, ensuring they are reusable, interoperable, user-friendly, secure, efficient, and pragmatic. An API design-first approach, where the design precedes implementation, is often recommended to achieve these traits. However, API-first does not necessarily mean all APIs will have an API-first design, as not all organizations or APIs are at the same level of maturity. While the ideal is for every API to embody these principles, practical limitations and varying levels of experience may result in different applications of the API-first strategy.

OAuth 2.0 has become a widely adopted standard for API authentication and authorization, known for enhancing security through constraints like short-lived access tokens. Postman users previously faced challenges with manual token regeneration and limited access to identity information via OpenID Connect. Addressing user feedback, Postman introduced two new features: a token refresh capability allowing users to easily renew OAuth 2.0 access tokens without repeating the authorization process, and support for ID tokens that facilitate access to user identity information. These enhancements aim to streamline OAuth 2.0 workflows, improve productivity, and provide a more efficient API client experience. Postman remains committed to continual feature development to optimize user workflows, with updates shared on their blog.

Navigating APIs and Postman Collections can become challenging as an organization grows, due to the increasing number of APIs and collections. To address this, a feature has been introduced that allows users to view the top trending APIs, collections, and workspaces within their Private API Network. This trending view, which updates based on user activity, enables users to sort elements by a trending timeline, making it easier to access the most popular and frequently used elements without needing to remember their exact hierarchy and location. By highlighting the top 20% of in-use APIs, collections, and workspaces, this feature is designed to enhance efficiency and productivity, while also promoting collaboration by showing which elements are being updated by others in the organization.

GraphMan, developed by Escape Technologies, is an open-source command-line tool designed to convert GraphQL schemas into Postman Collections, providing a programmatic alternative to Postman’s built-in graphql-to-postman module. Written in TypeScript and running on the Deno runtime, GraphMan allows users to introspect GraphQL endpoints, generate requests for each mutation or query, and quickly create collections for use in Postman. This facilitates various use cases such as monitoring API uptime, executing tests, collaborating with developers, and documenting APIs. Future developments for GraphMan include the ability to convert Postman Collections back into GraphQL schemas, improved typing in its codebase, and export as an npm package for Node.js compatibility. Additionally, GraphMan integrates with Escape’s GraphQL security platform to identify vulnerabilities in APIs.

Postman is advancing its API platform by integrating features like gRPC, WebSockets, and API governance, while emphasizing collaborative workspaces for teams and organizations. With over 20 million developers using the platform, Postman is addressing the challenge of catering to a diverse user base by simplifying its product packaging and introducing a new monthly versioning scheme for free and self-serve users. The company is enhancing its automation capabilities to support experienced developers and is making the Partner Workspace Viewer license free for Enterprise customers to facilitate collaboration with external partners. Additionally, Postman plans to release a VS Code extension to integrate with developers' workflows, further solidifying its commitment to an API-first approach.

WebSockets provide a protocol for maintaining a persistent, low-latency connection between a client and server, facilitating bidirectional data exchange without requiring repeated requests. This capability makes WebSockets ideal for real-time applications like games, chat apps, financial trading, and IoT data communication. In a tutorial, users learn to create a WebSocket server using Node.js and the 'ws' library, while employing Postman to send and receive messages across the connection. By setting up a local server, users can send CPU load data every second using the 'systeminformation' package and explore modifications such as adjusting message intervals and customizing data sent. The tutorial encourages further exploration of WebSockets in IoT applications and offers additional resources for deeper learning.