June 2023 Summaries

While developing the Postman Open Technologies Knowledge Base API, the author adheres to an internal API design playbook that encompasses strategy, definition, validation, and specification phases. After completing user interviews in the strategy phase, the author enters the definition phase, focusing on identifying the suitable API architectural style for the project. The document discusses popular architectural styles like REST, GraphQL, gRPC, and SOAP, contemplating their applicability and user needs. A compatibility matrix is created to align the API with the tools that potential users frequently utilize, ensuring that the chosen architectural style is user-friendly and aligns with the data and operations being designed. The analysis reveals that REST is the most compatible choice due to its widespread tool support and suitability for the project's data and operations. The process underscores the importance of aligning the API architectural style with user needs and existing tools for optimal compatibility and functionality.

An API key is a unique identifier used to authenticate clients and grant them access to an API, playing a crucial role in enhancing application security by controlling access to software and data. While not as robust as other authentication methods like OAuth or JWT, API keys help monitor usage, prevent anonymous traffic, and enable collaboration between API producers and consumers. They are commonly used in modern development workflows for tasks such as rate limiting, automating processes, and monetizing APIs through subscription tiers. However, API keys pose security challenges, such as potential exposure and difficult enforcement of access control, necessitating best practices like regular rotation, secure storage, and leveraging additional authentication measures. Postman offers tools to manage API keys securely, including encrypted storage, automatic scanning for exposed keys, and streamlined authentication with popular APIs, emphasizing the importance of finding a balance between convenience and security in API management.

Artificial intelligence is transforming industries by expanding technological possibilities, and the introduction of an AI APIs category in the Public API Network is facilitating access to this potential for developers. Updated on June 28, 2023, this category offers a range of APIs designed to enhance applications across various domains. Mist Cloud APIs provide capabilities in computer vision, natural language processing, and predictive analytics, while Symbl API enables intelligent conversation analysis to extract insights from audio and text. The Rasa X HTTP API simplifies chatbot creation by integrating natural language understanding and conversation management, and the ChatBot API allows for the development of personalized, intelligent conversational flows. Rev AI API offers speech recognition and language processing for transcribing and analyzing multimedia content. With these tools available through Postman, developers can seamlessly integrate advanced AI functionalities into their projects, expanding the horizons of innovation.

Simple Object Access Protocol (SOAP) is a message specification developed in the late 1990s for exchanging information between systems and applications in a structured and formalized manner. Unlike the more flexible REST APIs, SOAP focuses on the message structure using XML and provides extensive guidance on the message's envelope, encoding, requests, and responses. It is known for its extensibility, security, and platform independence, which makes it suitable for applications handling sensitive data, such as financial services and online banking. SOAP supports a variety of transport protocols, including HTTP, SMTP, TCP, and UDP, allowing for flexible data movement. Despite its advantages, SOAP is often slower and more complex compared to REST, lacking support for caching and being less adaptable. Common use cases for SOAP APIs include bank transfers, flight bookings, billing services, and city management, where secure and reliable communication is essential. While SOAP can be slower to evolve and onboard new developers due to its older methods, it remains a dependable option for enterprise-scale applications that require a robust foundation.

APIs are essential not only for developers but also for DevOps and data engineers, particularly in managing cloud infrastructure through programmatic operations. Cloud APIs, such as those provided by major cloud platforms, offer benefits like automation, integration, customization, and control, allowing users to tailor cloud capabilities to their specific needs, manage multi-cloud and hybrid environments, and leverage third-party integrations. The text highlights Google Cloud Platform (GCP) as a comprehensive suite of cloud services, including compute, storage, and machine learning, which can be accessed and managed via APIs. A step-by-step tutorial is provided to help users get started with GCP APIs using Postman, covering aspects like enabling APIs, authentication, setting up cloud resources, and troubleshooting. The guide encourages experimentation with APIs through Postman and offers additional resources for managing multi-cloud environments, noting that similar onboarding collections for AWS and Azure are available or forthcoming.

