December 2023 Summaries

API latency, the time it takes for an API to respond to a request, is crucial for maintaining a positive user experience, and its effective monitoring can prevent user churn. Although often confused with service time, latency should be measured from the client's perspective, encompassing both queue and service times. Elevated API latency can arise from network issues, server overload, inefficient code, third-party dependencies, geographic distance, and throttling. To manage this, best practices include accounting for both queue and service times, monitoring under various scenarios, setting Service Level Agreements (SLAs), testing throughout the API lifecycle, and using code profilers. The Postman API Platform, recognized as the best in API Management, provides tools to test and monitor API response times, visualize performance trends, and integrate with third-party observability tools, thus enabling teams to efficiently manage and reduce latency.

Cross-Origin Resource Sharing (CORS) is a security standard that allows servers to specify which origins can access their resources, refining the same-origin policy (SOP) that restricts resource access to the same origin as the requesting web application. The SOP ensures that origins must share the same host, scheme, and port to access resources, though it is lenient with certain resources like images and scripts. CORS operates through HTTP request and response headers, enabling servers to grant permission for cross-origin requests, which can be categorized into simple and preflight requests based on their complexity and methods used. CORS enhances security by preventing unauthorized access through explicit permissions, supporting cross-origin authentication, and facilitating API integration, thus allowing secure interaction with external APIs. Implementing CORS effectively involves avoiding cache poisoning by setting appropriate Access-Control-Max-Age durations, explicitly specifying allowed origins, methods, and headers, and ensuring the inclusion of necessary CORS headers to prevent security risks. Proper documentation and secure credential validation are essential to maintain security and provide a reliable developer experience.

True strength in teamwork is exemplified through the use of the Postman API Platform, which facilitates seamless collaboration and communication among teams by utilizing features such as Postman Collections and workspaces. Axis Bank has notably improved its information sharing, reducing communication and development times significantly, thanks to streamlined processes for linking API elements and collaborating on integrations. Similarly, Visma benefits from the convenience of collections for debugging, drastically reducing the time needed for bug fixing. The platform also enhances communication at Hathway and Werner Enterprises, where collections provide a unified view that fosters efficient conversations and reduces errors, leading to improved code quality and reliability of API calls. These examples highlight how Postman enhances collaboration and reduces operational inefficiencies across diverse industries.

Postman Senior Engineer Hemendra Kumar, part of the Workspaces squad, shares insights into how Postman uses its own platform internally to enhance API development and collaboration. The Workspaces team is responsible for developing core systems that facilitate collaboration features like commenting, real-time presence, and sharing APIs securely with partner workspaces. Utilizing Postman's API design, testing, and monitoring tools, the team streamlines workflows, reduces deployment errors, and accelerates onboarding processes. Hemendra emphasizes the importance of using Postman's features to create standardized templates for workspaces, which aids in cross-team collaboration and productivity. He notes that leveraging Postman's tools has not only improved internal processes but also provided valuable insights into customer behavior, enhancing the platform's development cycle. The internal use of Postman has been embraced by the team without much persuasion, as its effectiveness in streamlining API design and feedback loops quickly became apparent.

Postman has introduced new features to enhance API testing, including the Postman CLI and API performance testing, and now has released a file storage feature to further improve the process. This update allows users to upload files to the cloud for use in API requests, enabling more diverse and authentic testing scenarios by incorporating various data types in POST requests. The files can be uploaded easily in the form-data or binary sections of a POST request and are instantly accessible for team collaboration, streamlining the management of test data. Additionally, the uploaded files are available in scheduled collection runs, ensuring accurate execution of POST requests with the correct payload. This development is part of Postman's ongoing efforts to expand its capabilities and optimize test data management, inviting users to try and provide feedback on these enhancements.

Postman has launched public workspace metrics to help API publishers gain insights into how developers interact with their APIs, enhancing the overall developer experience. This new feature provides metrics such as collection views, new collection forks, response code distribution, and user authorization issues to track developer engagement and identify areas for improvement. These insights allow API publishers to optimize their APIs by tailoring content and improving documentation, thus reducing barriers to successful API calls. Companies like Salesforce, PayPal, and HubSpot are already leveraging these metrics to refine their developer experience, ensuring smoother and more efficient API interactions. The public workspace metrics are available across all Postman plans, encouraging API publishers to utilize them to enhance their services.

