Apisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman.
summary
Shows how to turn an Open API v3 YAML spec into automated checks that catch spec errors and common API flaws. Uses Postman: fork the contract test generator collection and environment, run it in a workspace (requires a Postman API key) and it generates dozens to 500–600 tests that validate spec conformity, schema and examples. Adds a documentation leaking credentials scan, behavior tests that assert query param user_id equals response user_id and field-count checks for excessive data exposure, and Postman monitors/CLI for CI alerts.
AI-written summary · about
chapters (9)
- 0:00API contract testing basics
- 2:13API contracts and security
- 5:23Producer-side contract testing
- 12:48Consumer-side validation techniques
- 21:41Automating security testing in CI/CD
- 23:26Q&A on governance and docs
- 30:09Cadence for security validation
- 34:23Quick wins for API security
- 38:36Closing thoughts on shifting left
related talks
22mAPI Security Testing with Postman: Best Practices and Techniques
49mTesting Your APIs: Postman, Newman & Beyond
17mAPI Testing Unlocked
28mAPI Security with Postman and Qualys
33mDynamic Test Generation with OpenAPI 3.0
16mElevate enterprise DX with AI-powered and secure API collaboration
18mBreaking the Mold Innovative Approaches to Testing GraphQL APIs
25mAutomation API Testing