July 2026 Summaries

Postman's AI Engineer emphasizes security through a multi-layered, architecture-driven approach designed to mitigate risks associated with autonomous coding agents, particularly focusing on prompt injection vulnerabilities. By treating every input as untrusted and restricting the agent's actions within defined trust boundaries, Postman ensures that even if malicious text is processed, it cannot lead to unauthorized actions. The system employs a defense-in-depth strategy, isolating each task in short-lived sandboxes to minimize impact and excluding credential theft by keeping credentials outside the agent's reach. The focus remains on continuous improvement, with new capabilities undergoing thorough security testing and threat model updates to adapt to evolving threats. Despite these measures, the challenge of indirect prompt injection persists across the industry, prompting ongoing refinement and investment in security practices to align with the expanding capability surface of the AI Engineer.

In recent months, API programs have experienced a paradigm shift as coding agents, rather than engineers, become the primary consumers of APIs. Traditional API documentation and support designed for human developers are often inadequate for these agents, which require machine-readable formats to function effectively. Consequently, many teams have developed AI-Ready APIs, an assessment that evaluates an API's readiness for agent consumption by examining its machine-readability and usability without human intervention. This shift necessitates a two-tiered approach: maintaining robust API Product Foundations for human developers and adding Agent Journey Optimizations tailored for machine consumers. The assessment, developed from extensive fieldwork and research, grades APIs on their ability to be discovered, understood, and operated by agents, offering a roadmap for improvement. This evolution in API consumption underscores the importance of adapting to the needs of coding agents, ensuring APIs remain competitive and integral to business operations in an increasingly automated landscape.

The upcoming release of the Model Context Protocol (MCP) specification on July 28, 2026, introduces a significant change by making MCP stateless, simplifying server management by eliminating the need for sessions and allowing for easier horizontal scaling with load balancers. This change requires server developers to upgrade their systems, with Postman’s MCP Inspector offering tools to test and debug the new stateless transport both before and during the migration process. Developers are advised to maintain dual transport modes for a transition period to ensure compatibility with existing clients while adopting the new protocol. Postman facilitates this migration by automatically detecting the transport type, testing both legacy and new endpoints, and allowing developers to verify the stateless behavior of their servers.

APIs have evolved from mere technical components to crucial elements in strategic decision-making and AI integration, prompting Postman to introduce the Postman Accredited Seller program within its Partner Program. This initiative addresses the need for technical fluency and operational expertise among partners, enabling them to engage in sophisticated customer conversations that go beyond basic API testing to include design consistency, API lifecycle integration, and AI agent readiness. The program includes a Sales Foundations course and AI-powered pitch scoring to help partners effectively communicate Postman’s value proposition and demonstrate their understanding of the platform's capabilities in fostering well-documented and governed API portfolios. As AI agents increasingly rely on APIs, the Accredited Seller badge equips partners to lead in these discussions, capitalizing on the growing demand for AI-ready solutions. Postman's strategic collaborations and achievements, such as its AWS AI Competency and partnerships with Microsoft, underscore its commitment to expanding API governance and agent-readiness, emphasizing the growing importance of these capabilities in modern digital ecosystems.

Postman's secret security model addresses the prevalent issue of credential abuse, which is responsible for 22% of data breaches, by implementing a comprehensive three-layer protection system. Unlike traditional security measures that focus on a single point of vulnerability, Postman scans for secrets at multiple stages: before data is saved, during cloud syncs, and at runtime. The first layer, Local Secret Protection, prevents secrets from being saved inappropriately by scanning data at the moment of saving and moving detected secrets to a vault. The second layer, Cloud Secret Detection, identifies and deletes exposed secrets in public Workspaces and provides reporting visibility for private Workspaces. The third layer ensures that secret values are only exposed when absolutely necessary, using references to vault entries during runtime. Postman offers various storage models, including Local Vault for on-device storage, Shared Vault for team collaboration, and integrations with existing infrastructure to maintain security across different workflows. This multi-layered approach, which includes an option for organizations to manage their own encryption keys, provides a robust defense-in-depth strategy that aims to cover all potential exposure points, making it unique among API platforms.

Quill is an AI-driven agent designed to streamline the content creation process for DevRel teams by automating the research, drafting, editing, and staging of blog posts. The agent was developed to address inefficiencies in the traditional workflow, which involved multiple tools and frequent context-switching. By distinguishing between deterministic workflows, such as saving drafts to Confluence and creating Jira tickets, and non-deterministic tasks that benefit from AI, such as drafting and copy-editing, Quill effectively manages the end-to-end process. Built using Astro AI, the agent employs separate system prompts for each AI task to enhance control and debugging. The development process emphasized the importance of observability and prompt testing, using Postman’s AI Request to ensure the reliability of AI outputs. Quill’s integration into the team has significantly reduced the time spent on each post while maintaining transparency and allowing for ongoing training and adjustments. The blueprint for deploying Quill is publicly available, offering other teams the opportunity to implement and benefit from a similar system.