Postman workspaces enhance API collaboration by allowing efficient management of roles and permissions, thanks to two new updates in the Postman API. These updates introduce the /workspace-roles endpoint, which provides a comprehensive view of assignable roles, and the /workspaces/:workspaceId/roles endpoint, which allows users to assign or modify roles using JSON PATCH-compliant requests. These endpoints facilitate onboarding and offboarding, automate role-based workflows, and ensure compliance and auditing by offering centralized management and enhanced security. They also provide benefits such as automation, scalability, and error reduction in role assignments. To utilize these endpoints, users need to obtain API credentials and can start integrating them into their workflows for efficient and secure collaboration.

Postman workspaces are designed to be collaborative environments that facilitate team problem-solving related to APIs, serving as a central source of truth. To enhance organization and scalability in large organizations, Postman has introduced a new feature called Workspace Management in Team Settings, which allows Team Admins or Super Admins to control who can create or approve the creation of team workspaces. This feature enables the implementation of standard conventions for easier discovery and collaboration within companies and is available exclusively to users on Enterprise plans. With this feature activated, only designated users can create team workspaces, while others will require approval, ensuring better organization and access control. Existing workspaces remain unchanged, and this new control applies only to new workspace creation requests.

Sensitive data and credentials present significant security challenges for organizations, and without adequate safeguards, there is a risk of data compromise. Implementing secure secret management practices is essential for protecting sensitive information from unauthorized access or misuse. In response, Postman has introduced a Secret Scanner dashboard specifically for teams on the Enterprise Essentials plan, allowing them to manage risks related to secret exposure proactively. This feature enables super admins to access and resolve all detected secrets, while workspace admins can focus on resolving secrets within their specific workspaces. Users can view detected secrets through the Secret Scanner subsection in Team Settings, filter them by workspace type, and resolve them by selecting appropriate reasons from a drop-down menu. The Postman Learning Center and Trust Center provide additional resources for understanding how to safeguard accounts and data.

Postman has introduced a new user role, the API-level Admin, to enhance control over the API version release process, addressing previous challenges where all API Editors could publish new versions. This update restricts version publishing to API Admins, offering a more streamlined and controlled approach to API version management. By doing so, Postman aims to prevent unintended version releases, reduce errors, and establish clear accountability, which results in better collaboration within development teams. Existing users can implement this change by assigning the API Admin role to designated team members, with workspace Admins being assigned this role by default. This development reflects Postman’s commitment to providing a robust and controlled environment for API development, and users are encouraged to share feedback on this update.

Postman has introduced a new feature called "Migrate to Postman," designed to streamline the process of transferring data from other API clients such as SoapUI, Insomnia, Thunder Client, and Hoppscotch directly into Postman. Previously, users faced challenges migrating data via cumbersome workarounds that often resulted in incomplete data transfer. This new feature aims to simplify the migration process by allowing users to import their data directly within the Postman app, using specific instructions for each API client to ensure a smooth transition. The feature is accessible through the Import option in Postman, enabling users to quickly and efficiently onboard from other clients.

Postman has launched a new feature called Live Preview to enhance the OpenAPI Specifications authoring experience by providing real-time feedback as changes are made. This feature allows users to see immediate updates to their API documentation without the need to constantly switch tabs, save, or refresh documents, thus eliminating guesswork and preventing errors. By offering instant visibility into the results of edits, it helps developers and technical writers identify errors or inconsistencies early on, saving time during troubleshooting. Users can visualize changes to elements such as headers, request bodies, and response examples using an intuitive editor alongside a live preview panel, with the option to maximize the editing space through a full-screen view. Live Preview is available to all users of the Postman API Platform, offering benefits for developers and technical writers looking to streamline documentation and improve collaboration.

Support for attaching environments to APIs published on the Private API Network has been introduced, addressing a previous limitation where only collection environments could be attached. This update allows users to select and update environments for APIs, facilitating faster and more efficient request sending by enabling variable resolution without requiring deep API knowledge. The change aims to reduce confusion in workspaces with numerous APIs and environments, ensuring that the correct environments are paired with the appropriate APIs. Users can attach environments through the Postman API Platform while publishing APIs, using the bulk add flow, selecting environments on published APIs, or utilizing Cloud APIs.

Postman is enhancing its Secret Scanner feature to bolster data security by identifying sensitive information in public documentation and team workspaces. The latest improvements include support for public documentation in the dashboard and reports, the ability to conduct dry runs for custom secret patterns, and summary emails to keep users informed about findings. The Secret Scanner now detects secrets in public documentation across all workspace types, and users are notified via email, in-app, and Slack if their published documents contain secrets. Updates to the Secret Scanner report include a section for unresolved secrets in published documentation, allowing users to address these issues effectively. Admins can set up and test custom patterns for proprietary or third-party tokens not scanned by default, with the option to conduct dry runs before full implementation. Additionally, team admins can subscribe to weekly or monthly summary emails for updates on Secret Scanner findings, accessible through Notification Preferences.

