April 2023 Summaries

Zoom offers robust tools for remote communication and collaboration, with REST and GraphQL APIs that allow developers to create custom integrations and automate workflows for enhanced functionality. A recent livestream with Zoom developer advocates highlighted the availability of the Zoom public workspace in Postman, featuring over 600 API endpoints that enable developers to build applications interacting with Zoom’s backend. Using Postman, developers can create, manage, and delete resources like users and meetings, while the GraphQL API offers a more flexible approach for querying and interacting with Zoom data. The livestream also covered topics such as authentication with Zoom, understanding Zoom Scopes, and working with both REST and GraphQL APIs, encouraging viewers to engage with Postman's weekly streams for further insights.

API governance focuses on maximizing the value generated by APIs by ensuring they are designed consistently and in the right way, which is key to their effectiveness. A consistent API design ensures that features and operations are harmonious within a single API and across multiple APIs, employing standard naming conventions, error messages, data structures, and security mechanisms. This consistency allows developers to learn and use new APIs more quickly, reuse code efficiently, and reduce the risk of bugs, ultimately enhancing development speed and reducing the need for extensive support. Conversely, inconsistent APIs require more time and effort from developers to address variations in data formats, error feedback, and security measures, leading to more code writing, potential bugs, and increased support demand. By offering a consistent API experience, developers can intuitively understand and utilize the APIs, facilitating faster and more effective integration, which is particularly valuable for public APIs that developers choose to adopt.

The Postman CLI is a powerful tool designed to automate API testing processes, seamlessly integrating into continuous integration and continuous deployment (CI/CD) systems to ensure APIs are functioning correctly before deployment. In a recent livestream with Postman Product Manager Malvika Chaudhary, insights into the design, evolution, and best practices of using automation in Postman were shared, highlighting how the Postman CLI facilitates easier test creation and execution via the command line, and provides detailed reports for informed development decisions. The Postman Collection Runner complements this by allowing entire collections to be executed at once, with the flexibility to schedule runs at specific times, akin to cron jobs, ensuring regular and systematic testing. This integration and automation make the Postman CLI an invaluable asset for developers aiming to streamline their testing processes and deliver quality code efficiently.

Postman has introduced a new Database APIs category in its Public API Network, aimed at simplifying the process of creating applications that interact with databases, whether for websites, mobile apps, or desktop applications. By utilizing these APIs, developers can avoid manually writing queries and instead use tools like MongoDB Data API, which supports standard HTTP methods for CRUD operations and offers features like request validation and rate limiting. Notion API allows seamless integration with Notion databases for automating workflows, while Stargate-Cassandra by DataStax and HarperDB API provide versatile integration options, supporting various protocols and enhancing security and scalability. This curated collection caters to both seasoned developers and newcomers, offering easy integration and real-time data streaming capabilities, and encourages users to fork these APIs into their own workspaces for immediate use.

API testing remains a pivotal aspect of Postman's platform, with both the legacy Newman tool and the newer Postman CLI providing robust testing capabilities. Released in fall 2022 as part of Postman v10, the Postman CLI introduces additional features such as API linting for governance and security, primarily aimed at enterprise users, and a streamlined login process that retains API keys securely. Both tools facilitate running Postman Collections in JSON format or via API key retrieval, with similar command-line arguments for setting variables and processing data inputs. While Newman, an open-source project with a broad community base, allows for exporting collections and has extensive tutorial support, it lacks some of the Postman CLI's newer features and digital signing. The choice between the two largely hinges on specific team needs and preferences, with the Postman CLI offering a modern, compact interface and direct integration into the Postman application, while Newman provides a well-established, community-driven option with comprehensive installation resources.

Postman has introduced several enhancements to improve API documentation workflows, allowing users to customize themes, logos, and SEO tags, alongside enabling dark and light mode toggles for published documentation. These updates aim to offer a more personalized and visually appealing experience, including the ability to set custom colors for different themes and choose a default theme. Users can now upload custom logos for each piece of documentation, enhancing the tailored appearance. Furthermore, the platform emphasizes the importance of SEO by allowing the addition of custom titles and descriptions to improve search visibility. For Enterprise users, a new feature preemptively scans collections for secrets before publishing, providing community managers with insights on potential leaks. These improvements are designed to simplify and enhance the customization and governance of public API documentation.

