September 2023 Summaries

Postman environments allow users to create reusable sets of variables that can be used across different requests and shared with team members, enhancing workflow efficiency and collaboration. These environments enable dynamic request adjustments by pointing requests to the correct server based on the selected environment, with each environment having its own variable values. The Postman API provides endpoints for managing these environments programmatically, offering methods to get, create, update, and delete environments, thus facilitating the handling of multiple environments, particularly when there are numerous collections to manage. The blog post details several scenarios, such as changing a variable's value across multiple environments, finding environments with specific variable values, and merging environments for specific test cases, all of which can be automated using Node.js and JavaScript functions. The examples provided highlight the use of the Axios library for making requests to the Postman API and underscore the ability to streamline environment management tasks through code rather than manual updates.

Postman API Platform has been awarded "Best in API Management" at the 2023 API Awards hosted by API World, celebrating its technical innovation and impact on the global API and integration community. Recognized for simplifying the API lifecycle and enhancing collaboration, Postman is instrumental in the API industry's growth, as emphasized by its co-founder Abhinav Asthana. The award, decided by the DevNetwork API Advisory Board, highlights Postman's influence in the API economy, which has significantly matured over the past decade, enabling professionals to develop future API-driven products and services. The recognition aligns with findings from the 2023 State of the API Report, where a large portion of surveyed API professionals acknowledged revenue generation from APIs, underscoring Postman's leadership in promoting an API-first approach. The platform's success is attributed to the support of its global community of over 25 million developers, which continues to shape its evolution to meet modern needs.

Dylan Huang, co-founder of Konfig, discusses the challenges developers face when integrating products with APIs and highlights the importance of providing a great developer experience through comprehensive SDKs. With examples of successful API companies like Stripe and Plaid, Huang emphasizes that SDKs simplify API integration by offering boilerplate code in various programming languages, thus saving time and reducing errors. However, existing solutions often fail to generate high-quality SDKs, especially without an OpenAPI Specification. Konfig addresses this gap by enabling the generation of SDKs from both OpenAPI Specifications and Postman Collections, offering a CLI tool that integrates with CI/CD infrastructure to produce, test, and publish SDKs efficiently. This tool allows API companies to enhance their developer experience and streamline onboarding, with companies like SnapTrade and Humanloop already benefiting from Konfig's capabilities.

Developer experience (DX) is crucial for the success of web APIs, and as developer preferences evolve, so does the future of DX. Anticipated changes include streamlined onboarding with intelligent sandboxes, instant testing, and more personalized and organized API documentation to reduce information overload. Collaborative platforms will improve API discoverability and integration, while increased standardization and automation, driven by generative AI, will simplify the integration process and enhance security. Monitoring and improving DX over time will become essential, with companies investing in tools and roles like chief developer experience officers to ensure developer satisfaction and productivity. These advancements promise to make the life of an API developer easier and more efficient, with Postman identified as a key platform supporting these innovations.

Postman's Sync service, an integral part of its backend ecosystem since 2014, recently faced storage issues due to its use of AWS RDS Aurora, which has a 128TiB storage limit. With a rapidly increasing data ingestion rate, the team anticipated hitting this limit within 6-8 months, potentially affecting the service's reliability. The Postman engineering team explored several strategies, such as pruning old data and creating dual tables, but these initial methods faced challenges due to MySQL's storage management and the risk of downtime. Eventually, they implemented a three-step approach: removing unused tables, adjusting strategies for append-only tables, and performing cross-cluster replication to safely free up space. This complex operation involved spinning up a secondary cluster (C2) from the main one (C1), executing TRUNCATE operations, and ensuring seamless replication between the clusters. Their efforts resulted in freeing up 60TB of critical database space and reducing the data ingestion rate, all while maintaining platform availability during a designated maintenance window. The team is now focused on designing a next-generation database infrastructure, considering sharding, partitioning, and data isolation to enhance scalability and reliability.