Integrations play a crucial role in the implementation of property and casualty (P&C) core systems, necessitating seamless connections within internal modules and with external third-party systems. As P&C carriers shift from monolithic architectures to microservices, there is an increased emphasis on API consumption and reusability. The Postman API Platform offers several tools to enhance developer experience, such as Partner Workspaces for collaboration with external partners, a Private API Network for internal API discovery and consumption, and monitoring features to ensure API quality and performance. Additionally, features like Live Collections and Postbot, an AI assistant, facilitate API documentation, testing, and optimization. These capabilities collectively enable P&C carriers to improve their API implementations and foster productive partnerships, ultimately enhancing customer experiences for policyholders.

Postman API Platform is instrumental in accelerating release cycles across various industries, particularly in financial services, by enabling faster product updates and feature releases. Axis Bank has reduced its product release cycle from six months to one month, facilitating easier collaboration with partners through Postman Collections, which has significantly increased integrations. SEI Novus can now deploy new features in hours rather than weeks, thanks to Postman's role early in the API lifecycle, allowing for rapid iteration and deployment multiple times a day. OVO has cut its service launch time from two weeks to two days by enhancing developer productivity and confidence in production releases through Postman testing. Meanwhile, Western Governors University has reduced its release cycles from six to nine weeks down to two to four weeks, benefiting from Postman's automation and streamlining capabilities. Overall, Postman offers comprehensive API lifecycle management, improving efficiency and collaboration while supporting faster time-to-market and competitive advantages for businesses.

HTTP (Hypertext Transfer Protocol) is a crucial application layer protocol in the internet's architecture, defining how data is exchanged between clients and servers via a TCP connection. When a browser sends an HTTP request to a server, the server responds with the requested data and metadata, such as status codes and headers, which the browser then renders as web content. HTTP requests are composed of methods like GET, POST, PUT, and DELETE, a URL, headers, and sometimes a body, while responses include status codes, headers, and a body containing the data. HTTP has evolved from HTTP/1.1 to HTTP/2, with improvements such as multiplexing, header compression, prioritization, and server push, which enhance speed and efficiency. Postman is a multi-protocol API platform that aids in working with various HTTP-based API architectures, like REST, GraphQL, and SOAP, by facilitating collaborative API development, testing, traffic capture, and mock API creation.

The Postman API Platform provides a variety of tools and endpoints that allow users to manage and automate their API workflows programmatically. Key features include the management of workspaces, collections, environments, APIs, mock servers, and monitors, which facilitate CRUD operations and enhance collaboration and testing processes. The platform supports integration with CI/CD systems, enabling automated API versioning and publication. Enterprise users have access to additional features such as the Private API Network for internal management, tags for organizing components, Secret Scanner for detecting and managing secrets, SCIM for user provisioning, and audit logs for monitoring team activities. These capabilities make Postman a versatile tool for streamlining API development and governance.

The blog post explores how Postman's internal teams, specifically the Automation Testing squad led by Senior Engineer Aman Khan, utilize Postman tools to enhance API development and testing workflows. Based in India, the team focuses on enabling users to build quality APIs by employing automation testing to ensure confidence amid the evolving API landscape. They actively use Postman Monitors with Slack integrations to conduct regular health checks on APIs, thereby identifying issues before they impact service consumers. Aman emphasizes the value of Postman Collection test suites for regression testing during significant code changes, such as the transition to Role-Based Access Control (RBAC). The team also leverages Postman collections for collaboration and as a repository of API documentation, which aids in onboarding new team members. Looking ahead, Aman expresses excitement about exploring new collaboration and automated testing features within Postman, highlighting the benefits of treating Postman as a comprehensive resource for API management.

JSON Web Token (JWT) is an open standard used for securely transmitting JSON data between parties, primarily in API authentication and authorization workflows. It achieves data authenticity and integrity through encoding and digital signing, with its structure comprising a header, payload, and signature. JWTs can be signed using JSON Web Signature (JWS) or encrypted with JSON Web Encryption (JWE), depending on whether the focus is on authenticity or confidentiality. A key advantage of JWTs is that they allow for stateless authentication, meaning servers do not need to maintain session state for users, which is beneficial in distributed systems. JWTs are compact, interoperable across different platforms, and useful for cross-domain communication. However, they also present challenges such as potential security risks if not handled properly, the lack of a built-in invalidation mechanism, and the difficulty in securely storing them on the client side. Best practices when working with JWTs include keeping payloads small, validating and verifying tokens, using secure libraries, and implementing token expiry to enhance security.