Postman has introduced a new feature designed to simplify the authentication process for API requests, which is often a significant hurdle for users. This feature automatically identifies if a request requires authentication and assists users in setting it up, particularly streamlining the process for APIs that support OAuth 2.0, allowing users to grant access with a single click. Additionally, users can save authentication details for future requests, eliminating the need to repeatedly authenticate. This innovation aims to enhance the time to first call (TTFC) for public APIs by providing a more seamless experience, thereby allowing developers to focus on building projects without being hindered by complicated authentication procedures. Postman currently supports popular APIs like OpenAI, Notion, and Twilio, with plans to expand its offerings. Users interested in implementing this feature for their public APIs can easily do so by filling out a form through their Postman account and joining a waitlist for more information.

API developers and testers often start with manual testing for debugging and validation, but automation becomes essential for efficiency and scalability. While manual testing allows for control over specific edge cases, automated testing ensures broader coverage and productivity. Transitioning from manual to automated testing can be challenging, but tools like Postman facilitate this process by offering features such as scripting, automated documentation, and monitoring. The API testing process involves understanding API requirements, specifying inputs and outputs, and organizing tests, which can be effectively managed using Postman’s capabilities for creating and editing API requests across various protocols. Testers can author scripts to validate functionality and automate the execution of tests using Postman’s Collection Runner, CLI, or Newman, integrating them into CI/CD pipelines. Viewing results and debugging failures is simplified within Postman, enabling testers to quickly identify and resolve issues, which enhances the overall API development and testing workflow. Strategic planning and the right tools are crucial for transitioning smoothly from manual to automated API testing, leading to increased productivity and improved outcomes for testers and developers.

Postman has introduced new collection templates to enhance API development by providing pre-built, customizable templates that cater to various use cases. These templates are designed to improve productivity by allowing users to quickly implement best practices without starting from scratch. They offer swift onboarding for newcomers to APIs or Postman, making it easier to explore the platform's capabilities. Users can benefit from templates tailored for integration testing, regression testing, RESTful API basics, API documentation, authorization methods, data visualization, and more. The templates can be easily customized and extended to meet specific project requirements, encouraging users to provide feedback to expand and refine their use cases.

API-first design is increasingly advocated by roles like API architects and designers within organizations due to its potential to enhance API efficiency, interoperability, and quality. While developers recognize that API-first can boost productivity and code quality, initial challenges such as increased upfront work, cognitive load, and satisfaction with existing processes can hinder adoption. To overcome these barriers, organizations are encouraged to build awareness of the benefits of API-first, establish governance bodies to create best practices, provide guidelines, offer reusable components, and automate feedback loops. Despite the upfront time and resource investment, once API guidelines and components are established, teams often experience increased productivity, improved code quality, and enhanced user experience. Flexibility is key, as API-first is not a universal solution, and aligning incentives with objectives can further drive adoption.

Postman has enhanced its OAuth 2.0 client capabilities by introducing features such as automatic refreshing of access tokens and the option to use ID tokens, making it easier for users to interact with OAuth protocols. The flexibility and customizability of OAuth 2.0 make it popular for fitting specific authentication server standards, and Postman now allows users to add custom parameters to the various requests involved in the OAuth token generation and refresh flow. These enhancements include the ability to specify whether parameters should be added in the query, request body, or request header, providing a high level of customization for systems with specific configuration needs. An Advanced section has been introduced for complex use cases, allowing users to customize the auth, token, and refresh token requests further. Users can learn more about these features through the Postman Learning Center and are encouraged to provide feedback or request new features via the GitHub issue tracker.

Postman has introduced a new feature that allows users to add JSON comments in the HTTP request body, facilitating more effective API testing and documentation. These comments enable users to include annotations or notes providing context or explanations about the data structure or purpose, without affecting the request when sent. This feature enhances documentation by making the request body more verbose and understandable, aiding team members or external API consumers in integrating with the API. Additionally, JSON comments can be used to add clarity and context to test cases, helping team members comprehend the intent and expected outcomes of the tests. The introduction of JSON comments aims to improve the overall testing and documentation experience in Postman, and users are encouraged to try it and share their feedback through comments or the GitHub repository.

APIs, essential for modern applications, enable communication and data transfer between software components, with REST APIs being a popular variant. The process begins with an API client, which can be a tool or service that initiates API requests prompted by user actions or external events. These requests include key elements like endpoints, methods, parameters, headers, and a request body, which are sent to an API server for processing. The server handles tasks such as authentication, data validation, and interaction with the database, acting as a mediator between the client and database. After processing, the server responds with a status code, response headers, and a response body containing the requested data or error messages. Though REST APIs are prevalent, other architectures like GraphQL and gRPC exist, each with unique components.

