Skip to content

Postman

Service Name: Postman

Service Description: Postman is a popular API platform for building and using APIs. It simplifies each step of the API lifecycle and streamlines collaboration, so teams can create better APIs faster.

Service Address: https://www.postman.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants access to Postman API, allowing management of collections, environments, workspaces, and other Postman resources.

Secret Revokement URL: https://go.postman.co/settings/me/api-keys

Secret Example: PMAK-5ef63f1395e9200d9b4c0897-abcdefghijklmnopqrstuvwxyz0123456789ab

Suspicious Activity Investigation Instructions:

  • Check Postman account for unauthorized API calls or collection modifications.
  • Review Postman activity logs for unusual access patterns.
  • Verify if any collections or environments have been exported or shared unexpectedly.
  • Check for unauthorized workspace members or team additions.

Mitigation Instructions:

  • Sign in to your Postman account.
  • Go to Settings > API Keys.
  • Revoke the compromised API key.
  • Generate a new API key if needed.
  • Review and update access permissions for all remaining API keys.
  • Enable additional security measures like 2FA if available.