Generative artificial intelligence (AI) is fundamentally transforming software development and user interactions, with APIs serving as the vital connectors that integrate AI into workflows and user experiences. APIs not only facilitate communication between AI, traditional services, applications, and humans, but also ensure data security and integrity. As AI continues to evolve, data remains its cornerstone, providing the necessary fuel for training machine learning models, while high-quality and relevant metadata enhances data usability and transparency. Postman is at the forefront of these developments, offering a comprehensive platform that supports API design and management, thereby aiding the seamless integration of AI systems. Furthermore, AI can enhance the quality of both data and metadata, enriching datasets and improving data-driven decision-making processes. The symbiotic relationship between AI, data, and metadata underscores the importance of collaborative efforts across these components, which Postman fosters through its environment and contributions to open-source projects.

Software development can be challenging due to interruptions and context switches, but APIs can enhance productivity by facilitating better software building processes. Postman highlights several productivity-improving APIs available on the Postman API Network that can streamline development workflows and encourage deep thinking. The Microsoft Graph API allows integration with Microsoft services via a unified RESTful interface, while the Laravel JSON:API simplifies the creation of RESTful APIs with standardized JSON responses. The Notion API centralizes notes, docs, and project management, enabling customizable workflows that integrate with daily tools. Additionally, the ML Tools for Developer Professionals workspace supports neural network creation and testing, accommodating users of all skill levels. Developers are encouraged to explore these APIs and incorporate them into their toolkits through Postman.

At the prestigious NDC Oslo 2023 conference, a developer relations engineer for GraphQL at Postman delivered a session titled “Don’t Panic: A Developer’s Guide to Building Secure GraphQL APIs,” focusing on empowering developers with best practices for securing GraphQL APIs. The talk highlighted essential security measures such as implementing middleware for authentication and authorization, applying depth checks to limit nested query complexity, conducting query cost analysis to prevent server overload, employing persisted queries to reduce bandwidth and enhance caching, and disabling introspection and error suggestions in production environments to minimize vulnerabilities. Additionally, it emphasized the importance of validating and sanitizing input through custom scalars to protect against malicious data. These insights aim to equip developers with practical strategies to address the unique security challenges of GraphQL, ensuring robust protection for sensitive data.

In Postman, variables are an essential feature that allows users to store and manage values efficiently across collections, environments, requests, and scripts, facilitating collaboration and dynamic workflows. Understanding the distinction between current and initial values is crucial for persisting variables between local sessions and runs. Variables can be managed manually through the variable editor or programmatically using the Postman API, particularly when using collection-based monitors or the command line tool Newman. Users can persist variables throughout collection runs by employing local variables and configuring options to maintain variable values. The process involves updating initial values to reflect current values, thus enabling seamless persistence across different sessions and runs. The ability to access and update variables using the Postman API is crucial for maintaining data integrity, especially when handling sensitive information like API keys within workflows.

Postman's latest update introduces the "Developer-managed groups" feature, which allows Developer roles within an Enterprise team to create and manage user groups, enhancing the efficiency of workspace administration. Previously, only Admin roles could manage groups, but now Developers can assign users to groups, delegate group management, and streamline access to multiple workspaces, thereby reducing repetitive administrative tasks. Existing Admin-created groups remain under Admin control unless delegation is chosen. This feature aims to facilitate the management of medium-sized developer squads by enabling easier group oversight, although it currently restricts role management within Developer roles to prevent unintended role escalation.

Postman has introduced a new feature aimed at simplifying the management of API keys for larger teams, particularly benefiting Super Admin and Admin users by allowing them to view and manage all active API keys within their teams. This enhancement is designed to help administrators maintain compliance and security by enabling the revocation of API keys and control over key creation and expiration at the team level, overriding user-level settings. The feature, available with Postman's Enterprise plan, allows admins to disable key creation, set expiration dates, and revoke all active keys with a single click, streamlining the governance of API keys on the Postman API Platform. For more information on these capabilities, users are encouraged to consult Postman's Learning Center and Trust Center, which provide resources on organizational security and account protection.

Releasing a new API version requires intricate coordination across systems, teams, and workflows, and Postman has traditionally offered a user-friendly interface for developers to manage this process. However, with the growth of API initiatives, manual publishing has become impractical, prompting the introduction of automated version publishing via the Postman CLI. This feature allows users to automate the entire API release process, integrating seamlessly into build pipelines by using specific Postman CLI commands. The CLI supports Git-linked APIs, enabling users to specify paths to collections and schemas within repositories, and offers the same control as the Postman UI. Users can define which collections and API definitions to publish, assign version names, and add detailed release notes in markdown, making the tool a powerful solution for scaling API operations.