Postman has launched a Project-Based Learning initiative to enhance API literacy among students by guiding them through real-world API projects using Postman. This approach, aimed at the ten thousand students who have earned the Postman API Fundamentals Student Expert certification, involves hands-on learning where students create tangible projects, such as an AI text summarizer app using Replit, Node.js, and the Hugging Face Inference API. The initiative not only provides practical experience in applying API skills but also fosters creativity, problem-solving, collaboration, and teamwork by encouraging students to extend their projects and engage with peers in a supportive community. Moreover, these projects result in a public URL and codebase, allowing students to showcase their skills in developer portfolios. Students and educators can access these modules through the Postman Student Program and Postman Academy, and the program plans to expand with more projects that cater to diverse interests and skill levels.

The Harness the Weather Hackathon, organized by Tomorrow.io and Postman, concluded with the AgroSoil team, composed of Colombian innovators Santiago Viana and Juan Diego Agudelo, emerging as the winners. Their project, "Agrosecurity," aims to enhance the resilience of farmers against climate change by utilizing climate-based insurance policies to protect against financial losses from extreme weather events. Their project stood out for its innovative use of Tomorrow.io’s weather APIs and seamless integration with Postman, earning them a grand prize of US$1000 and a US$100 Postman Swag gift card. The hackathon celebrated the creativity and technical skill of all participants, and organizers expressed gratitude to everyone involved, including judges and partners, for making the event a success.

Microcks, an open-source API mocking and testing tool, has been accepted as a Sandbox project by the Cloud Native Computing Foundation (CNCF), marking a significant milestone in its development. This recognition underscores Microcks' potential to enhance the cloud-native ecosystem and acknowledges the contributions of its core maintainers, Laurent Broudoux and Yacine Kheddache. Supported by Postman, this achievement is expected to accelerate Microcks' growth and impact in providing enterprise-grade solutions in a multi-protocol environment. The community anticipates ongoing contributions and developments from Microcks within the CNCF framework.

Postman has introduced a new feature to enhance API performance testing by enabling users to troubleshoot errors directly within the platform, following feedback from its canary user community. This feature allows users to simulate real-world traffic, identify errors, and understand their root causes without needing to rely on server logs, which can be cumbersome and slow. Users can hover over a graph during a test run to see the top error types, click on error rates for individual requests, and visualize error trends, thus improving productivity. The process involves examining request and response details such as URLs, headers, and bodies to identify and resolve issues. This capability is available in the latest release, and Postman offers up to 25 free performance test runs monthly, with additional runs available through paid plans.

The Postman Secret Scanner enhances data security by scanning for secrets in both team and public workspaces, with integration support from partners like GitHub and GitLab to protect Postman API keys. The feature allows Super Admin, Admin, and Workspace Admin users to view identified secrets, filter them, and access remediation steps for protecting sensitive information. Users can also view resolved secrets and the status of Postman API keys, ensuring compliance and security. The addition of a Secret Scanner Report provides insights into secrets within workspaces, aiding in informed decision-making for security enhancement. Furthermore, users with administrative roles can access Secret Scanner findings via the Postman API to create custom workflows, while further resources and support are available through the Postman Learning Center and Trust Center.

Postman's Private API Network serves as a centralized platform for publishing and distributing an organization's APIs, enhancing discovery and evaluation by allowing users to efficiently search for APIs of interest. Recent updates aim to improve API catalog quality by enabling detailed reviews to identify governance violations before publication. The approval process is streamlined through a documentation preview feature, facilitating issue detection prior to API release. The updates also enhance usability by allowing team members to quickly discover popular and recently added APIs, which is particularly beneficial for onboarding new developers. The search functionality has been integrated with Postman's universal search, offering a more cohesive experience by allowing searches based on request URLs, folder names, or team names. These enhancements equip users with improved tools and workflows for verifying API quality and ease of discovery.

Postman has introduced a revamped system-level proxy feature that enhances its capabilities as a versatile tool for API developers, allowing them to capture HTTP/HTTPS traffic and generate collections from intercepted requests. The new feature, integrated directly into Postman, complements the existing Postman Interceptor browser extension by enabling users to intercept system traffic, such as from the Spotify desktop application, and transform it into organized, testable collections. To start a proxy session, users must install a Root CA to intercept HTTPS traffic, after which they can filter and capture traffic from specific domains. The captured data can be saved, organized by endpoints, and used for testing and documentation purposes, achieving full feature parity with other HTTP/S proxy products. This development aims to make Postman a more comprehensive tool for API inspection and testing, inviting user feedback and engagement.