API security is a critical concern due to the potential for insecure APIs to expose sensitive customer data, as highlighted by several recent high-profile data breaches. Companies must focus on gaining visibility into their APIs, identifying security gaps, and managing credentials to mitigate the risks of unauthorized data access. Effective strategies include monitoring APIs for anomalous behavior, implementing strong authentication and authorization methods like multi-factor authentication, and using short-lived credentials such as ephemeral tokens. Postman emphasizes the importance of securing APIs through user management, information management, and role-based access control, as outlined in their blog series and guides. To further enhance security, Postman provides features for protecting API keys and leveraging API governance and security capabilities, which are detailed in their resources such as the "Introducing API Security in Postman v10" blog post and the Postman Security and Trust Portal.

Postman's latest update offers enhanced customization of the sidebar to improve user experience by allowing individuals to tailor their workspace according to specific needs and tasks. Users can now configure the sidebar to include or exclude elements such as collections, environments, and history, depending on their workflow requirements. This adjustment aims to bolster productivity by enabling quicker access to frequently used items, enhance organization by allowing related items to be grouped together, and personalize the workspace to align with individual preferences. The new feature underscores Postman's commitment to creating an efficient and enjoyable tool for users, with further customization options anticipated in the future.

Barry Owen, chief solutions architect at Wowza, discusses how developers can quickly start streaming using Wowza Video, Postman, and a 3D printer. The blog post provides a detailed guide on accessing Wowza's platform, forking the Wowza API collection in Postman, and initiating live streams, all within minutes using a free trial. Wowza Video is an API-centric solution designed for developers, offering extensive customization options and video asset management. The platform's functionality relies entirely on the Wowza Video API, now available as a Postman Collection, enabling users to fully leverage Wowza's tools. The process involves obtaining a JSON Web Token (JWT) through a Wowza Video Free Trial, setting up the token in Postman, and navigating through the Wowza API to create and manage live streams. Users can monitor and analyze their streams with webhooks, stream metrics, and various viewership options, although the free trial has limitations on some metrics. The post also features a video demonstration of live streaming a 3D printer, showcasing the flexibility and potential applications of the Wowza Video API.

API performance testing is crucial for ensuring that APIs maintain functionality and reliability under real-world conditions, which is vital for a positive user experience and business success. As APIs form the backbone of modern digital businesses, their performance directly affects customer satisfaction and a company's competitive edge. Postman, a well-known platform for API functional testing, has introduced an early-access release for API performance testing, allowing users to simulate real-world traffic and evaluate API behavior under various loads. This testing helps identify performance bottlenecks, optimize response times, and ensure scalability. A key component of this is load testing, which benchmarks API performance against expected real-world scenarios by simulating multiple users sending requests simultaneously. The early-access Postman feature guides users through setting up and running performance tests to monitor response times and throughput, thereby providing insights to improve API reliability and user satisfaction.

Bruno Lopes, a product leader at Kubeshop, discusses the complexities and solutions involved in API testing within Kubernetes environments. He highlights the challenges developers and QA engineers face, such as restricted access to environments, incomplete documentation, and the need to test multiple API versions, all of which can complicate testing processes. Kubernetes, despite its robust network model, still presents challenges that developers often address by creating Docker-based test runners. Testkube emerges as a solution by acting as a bridge between Postman tests and Kubernetes clusters, simplifying the process of executing API tests without dealing with Docker configurations. It supports various testing tools and offers a centralized interface for test orchestration and reporting, thus enhancing reliability and efficiency in testing. Lopes describes the process of setting up and running API tests using Testkube and Postman, emphasizing the ease of use and robustness of this integrated approach. With capabilities for performance, security, correctness, and uptime testing, Testkube enables comprehensive testing and continuous integration within Kubernetes, allowing developers to confidently validate API behavior and improve deployment velocity.

The OWASP API Security Top 10 2023 Release Candidate highlights the evolving landscape of API security, with a focus on GraphQL due to its growing prevalence among APIs. The updated list includes key vulnerabilities such as Broken Object Level Authorization (BOLA), Broken Authentication, and Server Side Request Forgery (SSRF), emphasizing the importance of robust authentication, authorization, and session management practices. Developers are encouraged to implement proper authorization checks and security measures, such as rate limiting and input validation, to mitigate risks associated with API vulnerabilities. Additionally, new categories like Improper Inventory Management and Unsafe Consumption of APIs underscore the need for thorough documentation and cautious interaction with third-party services. As GraphQL continues to rise in prominence, it is crucial for developers to understand these security concerns and adopt best practices to protect their APIs from potential threats.