Postman has introduced significant enhancements to its API Governance features, addressing challenges faced by large-scale organizations in designing cohesive API governance strategies. The updates include the creation of a new API Governance Manager role, allowing more team members to manage API governance settings and access reports for informed decision-making. Postman has also introduced support for custom functions, enabling developers to create proprietary checks using JavaScript for complex governance requirements. Users can now edit custom governance rules, facilitating easier modifications to achieve desired API linting results. Additionally, Postman has added the OWASP API guidelines to its rule library, allowing users to enforce security policies without coding, thereby identifying and addressing API security risks early in the development process. These improvements aim to help organizations establish a robust and personalized API governance program, enhancing security and consistency across distributed systems.

Postman's Private API Network serves as a centralized repository for an organization's internal APIs, facilitating easier distribution and discovery for developers, which enhances collaboration and API reuse. The latest updates introduce new features, such as folder-level access control with a Folder Manager role, bulk addition of elements, and seamless navigation from documentation to workspace for testing example requests. These enhancements aim to elevate API quality through decentralized curation and provide API producers and consumers with streamlined workflows for distribution, curation, discovery, and evaluation. Network managers can rapidly establish API distribution channels by creating folders and assigning Folder Managers, while API consumers benefit from improved search capabilities and the ability to execute API requests directly from documentation. These innovations empower developers, team leads, and engineering managers to maintain high standards and ensure that only appropriate APIs are published within their organization.

Postman has introduced API performance testing as a feature within its API platform, allowing developers to assess their APIs' behavior under simulated load conditions to ensure optimal performance in real-world scenarios. This capability enables users to run tests using their existing Postman Collections, observing metrics such as response times, throughput, and error rates in real-time. By simulating user traffic patterns, developers can identify bottlenecks, optimize API performance, and ensure scalability, thereby enhancing user experience and maintaining competitiveness in the digital marketplace. The tools allow for configuring virtual user loads and durations, with Postman providing visualizations of key performance metrics and error diagnostics. This feature is designed to be accessible to all API developers and testers, with Postman offering different plans to accommodate varying levels of usage.

Postman has introduced a new schema-to-collection validation feature that aids developers in maintaining alignment between their APIs' implementation and initial design contracts, crucial for both internal and external API consumers. This feature provides comprehensive validation by flagging inconsistencies in both requests and responses compared to the API definition, offering clear warnings and direct links to issues for quick resolution. The validation process includes examining saved examples within requests and validating server responses against the established contract, ensuring that APIs consistently adhere to their designed specifications. By updating to the latest version of Postman, developers can achieve enhanced development precision and control, making it easier to maintain consistency throughout the API development process.

Postman has introduced a new feature called universal tagging, which allows developers to create and assign custom tags to collections, APIs, and workspaces, thereby improving the organization, discoverability, collaboration, productivity, and documentation of API elements. This feature enables developers to logically categorize and efficiently search for elements, saving time and enhancing workflow management, especially in large organizations. Tags can provide contextual information such as API lifecycle stage, environment, and collection type, and they can be used to group elements together for streamlined actions like adding them to the Private API Network. Universal tagging also supports organic discovery processes through Postman's search functionalities, allowing for a more intuitive exploration of tagged elements. This feature is particularly beneficial for organizations aiming to curate APIs for internal catalogs or developer portals, as it facilitates the identification and bulk management of APIs within specific categories.

Organizations are increasingly using Postman to facilitate collaborative API development, allowing team members, partners, and public collaborators to contribute effectively. Postman workspaces and collections enable stakeholders to discuss and contribute to API projects by managing roles and permissions directly within the platform. Administrators can now manage large teams more efficiently with new features such as easy role management and seamless group management, which provide complete visibility into user roles and group memberships on dedicated pages. These enhancements are designed to streamline the process of managing existing team members, invitations, and collaboration requests, especially for those using Postman's Enterprise plan.

Postman Assets Scaffolding (PAS) is a newly introduced tool available in the Postman Public Workspace designed to automate the creation of API assets using OpenAPI Specifications (OAS3). This tool aids in generating Postman resources such as workspaces, APIs, schemas, collections, mock servers, environments, and monitors, while also facilitating the publication of a new API version to a Private API Network. PAS was developed to address customer needs for automating resource creation to enhance user experience and accelerate the time to first API call (TTFC), a crucial metric for measuring API accessibility and usability. The tool is particularly beneficial for API producers who frequently create resources from OAS3 specifications and seek to save time while ensuring consistency. Although PAS currently supports OAS 3.0 in JSON and YAML formats, future updates may include support for other specifications. To utilize PAS, users need to authenticate via OAuth 2.0 for Git repositories and use a Postman API key for API calls. The tool is flexible, allowing users to select specific requests and update necessary variables during the asset creation process. The introduction of PAS is supported by detailed instructions and community support for users who may have questions or require assistance.