Postman has introduced new features to enhance the management and security of API keys, particularly addressing the risks associated with exposed keys in public domains like GitHub, GitLab, and Postman's public workspaces. These enhancements allow Super Admin and Admin users to monitor and control publicly exposed API keys through the Manage Postman Keys page, offering details such as the key's name, location, detection date, last usage, and the team member responsible for its creation. Admins can manually or automatically revoke exposed keys, with notifications sent to the key owner via email, and all revoked actions are logged on the Audit Logs page. The auto-revoke feature is accessible to users with Enterprise plans, encouraging those not on such plans to upgrade for improved security. Additional resources for managing API keys and organizational security are available in the Postman Learning Center and Trust Center.

Postman has introduced MQTT support in open beta, allowing users to efficiently test and interact with MQTT APIs for IoT applications such as home automation and industrial monitoring. MQTT, a lightweight protocol ideal for low-bandwidth and real-time scenarios, enables data exchange through topics. Postman's implementation includes features such as SSL authentication, support for MQTT versions 5 and 3.1.1, and the ability to handle various payload types like JSON and Base64. A key feature is real-time data visualization, which provides a clear view of telemetry data without additional configuration, enhancing the understanding of data trends and event publishing. Users can customize visualizations for different topics, and the platform is designed to accommodate both seasoned developers and newcomers. Postman plans to expand MQTT features and integrate typical Postman functionalities, encouraging user feedback for further improvements.

Postman has launched the alpha version of Live Insights to address the challenges developers face in discovering and troubleshooting API endpoints. The initiative aims to provide "real insights" which traditional documentation and current tools lack, by offering detailed information on API usage and errors. As APIs have proliferated, systems have grown more complex, often leading developers to work with systems they don't fully understand. Mainstream observability solutions like AWS CloudWatch and Datadog provide aggregate data but don’t guide users in pinpointing specific issues. Live Insights, particularly through its Live Collections Agent, helps developers quickly identify problematic API endpoints by passively monitoring API traffic and updating Postman Collections with relevant endpoints. The tool is designed to assist developers, even those with minimal experience, in locating and resolving issues within half an hour of use. The alpha version is available for Kubernetes users, with plans to expand to ECS and EC2 users, and Postman invites early adopters to participate and provide feedback.

Tarric Sookdeo, a senior content strategy analyst at Mastercard, discusses the importance of encrypting sensitive data in API requests, even when using mTLS authentication, to ensure data protection throughout its journey to a customer's backend. Mastercard offers encryption-helper libraries in various programming languages, such as Java, Python, and Node, to facilitate this process. The post outlines how to integrate these libraries into the Postman API Platform by sideloading them, configuring pre-request scripts, and using the libraries to encrypt and decrypt payloads. It includes practical steps for setting up the Mastercard Consent Management API in Postman, emphasizing the creation of a project in Mastercard Developers to obtain necessary keys and leverage OAuth. The post also provides a video tutorial to guide users through the process of setting up and using the encryption tools, highlighting the importance of building a config object within Postman's pre-request script environment and utilizing the mcencrypt global variable for encryption tasks.

The essay explores the evolving landscape of developer experience (DX), emphasizing the need to move beyond simple narratives that focus solely on tool abstraction and ease of use. It argues that while tools designed to simplify and automate development tasks have accelerated the creation of larger and more complex systems, they often fail to address the nuanced and heterogeneous environments developers actually work in, sometimes referred to as "rainforests" rather than "planned gardens." The author highlights the Software Heterogeneity Problem, which arises from the reality that modern software systems are inherently complex, involving multiple languages and technologies. This complexity challenges traditional software development life cycles and calls for a shift from mere monitoring to true observability, where developers need tools that help them understand and manage their systems in real time. The essay advocates for designing developer tools that embrace complexity, fit seamlessly into existing workflows, and prioritize providing insights over simplicity. This approach could enhance developer productivity and better support the industry's shift towards decentralized, API-driven, and service-oriented architectures.