Postman has achieved ISO/IEC 42001:2023 certification, becoming one of the first companies to earn this international standard for AI Management Systems, which requires rigorous independent audits to ensure transparency and risk management in AI development. This certification underscores Postman's commitment to responsible AI, focusing on risk management, data protection, and compliance within its Postman Agent Mode, where users generate requests and automate workflows. The company has established an AI Governance Council to regularly review AI systems and ensure security and privacy, pledging not to use private data or Postman Collections for AI training. Additionally, Postman implements strict policy frameworks and vendor management to maintain transparency and security, positioning their platform as a mature and responsible AI tool for API development while maintaining user trust.

APIFlow-Bench is a benchmark designed to evaluate the reliability and readiness of AI agents in executing long-horizon, enterprise-style API workflows, focusing on whether they can complete real-world tasks rather than merely produce plausible answers. This benchmark addresses the challenge of "long-chain failure," where a single error in a workflow can cascade into larger issues, by measuring seven distinct competencies such as authentication, error recovery, and state verification. Unlike traditional AI benchmarks that often overlook operational reliability, APIFlow-Bench emphasizes end-to-end workflow completion, ensuring that agents can maintain context, manage dependencies, and recover from errors across multiple steps. The benchmark uses a deterministic grading system supplemented by a parallel LLM verifier to ensure that successful task completion reflects genuine operational capability rather than coincidental correctness. APIFlow-Bench aims to set a new standard for evaluating AI agent readiness in enterprise environments, with a focus on improving agentic reliability and the ability to handle complex, real-world API workflows.

Postman's Developer Relations team utilizes a Claude Code plugin to manage tasks such as writing blog posts, syncing calendars, and tracking event registrations, among others, using 19 distinct skills. A recent audit revealed inefficiencies, including a lack of declared allowed-tools, excessive token usage due to verbose descriptions, and embedded Python scripts within SKILL.md files, resulting in unnecessary token consumption. By optimizing these areas—by trimming descriptions, declaring allowed-tools, and moving scripts to a references directory—the team saved 13,300 tokens per combined run, equating to a modest cost reduction. The audit highlighted the importance of optimizing plugin structures to enhance efficiency, reduce costs, and improve overall functionality, underscoring the need for concise descriptions and progressive disclosure of detailed scripts to ensure that the model's resources are focused on essential tasks rather than extraneous overhead.

Postman's new feature, Share Local Changes, enhances API development workflows by allowing developers to share in-progress work without the need for cumbersome branch pulls or premature cloud pushes. This is achieved through temporary draft workspaces that create a shareable link reflecting the current state of a developer's local files, enabling team members to review and comment on collections, environments, and API specifications directly in their browsers. The feature supports seamless collaboration by allowing changes to be reviewed in real-time, without repository access, and maintains the integrity of permanent workspaces by keeping in-progress work isolated. This solution streamlines the review process, making it more accessible and interactive, and fits into existing workflows by providing a live companion to pull requests, where reviewers can see and comment on the actual API requests alongside code changes.

Postman Live Sessions provide a collaborative environment for real-time editing and execution of API requests within the Postman workspace, allowing users to work together seamlessly without the need for additional configuration like port forwarding or proxy setup. The feature is particularly beneficial for onboarding new engineers, pair debugging local APIs, and guiding external partners through API integrations. During a Live Session, all participants can view and edit the same collection, with changes reflected instantly, and requests run from the host's machine, ensuring that environment variables and secrets remain secure. However, it's essential to be cautious about sharing sensitive data, as all session participants can view response contents. Live Sessions are not sandboxed, so any changes made are permanent unless conducted in a forked workspace. The ability to sync HTTP collections in real time enhances collaboration, though sessions end when the host leaves the workspace.

Postman Agent Mode provides a powerful toolset for developers by introducing pre-written prompt templates, known as recipes, that streamline common API tasks like authentication debugging, collection cleanup, documentation refresh, and compliance audits. These recipes leverage the agent's ability to analyze live data from a user's Postman workspace, including collections, environment variables, and API specifications, to deliver precise and actionable outputs. For example, the Debug Auth Errors recipe helps identify root causes of 401 errors by checking token expiration and authorization headers, while the Collection Cleanup recipe organizes and de-duplicates messy collections. The agent's integration with live test data ensures that API documentation remains up-to-date, and the Compliance Audit recipe enhances security by scanning for hardcoded secrets and personally identifiable information. Users can also create custom recipes by defining specific tasks, contexts, and output formats, although they should be mindful of AI credit consumption and the need to review changes before applying them to their collections.