The latest addition to the Public API Network is the eSignature APIs category, designed to simplify the integration of electronic signature capabilities into applications, thereby transforming traditional document workflows into efficient digital processes. This curated collection includes top providers like DocuSign, Zoho Sign, SignEasy, Dropbox Sign, PandaDoc, Anvil, and Adobe Acrobat Sign, each offering robust APIs with comprehensive documentation and code examples for easy integration by developers of all skill levels. These APIs enable seamless document signing, workflow automation, and enhanced productivity by eliminating the need for physical paperwork and enabling legally binding electronic signatures. The Postman API Platform encourages developers to explore these options to inspire creativity and innovation, allowing them to create impactful and exceptional applications with streamlined, paperless processes.

A well-designed API should be intuitive, well-documented, and offer comprehensive support resources to facilitate seamless integration into applications. Drawing on insights from the Postman team, a compilation of the top 30 APIs was created based on three core principles: functionality, usability, and developer experience. Functionality reflects how well the API represents the service offerings, usability considers aspects like time to first call and onboarding, while experience focuses on documentation clarity and community support. Prominent APIs such as Stripe, Slack, Plaid, Salesforce, and Twilio are highlighted for their developer-centric design, making integration straightforward and efficient. The list includes various API-first companies and platforms across different domains, offering diverse functionalities from financial services to communication and data management, underscoring the importance of a robust developer experience in API-driven environments.

Greg Bulmash's guest post outlines a tutorial on building a highly performant, scalable, and flexible API using Node.js and MySQL, leveraging their strong developer communities. The tutorial guides users through creating a ToDo API using Postman and OpenAPI 3, starting with setting up a MySQL database in XAMPP, followed by defining the API, adding it to Postman, and coding the API. Postman is utilized to generate Node.js code for the API, and a Postman Collection is created to facilitate sending various requests, such as GET, POST, and PUT, to interact with the server and update the MySQL database. The tutorial concludes with suggestions for further exploration, including adding a DELETE method to the API definition and testing it, thereby enhancing the user's skills in API development and management.

Postman Flows, enhanced by the Flows Query Language (FQL), offers a novel approach to leveraging APIs for business processes without extensive coding by enabling data manipulation and aggregation within an intuitive interface. FQL, integrated within the Evaluate block, aids in performing complex operations on data sourced from API requests, allowing users to create sophisticated expressions and outputs. The text provides nine detailed examples showcasing various FQL capabilities such as aggregations, variable usage, array functions, and working with records, demonstrating how users can perform tasks like data summarization, transformation, and filtering. The examples highlight the simplicity of converting JSON data, aggregating data from arrays, and summarizing by dates, thus illustrating the versatility and power of Postman Flows for rapid application development. The tool is designed to enhance the functionality of APIs across different use cases, from ETL to business dashboards, and is available to users on all Postman plans.

The Postman API Platform extensively utilizes JSON Schema as a fundamental component in its operations, given its widespread adoption as the industry standard for API specifications, used by 72% of respondents in the 2022 State of the API Report. JSON Schema underpins the API specification movement and supports popular frameworks like OpenAPI, AsyncAPI, and RAML, making it integral to API-first development and the design and sharing of APIs. Postman's complex distributed system of microservices uses JSON Schema for modeling interfaces, validating data structures, and conducting end-to-end testing, while also exploring TypeScript annotations to generate API definitions. Beyond backend services, JSON Schema is employed in various capacities such as defining Postman Collection formats, validating custom outputs in Newman command-line tools, and transforming Protocol Buffers schemas into a unified schema language. With JSON Schema's embedded role in Postman's tools, the platform offers features like API specification conversion, advanced OpenAPI editing, and integration with the AJV JSON Schema validator. The Postman API Network, the largest public registry of APIs, is rich with JSON Schema definitions and exemplifies Postman's commitment to the JSON Schema organization as part of the OpenJS Foundation, highlighting its pivotal role in the future of APIs.