Cara Borenstein, co-founder and CEO at Stashpad, highlights the efficiency benefits of using keyboard shortcuts in Postman, a tool for interacting with APIs. She suggests starting by identifying frequently performed actions in Postman, then adopting shortcuts to streamline these tasks. Postman categorizes its shortcuts into Navigation, Manipulation, and Global actions, with key combinations like CMD/CTRL + T for opening a new request tab, CMD/CTRL + Enter for sending requests, CMD/CTRL + W for closing tabs, and CMD/CTRL + (tab number) for switching between tabs. These shortcuts help maintain workflow momentum by minimizing the need to switch between keyboard and mouse. Additionally, Postman offers right-click mouse shortcuts for duplicating, closing, copying, and saving tabs or responses, further enhancing user productivity.

Boris Markovich, co-founder at Ayrshare, outlines how businesses can leverage the Ayrshare Postman Collection to streamline posting across multiple social media platforms, including Facebook, Instagram, LinkedIn, and others. Ayrshare, a leading social media API, allows users to post to ten major social networks from a single platform, simplifying brand building and customer outreach. By using Postman, users can easily create a REST API call to the Ayrshare endpoint, facilitating the publication of posts across linked social accounts. The process involves setting up an Ayrshare account, linking social accounts using OAuth, and utilizing environment variables in Postman to manage API keys securely. Postman Collections provide examples to help users get started, and the tool's ability to generate code in various programming languages aids in integrating these functionalities into users' systems. Ayrshare's comprehensive API offerings, combined with detailed documentation and technical support, allow users to create robust social media management systems tailored to their needs.

API governance is often met with apprehension due to past negative experiences or misconceptions, but it is gradually being recognized for its potential to enhance the value derived from APIs. Establishing effective API governance involves reassuring teams that the governance initiative is supportive, not judgmental, and aims to boost their design skills through ready-to-use design patterns and consulting services tailored to their expertise level. It also emphasizes the importance of respecting API ownership, where governance representatives offer guidelines-based recommendations without imposing decisions, allowing teams to make informed choices. Feedback and active contributions from the API creators are encouraged to improve guidelines continuously, and engaging API experts in the governance initiative helps share valuable knowledge across the organization.

In celebration of World Health Day on April 7, 2023, the article highlights the role of technology, specifically APIs, in enhancing healthcare by offering tools for tracking physical activity, monitoring nutrition, and connecting with healthcare providers. It introduces a curated list of healthcare APIs available on the Postman Public API Network, including Withings APIs for health and wellness data, Change Healthcare APIs for claims and clinical information, DrChrono APIs for EHR data, DrugBank APIs for drug-related applications, and Commure APIs for standardized EHR data exchange. These APIs are designed to streamline healthcare operations, improve patient outcomes, and empower users to develop innovative healthcare applications. The article encourages leveraging these APIs to revolutionize healthcare data access and sharing, suggesting that users can easily integrate these tools into their own Postman workspace to enhance their medical and healthcare apps.

Time to first call (TTFC) is a crucial API metric that can be significantly improved through the use of Postman Collections, which facilitate quicker and more efficient developer onboarding by providing a familiar and executable format for API requests. The blog post highlights that while all APIs typically have documentation, the presence of well-structured collections can reduce cognitive load and expedite the first successful API call, as demonstrated by quantitative results showing developers are 1.7 times faster with Company A's API when using a collection. Despite the benefits, many API producers have yet to publicly share collections due to competing priorities and unclear responsibilities within organizations. The post encourages API publishers to consider collections as an integral part of the developer experience and provides guidance for creating effective onboarding experiences.

API platforms are critical in modern software development, as they facilitate an API-first approach by leveraging private, partner, and public APIs. G2's extensive evaluation of these platforms highlights their importance, with Postman emerging as the "Best API Platform" in G2's 2023 Spring Reports. Postman achieved this recognition by scoring impressively with an 834 review count, a satisfaction score of 93, and a market presence score of 92, contributing to a G2 score of 92. This accolade underscores Postman's role as a comprehensive tool for developers to design, build, test, and monitor APIs, allowing collaboration through shared workspaces and a Private API Network. The significance of API-first strategies is increasingly evident as developers globally utilize Postman for discovering and working with new public APIs.