API governance programs often fail predictably across various industries due to a lack of effective enforcement mechanisms, resulting in inconsistent APIs and a lack of clarity on ownership. Despite well-documented standards, these programs typically succeed only in documentation and not in enforcement, leading to shadow APIs and unmanaged API debt over time. Common pitfalls include governance processes that are external to the development workflow, causing delays that developers circumvent by creating redundant APIs, and a lack of real-time rule enforcement that fails to catch violations early in the design phase. Additionally, AI-driven agents exacerbate these issues by producing API specifications without adhering to existing standards, further complicating governance efforts. Effective governance requires integrating enforcement into the development process, maintaining a real-time inventory of APIs, and ensuring that governance rules apply equally to human and machine-generated specifications. This approach not only addresses immediate compliance and security concerns but also facilitates scalable AI integration by ensuring APIs are in a state that agents can consume efficiently.

Postman's new capabilities—Local Secrets Protection, Postman Shared Vault, and Secrets Resolution—address the common issue of secret leaks in shared API collections by automatically detecting, securing, and replacing sensitive information with variable references. These features aim to eliminate the need for manual discipline in handling credentials, which are often hardcoded and inadvertently shared due to the collaborative nature of Postman collections. Local Secrets Protection runs on user machines to intercept potential secrets before syncing to the cloud, while the Shared Vault allows workspace administrators to manage and control access to stored secrets, ensuring that developers can use variable references without exposing raw values. Secrets Resolution further streamlines this process by automatically updating collections with variable references, enhancing security and collaboration across all Postman plans, including the free one. This system not only secures sensitive data but also integrates seamlessly with external secret managers, providing flexibility for teams managing API keys and tokens.

Postman has achieved the AWS AI Competency in the Agentic AI Tools category, underscoring the importance of robust APIs in the deployment of AI systems. This recognition highlights Postman's role in helping organizations design and manage APIs that AI agents can reliably interact with at scale, addressing the often-overlooked challenges of integrating AI with existing business processes and production data. As AI projects face potential cancellations due to escalating costs and unclear business value, the reliability and governance of APIs become critical, especially in regulated industries. Postman's tools, such as the MCP server and API Governance rules, facilitate the development of well-specified, agent-ready APIs, as demonstrated by PayPal's successful integration of AI with its commerce APIs. Through collaborations with AWS, including integration with Amazon API Gateway and Amazon Bedrock, Postman supports enterprises in bridging the gap between AI experimentation and production, emphasizing that the infrastructure supporting AI systems is as crucial as the AI models themselves.

API specification drift occurs when an API's behavior diverges from its documented specifications, leading to potential failures in client applications relying on the API. A recent experiment tested two AI agents—Claude Code with the Postman plugin and the Postman AI Engineer—on handling API specification drift. The study highlighted the importance of context in AI-assisted development, revealing that while both agents can technically resolve drift issues, their approaches differ significantly. Claude Code, integrated with Postman capabilities, focuses on code-level reasoning, whereas the Postman AI Engineer utilizes the Postman Context Graph to consider broader API lifecycle implications, such as how changes affect teams and systems. This experiment underscores the necessity of context for effective AI reasoning, emphasizing that understanding the broader impact of API changes is crucial for maintaining system integrity. Rather than replacing one another, these AI tools complement each other, with Claude Code addressing code modifications and the Postman AI Engineer evaluating the ramifications of those changes.

The Postman API Catalog has introduced Service Health Scorecards to provide an aggregated health signal for each service, drawing from test pass rates, specification compliance, and production metrics, which is available on the Postman Enterprise plan. This update allows platform teams and API governance leads to monitor service health at the catalog level, streamlining the process by reducing the need for manual checks across multiple APIs. The catalog's layout is now organized around the API development lifecycle, integrating development activity, test results, and production signals into a single view, facilitating better API governance by highlighting services that require attention. To fully utilize these features, teams should ensure their collections run on a schedule and connect API gateways to include comprehensive production metrics, while the new API Catalog endpoints in Postman API v1.39 allow for programmatic data retrieval. Note that the accuracy of scorecards depends on the connectivity of services to relevant data sources, and this feature is exclusive to the Postman Enterprise plan, prompting those on different plans to consider upgrading if this functionality is crucial.