performing-api-security-testing-with-postman

name	performing-api-security-testing-with-postman
description	Use when using Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writing test scripts for automated security validation, and integrating Postman with OWASP ZAP and Newman for CI/CD security testing.
domain	cybersecurity
tags	["api-security","postman","owasp","automated-testing","security-validation"]
subdomain	api-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Performing Api Security Testing With Postman

Overview

Cybersecurity skill for performing api security testing with postman. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing api security testing with postman"

• "Uses Postman to perform structured API security testing by building collections "

• Building repeatable API security test suites for OWASP API Security Top 10 coverage

• Creating automated security regression tests that run in CI/CD pipelines via Newman

• Testing API authentication and authorization across multiple user roles systematically

• Integrating Postman with OWASP ZAP proxy for combined manual and automated security testing

• Establishing a baseline security test collection for new API endpoints before deployment

Do not use against production APIs without authorization. Postman security testing involves sending potentially malicious payloads.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Postman Desktop or web application with an active workspace
• Target API with OpenAPI/Swagger specification for collection import
• Test accounts for at least three roles: unauthenticated, regular user, admin
• Newman CLI installed for CI/CD integration: npm install -g newman
• OWASP ZAP configured as local proxy (localhost:8080) for Postman proxy integration
• API environment variables for base URL, tokens, and test data

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}