E-commerce's growing role in daily life has increased the demand for scalable, secure, and efficient APIs to enhance online shopping experiences. Postman has introduced a new category of APIs in its Public API Network, specifically designed to support the e-commerce sector. Key offerings include the Shiprocket API for automated shipping processes, the Salesforce Commerce API for improved customer experience and business growth, and the DoorDash Drive API for enhanced order management. Other notable APIs include Stuart for same-day delivery optimization, Retail Express for real-time retail management, Klaviyo for personalized marketing strategies, Jet Delivery for advanced tracking and routing, and Shopwired for streamlined inventory and order management. These APIs aim to empower businesses of all sizes to elevate their e-commerce operations, offering tools for developers and entrepreneurs to create superior online shopping platforms.

Jonas Inggbom, director of sales engineering at Curity, discusses advanced OAuth 2.0 authorization flows such as JWT-Secured Authorization Request (JAR), Pushed Authorization Requests (PAR), and Client Initiated Backchannel Authentication (CIBA), highlighting their functionality and usage in obtaining access tokens for API testing. These flows are particularly relevant for testers requiring user-level access tokens and involve complex operations beyond the traditional OAuth 2.0 code flow. Inggbom explains how tools like OAuth Tools can facilitate these processes by automating steps and validating requests, ensuring tokens are securely generated and can be seamlessly integrated into platforms like Postman for further API testing. The article underscores the importance of securing authorization requests and offers insights into the mechanics of these flows, which enhance security and manageability in API testing environments.

OAuth 2.0 is a widely adopted authorization framework designed to allow users to securely share their data across multiple applications without exposing their credentials. Originating from a community effort in 2007 and now managed by the Internet Engineering Task Force, it addresses key security concerns such as credential exposure, unauthorized data access, and lack of revocation capabilities by employing a token-based system. OAuth 2.0 functions through four primary roles: resource owner, client, authorization server, and resource server, facilitating data sharing by granting access tokens instead of credentials. It supports several authorization grant types, including the widely used authorization code grant and the deprecated implicit grant. OAuth 2.0 is celebrated for its benefits, including simplified authorization flows, user data control, and broad industry adoption, yet it also presents implementation challenges such as complexity and secure token management. Best practices for working with OAuth 2.0 involve using short-lived access tokens, limiting token scope, and ensuring secure token handling. The Postman API Platform aids in managing OAuth 2.0 workflows by offering built-in support, automatic token refresh, and features for seamless collaboration and authentication with public APIs.

The newly revamped Postman Interceptor extension, now available for all browsers, enhances developers' ability to capture and analyze web traffic outside the browser environment, offering increased control over API interactions. This tool is particularly beneficial for tasks such as reverse engineering, understanding payloads, and documenting APIs, exemplified by its application in observing Slack's message-sending API. Users can apply domain filtering to selectively capture traffic, sync cookies for authentication, and utilize sessions to organize and review captured requests. Additionally, developers can generate collections from recorded sessions for future reference, enhancing workflow efficiency. The extension can be installed from major browser stores, broadening its accessibility to Postman's extensive user base.

Originally published in Andreessen-Horowitz's Future publication in February 2022, this essay reflects on the experience of building developer tools, highlighting the disconnect between the practices of tech giants like FAANG companies and the reality faced by the majority of developers, referred to as "99% Developers." These developers often work outside high-profile tech firms, dealing with legacy systems and lacking the resources to adopt cutting-edge technologies or emulate the processes of Silicon Valley's elite. The essay argues that the tech industry should acknowledge the diverse needs of different organizations and dispel myths that promote uniformity in development practices. It critiques the aspirational narratives often propagated by developer-influencers and emphasizes the importance of understanding real software environments, where progress is prioritized over perfection. The piece further discusses the challenges of evaluating developer tools based on demos and the pervasive myth of achieving homogeneous tech stacks, advocating instead for embracing heterogeneity and addressing the unique demands of each organization.